Andrew W. Jones

Security Analyst · SOC & Incident Response

Professional Summary

Security-focused IT professional with three years of experience across federal, state, and municipal environments, currently responsible for security alert triage, incident response, and endpoint protection for a 17-department municipal government. Regularly analyzes, investigates, and documents security alerts across Sophos EDR and Microsoft Defender, coordinates containment and remediation for confirmed incidents, and produces investigative documentation for leadership review. CompTIA Security+ certified with daily Microsoft 365 administration, a systems-networking background (Active Directory, Cisco, VLAN segmentation), hands-on PowerShell command-line administration, and scripting experience in Bash and Python. U.S. citizen based in Tifton, GA, currently pursuing a B.B.A. in Cyber Security, with a Public Trust federal clearance history from prior DoD healthcare work.

Certifications & Clearance

Certification: CompTIA Security+ (CE) — earned 09/2021, valid through 09/2027
Clearance History: Public Trust investigation completed June 2022 (Defense Health Agency) — prior federal vetting on record, supports an expedited re-investigation if required
Work Authorization: U.S. Citizen, residing in the United States

Technical Skills

Security Operations: Security Alert Analysis & Investigation, Incident Coordination & Escalation, Investigative Documentation & After-Action Reporting, Phishing & Business Email Compromise Investigation, Endpoint Detection & Response (EDR), Microsoft Defender, Sophos Endpoint Protection

Query Languages & Scripting: Bash and Python scripting for automation and system tasks; PowerShell for command-line/terminal administration

Systems & Networking: Active Directory, Group Policy, Cisco networking, VLAN segmentation, DNS/DHCP, VPN administration, Windows Server, Linux (Ubuntu, Debian, Mint, Arch)

Microsoft 365 & Identity: Microsoft 365 (Office 365) administration, Microsoft Entra ID, Conditional Access, Multi-Factor Authentication, Active Directory account lifecycle management

Vulnerability & Compliance: Vulnerability & patch management, configuration hardening, security awareness training delivery, standard operating procedure (SOP) adherence, shift-change/incident documentation

Professional Experience

IT Specialist — Security Operations

Sep 2024 – Present

City of Tifton — Tifton, GA

Sole front-line security analyst across a 17-department, 19-site municipal government — city hall, police, fire, and public works.

Analyze, investigate, and document security alerts across Sophos EDR and Microsoft Defender for a 293-endpoint environment, escalating or containing confirmed threats within a 30-minute mean response time.
Serve as incident coordinator for security events requiring urgent response — phishing, malware, and unauthorized-access incidents — performing log analysis, scoping affected accounts and hosts, and driving containment and remediation to closure across an average of 160 incidents per quarter.
Generate investigative documentation and after-action notes for every security alert and incident handled, supporting cyber insurance requirements and audit readiness.
Investigate and remediate reported phishing and business email compromise attempts across Microsoft 365, purging malicious mail tenant-wide and resetting compromised credentials.
Provide ongoing security process-improvement recommendations to IT leadership, including a security awareness and phishing-simulation program delivered to 159 staff that reduced simulated phishing click-through from 24% to 21.3%.
Run recurring vulnerability and patch management cycles across Windows and Linux systems, remediating 9 critical/high findings and cutting mean time to patch from 12 to 5 days.

Environment: Sophos EDR, Microsoft Defender, Microsoft 365, Entra ID, Active Directory, Group Policy, Fortinet, Cisco, PowerShell, Windows Server, Linux

Forestry Dispatcher — Emergency Operations · Georgia Forestry Commission, Tifton, GA · Apr 2024 – Sep 2024 — First-line incident coordination and triage for wildfire emergency response, dispatching units and tracking incidents to resolution under sustained high-tempo conditions.

Desktop Support Specialist — Access & Endpoint Compliance

Jun 2022 – Jun 2023

U.S. Defense Health Agency (via Peraton) — San Antonio, TX

DoD healthcare enterprise; work performed under an active Public Trust clearance.

Validated user access and PKI/CAC credentials for DoD healthcare systems, enforcing least-privilege standards and HIPAA-governed handling of protected health information.
Triaged and resolved endpoint and access incidents through ServiceNow across a globally distributed enterprise, ranking in the top 15% of frontline support agents worldwide by resolution time.
Maintained endpoint compliance through patching, configuration baselines, and secure remote support via BeyondTrust Bomgar and Cisco AnyConnect VPN.
Served as subject matter expert and trained 20+ new analysts on secure support procedures, escalation paths, and DoD compliance requirements.

Environment: ServiceNow, Office 365, Active Directory, PKI/CAC, Cisco AnyConnect, BeyondTrust Bomgar

Security Projects

Home Detection & Vulnerability Lab — Built a segmented virtual lab (VMware, VirtualBox) running Windows Server/Active Directory and Linux hosts to practice the full detection-to-remediation cycle: ran authenticated Nessus and Nmap scans, captured and analyzed traffic in Wireshark, validated findings with Metasploit against isolated targets, applied hardening, and documented before/after posture.

Education

B.B.A., Cyber Security (in progress) — University of Texas at San Antonio (Online) · GPA 3.94
Relevant coursework: Telecommunications & Networking, Programming I & II, Cyber I

Expected Jun 2028