Amir Khodakarami

Vulnerability Identification & Dependency Hunting

• Own Tenable as the primary vulnerability identification platform — led onboarding of Tenable Cloud alongside an existing on-prem-only deployment, materially expanding scan surface coverage and finding accuracy.
• Design and tune scan policies across a mixed Windows, macOS, and Linux fleet, balancing scan depth against impact on production and manufacturing systems that cannot tolerate disruption.
• Separate real exposure from scan noise, ranking findings by severity, exploitability, asset criticality, and fleet spread — then translate that into a remediation queue the business can act on.
• Evaluate significant CVEs in an isolated sandbox against our own configuration rather than trusting vendor severity, reproducing published proof-of-concept code where warranted.
• Ran fleet-wide dependency hunts for Log4Shell and embedded-Chromium exposure, inventorying the desktop estate for applications bundling the affected components internally rather than waiting on vendor advisories that under-report them.
• Escalated directly to the vendors shipping those components as prerequisites and drove them to issue remediated builds — closing exposure we could not patch ourselves and that scanners alone would never have surfaced.
• Re-scan after every deployment to verify fixes landed, catching cases where a patch reported success without remediating the underlying finding.

Remediation at Scale

• Took a standing backlog of 5,000+ open vulnerability findings down to a sustained 98%+ patch compliance posture across 6,500+ endpoints — the result of an automation program I designed, and it has held rather than regressing.
• Root-caused that backlog to configuration inconsistency — endpoints drifting into non-standard states generated findings faster than manual patching could close them. Built automation enforcing uniformity, eliminating whole classes of vulnerability at the source.
• Built an extensive library of Ivanti Neurons bots that push fixes and configuration corrections to thousands of endpoints in a single action rather than device by device, and that self-heal drift autonomously — the mechanism that makes this scale sustainable.
• Write custom PowerShell and Bash remediation scripts where no vendor patch exists or would break a dependent system — registry hardening, service disablement, permission corrections — deployed via Intune, SCCM, and Ivanti.
• Built compliance and remediation workflows on PowerShell, Bash, and Microsoft Graph API, cutting manual remediation effort 60% and shortening the window between disclosure and fleet-wide fix.
• Coordinate with software and equipment vendors across a mixed fleet that includes manufacturing floor systems, validating patch compatibility in staging so security fixes never take production offline.

Host Hardening & Access Control

• Designed and deployed Windows Security Baselines through Intune Settings Catalog, Group Policy, and MDT task sequences, enforcing CIS hardening across the managed fleet.
• Integrated Intune with Entra ID Conditional Access so device compliance state gates access to corporate resources automatically — zero-trust enforcement aligned to CIS and NIST.

Security Design & Threat Modeling

• Threat-model every application and environment before it enters the enterprise — mapping identity and access paths first, then designing to minimum necessary privilege.
• Size controls to actual exposure rather than applying everything uniformly, and treat identity as the primary control surface — over-provisioned access is the attack path that matters most in a workforce environment, and it is cheaper to design out than to detect later.

Ownership & Cross-functional Work

• Function as the hands-on security execution layer for the endpoint estate — the security org sets requirements and monitors posture; endpoint engineering builds, tests, and deploys the controls that close findings.
• Translate technical risk into operational impact for business stakeholders and equipment owners, so patching trade-offs get decided on business terms rather than escalated as blockers.

GenAI Adoption

• Lead enterprise deployment of Microsoft 365 Copilot — semantic indexing, Entra ID prerequisites, and data governance policy so AI adoption does not outrun the controls around it.

• Administered JAMF Pro for 300+ macOS devices — configuration profiles, patch policies, and scoped deployments — alongside Apple Business Manager for zero-touch provisioning of hardened devices.
• Ran SCCM (MECM) and Intune co-management for a mixed Windows, macOS, and Linux fleet, migrating legacy workloads to cloud-native management.
• Integrated JAMF and Intune with Azure AD and Okta to automate onboarding, offboarding, and configuration enforcement from identity signals.
• Hardened endpoints through Group Policy and migrated legacy settings into modern Intune policy; wrote PowerShell and Bash diagnostic and auto-repair scripts across all three operating systems.
• Optimized VDI environments for 800+ remote users, maintaining login performance and application responsiveness.

• Managed Windows endpoint lifecycle with Intune and Ivanti Neurons, overseeing patch deployment and vulnerability remediation.
• Automated administrative and configuration workflows through PowerShell, standardizing system builds and reducing manual error.