↓Skip to main content
Alec Eckmann
alec@aleckmann.com
https://aleckmann.com  •  @aleckmann  •  @aleckmann
Professional Experience
Hadrian
Information Security Engineer Jan 2026 - Current
  • Led an enterprise vulnerability and patch-management program spanning cloud, endpoints, Kubernetes, and factory OT networks; deployed Tenable scanner appliances as Terraform/Terragrunt-managed infrastructure and created a reusable per-factory onboarding module.
  • Automated the creation of SaaS access requests and governance functions with reusable Terraform modules, standardizing RBAC, approval workflows, group assignments, lifecycle provisioning, and entitlement controls.
  • Authored organization-wide Identity Security and Endpoint Security roadmaps aligned to CMMC Level 2, NIST 800-171, and NIST CSF, covering HRIS-driven lifecycle management, phishing-resistant MFA, privileged access, device posture, endpoint vulnerability management, and staged enforcement.
  • Designed a hardware-attested device-trust architecture using PKI, TPM/Secure Enclave-bound certificates, and endpoint posture checks to enforce managed-device access controls.
  • Designed a least-privilege authentication scheme and supporting software for an enterprise LLM gateway, issuing per-user short-lived credentials with model allowlists, rate limits, spend controls, and audit logging.
  • Built AI-assisted operational skills for managing FleetDM and endpoint configuration, plus an automated software-packaging test suite covering installation UX, upgrade paths, and regression testing across managed platforms.
  • Implemented CUI/ITAR data protection in Box using customer-managed AWS GovCloud KMS keys, least-privilege key policies, rotation and revocation procedures, and CloudTrail/Athena audit evidence.
  • Automated CMMC Level 2 evidence collection and cross-functional control reviews through an agentic review lifecycle, producing consistent, traceable assessments aligned to the DoD CMMC assessment guide.
Azoff Music Company
Information Security Specialist Apr 2021 - Jan 2026
  • Led the company’s cybersecurity program, prioritizing improvements based on data-driven risk assessments, industry specific attack patterns, and the NIST Cybersecurity Framework. Reduced IT spending while improving overall security posture.
  • Led the design and development of a Bicep-based IaC framework to codify a hub-and-spoke topology and migrate legacy infrastructure to the new model. Implemented a Role Based Just-in-Time permissions model for all cloud resources.
  • Enforced biometric sign in requirements and synced local hardware security tokens with Entra ID, enabling passwordless logins from compliant endpoints to all corporate resources. Deployed FIDO2 hardware tokens to a smaller group of highly privileged users. Achieved a 95% device compliance rate within 1 month of policy rollout.
  • Fully automated the user onboarding process with Azure DevOps, PowerShell, and app-specific API integrations to streamline provisioning, reducing onboarding turnaround time by 80%.
  • Developed highly customized Conditional Access Policy solutions for all identities, employee or otherwise. Maintained an average Identity Secure Score of 90%.
  • Transitioned 99% of managed corporate applications to SAML/OIDC Single Sign-On (SSO).
  • Served as the primary Intune and Jamf administrator, managing 400+ Windows, MacOS, iOS, and Android endpoints. Enforced hardened device configurations based on CIS Benchmark recommendations. Fully automated app provisioning and patch management across all endpoints.
  • Deployed and managed Microsoft’s Defender Suite to unify vulnerability reporting across all IT and Development infrastructure. Integrated Microsoft and third-party services into Azure Sentinel with automated playbooks to streamline incident response.
  • Designed and led a new hire security training program. Administered new phishing awareness and security training platforms with an emphasis on industry-specific attack patterns.
  • Redesigned corporate office network, implementing port-based access controls across several VLANs.
  • Deployed Azure Arc to all on-prem servers. Built unified monitoring and patching solutions with Azure Monitor and Update Manager.
  • Worked cross departmentally on standardizing and updating company IT and Security policies. Formalized a company wide vendor management process.
  • Administered a cloud CA and RADIUS Server (EZCA and EZRadius), enabling Entra ID Wi-Fi authentication for corporate networks.
Cartwheel IT (now Altourage)
Security Analyst Feb 2018 - Apr 2021
  • Sole developer; designed, developed, and deployed an internal automation suite in Python that monitored, audited, and reported on over a thousand endpoints daily.
  • Worked daily to investigate and remediate security alerts through SentinelOne, Office365 Cloud App Security Portal, and ArcticWolf, Cyberhawk Vulnerability Management platforms
  • Responsible for the maintenance, management, and continuous improvement of 25+ clients’ security programs.
  • Routinely configured and hardened common SaaS products (Box, Dropbox, Google Drive, Sharepoint), network security products (Cisco Umbrella, Cisco Secure Internet Gateway), and IdPs (Azure AD and GSuite)
  • Enforced industry standard compliance for HIPAA, FINRA, PCI, GDPR, and CCPA requirements.
Project Highlights
LLM Gateway Authentication and AI Governance
Least-Privilege AI Tooling Authentication and Audit Controls
  • Designed the least-privilege authentication scheme and supporting software that issues per-user short-lived gateway credentials with model allowlists, rate limits, spend controls, and audit logging.
  • Built managed endpoint configuration and packaging workflows for AI developer tools across macOS and Windows.
CMMC Evidence Automation
Agentic Control Evidence Collection and Review
  • Automated evidence collection and cross-functional control reviews through an agentic lifecycle aligned to the DoD CMMC Level 2 assessment guide.
  • Produced traceable, consistent control assessments across infrastructure, IT, security, and application teams.
Infrastructure as Code Migration
Bicep-based IaC Framework
  • Developed a system to migrate existing infrastructure to a modern hub-and-spoke topology
  • Wrote modular and parameterized Bicep templates to deploy different development environments across teams, subsidiaries, and regions
  • Created an IaC sandbox environment to automate the testing of resource deployment and network restrictions before updating production workloads
  • Aligned with Microsoft’s Well-Architected framework to centralize network security and monitoring across a multi-spoke, multi-region cloud environment
Geofencing Form
Simple Web Form for Traveling Employees
  • Access restricted to employees and requires SSO login; allows submission on behalf of another valid user (useful for assistants)
  • Takes travel dates and destination region as input, exempts users from Conditional Access Policies specific to their destination region only for duration of their trip
  • “Risky” regions require approval from manager and security team (risk calculated based on current threat model)
  • Every step of process is logged through ticketing system, sending email notifications to relevant parties
Onboarding Form
Automated User Provisioning with Advanced Logic and Built-in Approvals
  • Access restricted to hiring managers only, requires SSO login
  • Takes user metadata and access package as input (no sensitive information) and creates relevant accounts, licenses, and group assignments
  • Unique behavior based on access package, department, employement type, and subsidiary
  • Built-in approval process for managers, application administrators, and security team depending on requested access
  • Every step of process is logged through ticketing system, sending email notifications to relevant parties
Technical Skills
Infrastructure & Platform Security:
OpenTofu, Terraform, Terragrunt, AWS GovCloud, Kubernetes, HashiCorp Vault, env0
Identity & SaaS Governance:
Okta, SAML/OIDC, SCIM, RBAC, Access Requests, Lifecycle Management, Privileged Access Management
Endpoint Security & Management:
FleetDM, Intune, Mosyle, Defender for Endpoint, Cortex XDR, Device Trust, PKI, Software Packaging
Security Compliance & Data Protection:
CMMC Level 2, NIST 800-171, NIST CSF, CUI, ITAR, AWS KMS, CloudTrail, Tenable
AI Platform Security & Automation:
LLM Gateways, MCP, Bedrock, Agentic Workflows, Security Automation
Network Security:
AWS VPC, DHCP, DNS, VLANs, RADIUS, PAN-OS
Academic Background
New York University
Bachelor, Computer Science Sep 2013 - May 2017
Spoken Languages
English: Native or Bilingual Proficiency
Spanish: Limited Working Proficiency
Italian: Elementary Proficiency
Download