MDR & SOC Maturation
Helped bring siloed SIEM and managed EDR together into a single MDR practice, moving the SOC from reactive alerting toward proactive detection and response.
Security Architect · CISSP · Tampa, FL
Mike Fuentes
Building security that bends without breaking.
Cybersecurity team lead with 9+ years in managed security services. I've helped grow a SOC into an MDR practice, I'm currently designing an identity threat detection service, and I build a lot of my own tooling along the way. Still learning something new every week.
- 0Years in security
- 0Clients protected
- 0New-service profit margin
- 0Faster IR ingestion
visitor@mike:~$
Working across
- SentinelOne
- Singularity Identity
- SOAR
- Active Directory
- AWS
- Docker
- Cloudflare
- Python · FastAPI
- NIST CSF
- CIS Benchmarks
01
About
I help turn security capabilities into services clients can actually use.
I'm a security architecture and engineering team lead at a managed security provider (MSSP). I'm an individual contributor who leads projects, and most of what I'm proud of was done with a good team. We brought siloed SIEM and managed EDR together into a unified MDR offering and moved the SOC from reactive toward proactive.
A lot of my work sits between the technology and the business: service design, go-to-market, and the economics of new offerings. I designed our Dark Web Monitoring service on the Flare platform, launched it at a 60% margin, and trained the SOC and sales teams on it. Right now I'm designing a managed identity threat detection and response service on SentinelOne Singularity Identity, which is in beta, and researching SASE and Zero Trust platforms that fit an MSP model.
I'm also a builder. I write internal tools in Python, TypeScript, and PowerShell, increasingly AI-assisted with LLMs and local models, and I try to hold them to the same standards I'd ask of anyone else: threat models, secret scanning, and tested backups. A self-hosted homelab and an Active Directory test lab keep the fundamentals sharp.
I don't know everything, and I like it that way. The thread through my work is curiosity: starting new projects and trying new approaches so we can keep offering better services.
- Now Security Architecture & Engineering Team Lead · All Covered (Konica Minolta)
- Cert CISSP · ISC2
- Focus MDR · identity security · service design
- Builds Python · TypeScript · PowerShell · Docker · AWS
- Base Tampa, FL · Open to advisory & architecture work
02
What I Do
Security Service Design & GTM
Help design, launch, and price managed services. Launched Dark Web Monitoring on Flare at a 60% margin, am taking an identity threat detection service through beta, and am evaluating SASE platforms for MSP multitenancy.
Identity Threat Detection
Designing a managed ITDR service on SentinelOne Singularity Identity. Built an Active Directory test lab and PowerShell test harnesses to validate detections and posture checks before any customer rollout.
SOAR & Automation
Cross-team SOAR and Python automation that cut manual analysis 50%. Built Hyperautomation workflows that route SentinelOne alerts into the right PSA tickets automatically.
Incident Response & Threat Intel
Served as incident commander on partner breaches and helped build an AWS IR stack that cut ingestion 75%. Built a read-only exposure console on the Flare API that surfaces leaked credentials across clients.
AI-Assisted Secure Development
Internal tools in Python, FastAPI, TypeScript, and Docker, including an MCP server that lets AI assistants query the SentinelOne API safely. Secure-by-design from the first commit.
The strongest programs aren't the ones that never get hit; they're the ones built to absorb the hit, recover fast, and come back smarter.
From “Resilience Over Defense”, Cybersecurity Insiders
03
Experience
-
Security Architecture & Engineering Team Lead
Oct 2024 - PresentAll Covered · Konica Minolta
- Lead security architecture and engineering projects as an individual contributor, including SOAR deployments and automations that helped lower operational cost.
- Designed and launched a Dark Web Monitoring managed service on the Flare platform (around a 60% margin) and trained the SOC, engineering, and sales teams on it.
- Built an internal, read-only exposure console on the Flare API (Python, Streamlit) for cross-client rollups and client-ready reports, with rate limiting and export safeguards.
- Designing a managed identity threat detection and response (ITDR) service on SentinelOne Singularity Identity, from strategy and service design through a beta posture review.
- Built an Active Directory test lab and PowerShell test harnesses to validate identity detections and posture findings before customer rollout.
- Built Hyperautomation workflows that route SentinelOne alerts into ConnectWise PSA tickets with the right type and priority.
- Built a Python client and MCP server for the SentinelOne API so analysts and AI assistants can query the console from one place.
- Researched SASE and Zero Trust platforms for a potential managed offering, focusing on MSP manageability and multitenancy.
- Helped bring siloed SIEM and managed EDR together into a unified MDR offering, and support and mentor SOC teammates on technical and career growth.
-
Senior Cybersecurity Engineer
Aug 2022 - Oct 2024All Covered · Konica Minolta
- Supported deployment and maturation of managed endpoint security for 400+ clients, tailored to each client's risk profile.
- Served as a senior escalation point for analysts on incident review and response.
- Built SOAR and Python automation that cut manual data analysis 50%.
- Served as the team's SentinelOne SME, using it for triage and helping improve true/false-positive accuracy.
- Put together data-driven business cases that supported team growth.
-
Incident Response Consultant
Sep 2021 - Aug 2022ConnectWise, LLC
- Served as Incident Commander for partner-facing incidents, coordinating SMEs and external partners for rapid recovery.
- Cut partner downtime 50% through IR process improvements.
- Led playbook development that shortened response times 35%.
- Analyzed logs and artifacts with IOC tooling to determine root cause, TTPs, and threat intel.
- Architected an AWS IR stack, cutting data ingestion/processing time 75%.
-
Information Security Engineer
May 2018 - Sep 2021ConnectWise, LLC
- Built a Vendor Risk Management program, surfacing new revenue opportunities from risk data.
- Created NIST CSF-compliant product assessments and remediation plans.
- Automated vendor processes in Python; a separate tool cut manual workload 30%.
- Architected multi-node, multi-cloud data discovery and classification in AWS for DLP.
- Designed hardening guidelines on CIS Benchmarks and built CTFs for customer enablement.
-
Managed Data Security Analyst
Jan 2017 - May 2018Sienna Group, LLC
- Maintained customer-managed data security infrastructure and software.
- Remediated DLP configuration and installation issues for managed customers.
- Validated data-classification effectiveness by testing data against the DLP engine.
04
Side Projects
Things I build and run on my own time. A couple are live, a few are open source, and the rest are private builds I'm happy to walk through.
Spotlight
Live · php2shell.fowlapps.com
PHP2Shell Checker
Built the day the php2shell PHP core RCE (CVE-2026-109618 / 109619) was patched. Enter a site and it checks whether the PHP version header is exposed, and if it is, whether that version is below the patched baseline. Detection only: it reads the banner from ordinary requests and never sends exploit traffic. There's also a stdlib Python CLI for checking a whole list of sites.
Check a site ↗ Open source · GitHubMeeting Notes
A self-hosted meeting recorder that never joins the call. A lightweight desktop client records your mic and the meeting audio as separate tracks and sends them to a server, which transcribes with Whisper, writes the notes, and copies them to Notion. Note types have editable prompts, so a webinar gets different notes than a work meeting.
View on GitHub ↗ Open source · GitHubMantel
A self-hosted family calendar for a wall-mounted touchscreen. Two-way Google Calendar and iCloud sync, so you can add an event from the wall, plus shared grocery lists and weather. One Docker container, no account, no subscription, and it runs on a Raspberry Pi.
View on GitHub ↗ Live · speed.fowlapps.comHow Fast?
A small, silly one. Enter where you're starting, where you're going, and when you need to be there, and it tells you the average speed you'd have to hold. Or flip it around to see when you'll arrive. Two static pages and one edge function.
Try it ↗Live now
Open source on GitHub
PowerShell · GitHub
Simple EDR & Identity Tests
A menu-driven PowerShell harness for authorized detection testing in a lab. It triggers common attacker-style behaviors so you can confirm SentinelOne, or any EDR, actually catches them.
View on GitHub ↗ Python · GitHubConduit
A self-hosted Python automation platform: scheduled scripts, encrypted secrets handed to scripts at run time, shared data tables, and full run history in a web UI.
View on GitHub ↗ JavaScript · GitHubBookmark Clipboard
A self-hosted bookmark dashboard with clipboard and file sharing, plus an HTTP API so an AI assistant can manage bookmarks.
View on GitHub ↗Private builds
Household vault (zero-knowledge)
An end-to-end encrypted vault for a household's documents and instructions. The server never sees plaintext or keys. Written threat model (STRIDE), architecture decision records, passkeys, and a trustee-based emergency access flow.
Hardened cloud host
A small cloud Docker host with one reverse proxy as the only public entry point, key-only SSH, firewall rules managed through the API, and releases built from a reviewed commit with a recorded checksum.
Homelab & AD lab
A few Linux hosts running about 30 containers behind a single reverse proxy, remote access only over Tailscale, VPN-routed egress for untrusted traffic, nightly backups, and an Active Directory lab for testing.
Fleet status dashboard
A LAN-only dashboard for my own machines. Agents only send data out, new devices need approval, and viewing, control, and screen access are permissioned separately. A pre-commit hook blocks secrets from being committed.
Personal hub with an agent API
Notes, projects, and lists for my home network, with a REST and MCP interface where each AI agent gets its own key that can be revoked, and link previews are guarded against SSRF.
05
Technical Proficiencies
Security Operations
Endpoint & Identity
Security Architecture
Automation
Development
AI-Assisted Development
Cloud & Infrastructure
Data Protection & Crypto
Frameworks
06
Credentials
Certifications
-
CISSP, Certified Information Systems Security Professional
-
SentinelOne Sales Engineer Expert
-
SentinelOne Incident Responder
07
Writing & Code
Published · Cybersecurity Insiders
View GitHub →
Resilience Over Defense: What Cybersecurity Strategies Often Miss
Why building to absorb and recover beats building only to block, and how to design for it.
Read the article → Open Source · GitHub@heyitsmiike101
Python and PowerShell tooling for security operations and incident response. A few recent public projects are highlighted under Side Projects above.
– contributions in the last year
08
Let's build something resilient.
Open to security architecture, advisory, and engineering conversations. The fastest way to reach me is email. I read every message.