Michael
Quiles.

Senior Security Infrastructure Engineer

• Lead enterprise Azure architecture, engineering, security, governance, and operational strategy for a public company and its portfolio affiliate.
• Translate business, regulatory, and customer requirements into secure cloud architectures, operating standards, and executable technology roadmaps.
• Own Azure security policy design and enforcement — Azure Policy, security baselines, RBAC, network security groups, Defender for Cloud, and cloud security posture management.
• Drive CMMC Level 1, NIST 800-53, NIST CSF, FedRAMP, and HITRUST control implementation, documentation, and audit readiness.
• Direct FedRAMP-aligned deployments for government/VA customers, addressing NIST 800-53 and FIPS 140-2 requirements.
• Reduce annualized Azure cloud spend 50% (~$420K) through FinOps-driven governance, rightsizing, and cost optimization.
• Lead technical due diligence and post-merger IT/security integration for the Strive Asset Management affiliation.
• Lead containerization and DevSecOps with Docker, Azure Container Apps, Jenkins, and Terraform; modernize legacy VM services to cut patching risk and speed deployment.
• Own vulnerability management, privileged identity reviews, SIEM monitoring, incident triage, identity/endpoint security, vendor risk, and security architecture reviews.
• Evaluate generative AI tools including Microsoft Copilot and Gemini for security, data governance, and risk implications, advising leadership on safe adoption.
• Own enterprise backup and disaster recovery using Veeam and Wasabi, and maintain documentation supporting audits, security reviews, and recovery planning.
• Mentor engineers and IT staff while partnering across business, application, security, and infrastructure teams.

Virtual CISO (vCISO)

Fractional security leadership for organizations that need a senior security voice without a full-time hire — acting as an extension of the client’s information security and governance function across strategy, program maturity, risk, compliance, and day-to-day security operations.

• Define and lead client information security vision, roadmap, and operating model, aligning security investment to business objectives through risk-based prioritization.
• Review current security and service management programs, assess program maturity, and build a corresponding roadmap that key stakeholders can act on.
• Serve as the client’s virtual CISO in executive and board-level discussions, translating security posture into language leadership can act on.
• Develop, implement, and oversee information security programs, roadmaps, and plans of action across infrastructure, cloud, applications, and endpoints.

• Lead cybersecurity risk assessments and security posture reviews, producing high-quality reports including gap analysis, POAMs, prioritized recommendations, and remediation planning.
• Guide compliance and framework alignment — NIST CSF, NIST 800-53, CIS Controls, ISO 27001, SOC 2, HIPAA/HITECH, CMMC, PCI, and GDPR — including policy and procedure development.
• Lead internal and external audits, risk assessments, and vendor security reviews.
• Coordinate and advise on vendor-specific partnerships, third-party risk programs, and due diligence.
• Develop business continuity, disaster recovery, and incident response plans — including ransomware readiness, tabletop exercises, response playbooks, and post-incident remediation guidance.

• Provide oversight of security operations — SOC, threat detection, incident response, and vulnerability management — and build playbooks for threat mitigation and breach containment.
• Lead and manage security analysts, providing direction, oversight, expertise, and mentoring, and support professional development across consulting teams.
• Advise on security controls and technologies, and stay engaged in architecture reviews, IAM and zero trust, encryption, secure networking, penetration testing, and secure-by-design practices with engineering, IT, and DevOps teams.
• Establish KPIs, metrics, and security dashboards that give leadership a clear view of risk and program performance.

• Support annual security and technology budgeting, forecasting, and investment prioritization, and provide strategic oversight of client IT and security initiatives.
• Build long-term client relationships within recurring consulting programs, and support business development through scoping, statements of work, resource estimates, and RFP responses.
• Communicate risk, incidents, and program performance to executive leadership and the board; develop expert-level content and contribute to panels and speaking engagements.

Chief Information & Security Officer

• Served as CIO and CISO, leading a multi-million-dollar IT/security budget, enterprise technology strategy, and a team of 9+, with direct reporting to executive leadership and the Board.
• Defined the information security vision, roadmap, operating model, policies, security architecture, data protection strategy, and third-party risk program.
• Built enterprise data governance covering retention, access control, and secure data lifecycle management.
• Oversaw security operations, threat detection, incident response, breach response planning, and tabletop exercises.
• Aligned cybersecurity and risk management with HIPAA, HITECH, NIST CSF, NIST 800-53, ISO 27001, SOC 2, and GDPR requirements.
• Led audits, risk assessments, vendor security reviews, and executive/Board reporting on risk posture and performance.
• Built and led IT operations teams supporting enterprise infrastructure, SaaS platforms, and healthcare applications; recruited, mentored, and retained technical talent.
• Cut operational downtime 70% through infrastructure modernization, GRC improvements, and disaster recovery planning.
• Built organization-wide security training and awareness programs to strengthen compliance culture and reduce human-factor risk.

Sr. Systems Engineer

• Engineered Azure, identity, network security, and enterprise systems supporting healthcare operations across hybrid on-premises and cloud environments.
• Administered Windows Server and Linux Server infrastructure, including server deployment, hardening, and patch management tooling.
• Built infrastructure as code and automation to standardize provisioning and configuration across enterprise platforms.
• Implemented infrastructure and platform monitoring plus backup and disaster recovery technologies to improve availability and reduce recovery time.
• Rolled out Microsoft MFA organization-wide and led SSL/TLS certificate lifecycle management across Linux and Windows platforms.
• Designed Azure AD/Entra ID, Okta, ADFS, and secure Azure network segmentation using VNets, NSGs, and UDRs.
• Partnered with security teams on HIPAA compliance, PAM, DLP, vulnerability management, access controls, and audit remediation.

IT Operations Manager

• Led a 9+ person infrastructure, security, and help desk organization, owning budget, staffing, performance management, and technology operations.
• Built and stood up the organization’s first formal IT security program, reducing malware infections 95%.
• Architected VMware vCloud Director IaaS environments on Cisco UCS and Dell PowerEdge infrastructure and directed enterprise identity and access management.
• Led data center relocation, enterprise wireless deployment, secure remote access/VPN, facility access-control systems, and major infrastructure modernization programs.
• Directed server lifecycle and Office 365 migration initiatives while building more than 70% of the organization’s file servers.
• Led the launch of a new electronics division, including website, servers, networking, and technology infrastructure.

SOC Analyst / Infrastructure Services Security Analyst / Systems Administrator

• Monitored and triaged security alerts and incidents using SIEM and EDR tooling — investigating events through log review, containing and remediating incidents, and documenting findings through ticket closure.
• Deployed and configured security tools including SIEM, endpoint protection, and identity solutions alongside senior team members and vendors to protect the organization’s digital assets.
• Maintained and improved SIEM detections — updating and tuning alerts, assisting with platform upgrades, and building and refining detections with query language.
• Conducted internal and external vulnerability scans, analyzed results, and coordinated remediation with system owners based on risk and priority.
• Audited user access and permissions by reviewing access reports, validating approvals with system owners, and documenting findings to support least-privilege governance.
• Responded to security-related inquiries and requests — following up on security tickets and user/vendor reports such as phishing submissions or suspicious activity, and providing cybersecurity guidance to employees.
• Supported cross-functional security projects alongside Information Security Engineers, contributing to governance, architecture, research, and compliance initiatives.
• Performed periodic security audits to verify that policies and procedures were followed, and assisted with audit evidence collection and follow-ups.
• Participated in a limited on-call rotation (typically 2–3 weeks per year) supporting urgent security incidents and escalations outside normal business hours.
• Administered Active Directory, Domain Controllers, GPOs, and Exchange while supporting disaster recovery policy development.

Sr. Systems Administrator

• Administered Active Directory and a 35,000+ mailbox Exchange environment; monitored network vulnerabilities and led remediation.
• Implemented antivirus and patch management programs that eliminated hundreds of active infections, and maintained data center, backup, and disaster recovery infrastructure for mission-critical operations.