Mustapha Aziane

Work across corporate security with a focus on security operations, incident response, identity and access, endpoint and SaaS security, vulnerability management, third party risk, and security automation.

My role includes investigating security issues, improving controls and processes, driving remediation with technical teams, and helping address security risk across the corporate environment.

Worked across day to day security operations, investigations, identity and access, endpoint and email security, vulnerability management, SaaS security reviews, third party risk, and security awareness.

Supported the implementation and improvement of security controls while working with IT, Engineering, and business teams through investigation and remediation.

Worked across identity, endpoint, email, cloud, network, vulnerability management, and third party security in a cloud based environment.

Implemented and operated security controls, investigated security events, supported Zero Trust initiatives, developed security processes and policies, and worked with technical and business teams to address identified risk.

Led technical support in an MSP environment across identity, Microsoft 365, endpoints, networking, servers, and security.

Supported corporate IT, vulnerability remediation, change management, infrastructure security, ITGC and SOX activities, penetration testing, and PCI compliance.

I investigate security events by building a timeline across the available evidence and determining what actually happened, what was affected, and what response is required.

My work has included account compromise, suspicious authentication, phishing, malicious activity, unexpected access changes, and externally reported security issues.

Depending on the incident, I may review Okta System Logs and Google Workspace audit activity, correlate events through RunReveal or Rapid7, validate endpoint behavior in CrowdStrike, or use Netskope and cloud telemetry to understand the surrounding activity.

The work does not stop at confirming an alert. I focus on containment, remediation, and identifying whether a control, detection, or process should change afterward.

I work across identity and access from both an operational and security perspective.

That includes investigating authentication and account lifecycle events, reviewing privileged and application access, evaluating MFA and SSO controls, validating group and permission changes, and identifying access that no longer matches a user's role or business need.

My experience includes Okta, Google Workspace, Microsoft 365, AWS, and SaaS environments.

I have also worked on Zero Trust initiatives that bring identity, device posture, and endpoint security together so access decisions are based on more than a username and password.

My endpoint security work has evolved from hardening systems, encryption, patch management, and endpoint protection into designing controls that use device posture and security telemetry as part of broader access decisions.

I have worked with CrowdStrike, Workspace ONE, Microsoft Intune, Cisco Secure Endpoint, and other endpoint technologies across macOS and Windows environments.

I also review SaaS applications, integrations, and service accounts to understand how they authenticate, what they can access, and whether permissions and lifecycle controls match the business need.

My Zero Trust work brings identity, device posture, and endpoint security together so access decisions are based on more than a username and password.

At Lime, I designed automated enforcement using CrowdStrike Fusion SOAR and Real Time Response to identify and remediate unauthorized VPN software across more than 1,000 endpoints.

The rollout used staged enforcement and validation rather than immediately applying a blocking control across the entire environment.

I investigate threats that begin both inside and outside the corporate environment, including phishing, business email compromise, account takeover, brand impersonation, malicious and lookalike domains, and exposed information.

I use CrowdStrike Falcon Recon for external threat and brand monitoring and have coordinated investigation, blocking, escalation, and domain takedown activity.

I also supported the implementation and integration of Abnormal Security with Google Workspace to strengthen phishing, business email compromise, and account takeover detection and investigation.

My vulnerability management work includes reviewing penetration testing results, dependency findings, application issues, and external disclosures to understand exposure and prioritize remediation.

I work with technical owners to validate impact, drive remediation, and determine whether a finding requires a control change, compensating control, or longer term process improvement.

Not every security problem begins with an alert.

I review SaaS applications, integrations, service accounts, third parties, and architecture changes to understand what they can access, how they authenticate, what data they handle, and what a compromise would mean to the environment.

I have built third party security review processes, designed a risk based vendor assessment program, supported PCI DSS and SOC 2 work, and helped translate security requirements into controls that can be operated and verified.

My approach is to understand the actual risk first, then determine the control or remediation that makes sense for the environment.

An unexpected identity event rarely exists in one log source.

I use Okta System Logs and Google Workspace audit and investigation data to reconstruct authentication activity, administrative actions, lifecycle changes, and group membership events.

When needed, I correlate those records with endpoint, network, or SIEM telemetry to determine whether the activity was expected, automated, or potentially malicious.

The result is a defensible timeline that can be used to determine containment and whether access can safely be restored.

I designed a CrowdStrike based workflow to identify unauthorized VPN software across more than 1,000 endpoints and automate remediation using Fusion SOAR and Real Time Response.

Rather than immediately enforcing the control everywhere, the rollout was staged so detections and potential false positives could be validated before broader enforcement.

The goal was not automation for its own sake. It was to make a recurring security control consistent and scalable without creating unnecessary disruption.

I investigate malicious and lookalike domains, brand impersonation, credential phishing infrastructure, and exposed information using CrowdStrike Falcon Recon and supporting evidence.

When activity represents a risk, I coordinate the appropriate response, which may include internal blocking, additional investigation, takedown activity, or escalation to Legal.

I also use email and identity security telemetry to determine whether an external campaign has resulted in activity inside the environment.