Cyber Security Degree Apprentice

Working with Zoho Directory as part of identity lifecycle management: user provisioning and deprovisioning, group-based access control, MFA enforcement and policy tuning, conditional access policies, device trust enforcement, SSO configuration across services, and auditing login activity and anomaly detection. Role-based access mapping, periodic access reviews, and handling privileged accounts separately.

Hands-on with Google Admin Console: OU structure design, device management (Chromebooks and endpoints), context-aware access, app access control, API controls, Data Loss Prevention (DLP) policies, audit log investigation, Gmail routing rules and anti-spoof protection, SPF/DKIM/DMARC alignment, and Vault retention policies. Monitoring suspicious login activity, reviewing OAuth app permissions, handling compromised accounts, and implementing 2FA enforcement.

ServiceDesk Plus administration: workflow creation and automation, SLA configuration, incident categorisation, priority matrices, escalation rules, custom forms and templates, change management logging, and security incident classification. Identifying patterns in incidents, flagging potential security incidents, aligning incident categories with security taxonomy, and coordinating response between IT and SOC with maintained audit trails.

SOC coordination: responding to security alerts, investigating suspicious login events, correlating user reports with SOC notifications, validating phishing alerts, endpoint alert triage, providing contextual information for SOC analysis, and following up on remediation actions. Acting as the operational bridge between internal IT and external SOC monitoring.

DNS filtering, category-based web controls, safeguarding compliance, false positive review and whitelisting process, threat blocking (malware/phishing domains), TLS inspection considerations, and policy exceptions with audit trail. Balancing safeguarding, compliance, and user productivity while reducing exposure to malicious or inappropriate content.

Running vulnerability scans, interpreting CVSS scores, risk prioritisation, patch validation, coordinating remediation with stakeholders, documenting risk acceptance decisions, and tracking remediation timelines. Participating in the risk reduction lifecycle.