Ezekiel Marrowfield-Nyarko

Triage ~120 Splunk SIEM alerts per shift across a 14-hospital network, escalating confirmed incidents to Tier 2 with complete timelines and IOCs Analyze 40+ user-reported phishing emails weekly, extracting headers, URLs and attachments in a sandbox and purging malicious messages from 9,000+ mailboxes Contain compromised endpoints with CrowdStrike Falcon (network isolation, process kill, hash blocking), averaging under 15 minutes from alert to containment Wrote 11 Tier 1 playbooks (phishing, impossible travel, malware beaconing, brute force) mapped to MITRE ATT&CK, adopted as the SOC standard Tuned 35 noisy correlation searches with Tier 2 engineers, reducing false positives 28% and freeing ~6 analyst hours per shift Cut mean time to acknowledge (MTTA) from 22 to 9 minutes by building Splunk dashboards and queue-routing rules for high-severity alerts

Resolved 45+ tickets per day across 18 branches in ServiceNow, maintaining a 94% first-contact resolution rate and 4.8/5 CSAT Administered Active Directory accounts, MFA enrollment and group-policy access for 320 employees, enforcing quarterly least-privilege reviews Flagged and escalated 60+ suspicious login and phishing events to the security team, earning a referral into the SOC pipeline Imaged and patched 400+ Windows endpoints with SCCM, lifting monthly patch compliance from 81% to 97% Authored 25 knowledge-base articles that cut repeat password and VPN tickets by 30%

Ran weekly Nessus vulnerability scans on 600+ municipal assets and tracked 200+ findings to remediation with system owners Built a Python script that parsed firewall logs into CSV reports, saving the network team ~4 hours per week Supported security awareness training for 150 city employees, including a phishing simulation that lowered click rates from 19% to 7%

GPA 3.6/4.0. Coursework: Network Security, Digital Forensics, Operating Systems, Applied Cryptography. Member of the UTC Cyber Defense Club and NCL competition team.

Built a Proxmox home lab with Splunk, Zeek and Sysmon; wrote 20+ Sigma rules for credential dumping, persistence and lateral movement, validated with Atomic Red Team.

Placed 4th of 300+ teams in the National Cyber League team game; focused on log analysis, network traffic and forensics challenges.