Microsoft 365 & identity
- Exchange Online, SharePoint, Teams, OneDrive
- Entra ID, Conditional Access, MFA
- Intune, Defender for Business
- Purview / eDiscovery, Graph API
- User lifecycle: onboarding and offboarding
online · metro Atlanta, GA
Neal Fleming
IT Technician & Systems Administrator
I keep small businesses running, secure and patched, across Microsoft 365, endpoint security, firewalls and a lot of PowerShell.
$ whoami
Neal Fleming, IT Technician & Systems Administrator
$ cat focus.txt
Microsoft 365 · Endpoint security · Networking · Automation
Type help to look around.
~/about
- user
- neal@fleming
- role
- IT Tech / SysAdmin
- env
- MSP, SMB clients
- shell
- pwsh · bash · python
- focus
- M365 · security · network
- certs
- CompTIA Network+
- base
- Metro Atlanta, GA
I'm an IT technician and systems administrator at a managed service provider in metro Atlanta. I support a mixed portfolio of small and mid-size businesses: construction, real estate, automotive, finance, healthcare, design and manufacturing. The work runs from Tier 1 helpdesk through Tier 3 escalations.
Most days I'm somewhere between a Microsoft 365 tenant, a firewall console and a PowerShell window. I like turning repetitive work into scripts and dashboards, and turning an alert into a clear answer: what happened, whether it matters and what to do next.
~/skills
Endpoint & email security
- EDR / XDR alert triage and incident analysis
- MITRE ATT&CK mapping, IOC handling
- Email filtering, phishing and BEC response
- Compromised account remediation
- Duo, FortiToken and other MFA tooling
Networking & infrastructure
- FortiGate, Zyxel USG FLEX, SonicWall
- IKEv2 / SSL VPN, Tailscale, Cloudflare Tunnel
- Ubiquiti, mesh Wi-Fi, structured cabling
- Hyper-V, Proxmox, Docker, Synology NAS
- Backup: Active Backup for M365, cloud backup
Scripting & automation
- PowerShell: Graph, PnP, Exchange Online
- Python: APIs, data parsing, small web services
- RMM script and scheduled-task deployment
- Ansible, Bash, Linux administration
- Power Automate, AI and LLM integrations
~/projects
Raspberry Pi kiosk fleet
I manage a fleet of Raspberry Pi display kiosks spread across the offices of a multi-company real estate group. The kiosks show live dashboards on wall screens with nobody touching them.
- Bootstrap scripts take a freshly flashed card to a working kiosk with no hands-on setup: autostart, Wi-Fi power management and display configuration
- Every unit is reachable over a private Tailscale network, with no inbound ports open at any site
- Fleet-wide changes go out through Ansible, tested on a single canary unit before the rollout
- Cut SD card wear by moving logs and browser cache into RAM, the main cause of failures on long-running Pis
Hosted MCP servers for business systems
Built Model Context Protocol servers that let an AI assistant query a client's line-of-business SaaS platforms (shop management and call tracking) in plain English, without anyone exporting reports.
- Python FastMCP services that wrap each vendor's REST API, scoped to read access
- Run as Windows services on a Hyper-V VM, published over HTTPS through a reverse proxy
- Added to the assistant as custom connectors by URL, so non-technical staff can use them
MSP maintenance dashboard
Quarterly maintenance status lived in a separate Excel checklist per client. I built a dashboard that shows every client's status on one page.
- A Python job pulls the checklist workbooks from SharePoint through an Entra app limited to read-only
Sites.Selectedaccess - Workbooks are parsed into a single JSON feed, served as a static dashboard behind a reverse proxy
- A per-device work log shows what's done and what's still pending at each site
- Standardized the checklist templates so the data stays parseable as new clients are added
SOC triage workflow
Built a repeatable process for triaging endpoint detection alerts, so every alert ends with a consistent verdict and an audit trail.
- Playbooks by detection family: process trees, command lines, network destinations, identity anomalies
- A standard write-up for each alert: MITRE techniques, defanged IOCs, escalation decision, remediation and verdict
- A catalog of recurring false positives (OS telemetry, signed driver installs, OEM firmware tools) to speed up triage without lowering the bar
- Daily read-only alert digests so nothing ages unnoticed
~/training
Certifications
- CompTIA Network+
Hands-on security labs
Ongoing offensive and defensive training on TryHackMe:
- Nmap enumeration, Wireshark traffic analysis
- Metasploit and msfvenom payloads
- Password cracking with John the Ripper
~/contact
Let's talk.
Open to conversations about IT, systems administration and security roles.