> mchandler_

Senior Cybersecurity Engineer

Give me the problems nobody else has solved yet.

Michael James Chandler

Retired Army Cyberspace Defense Warrant Officer (CW3)

Cybersecurity engineer and technical leader with 23 years across IT infrastructure, security operations, and enterprise modernization. Built and secured virtualized Microsoft environments, integrated security monitoring in constrained environments, and led IT teams supporting 4,000 users. Experience spans hands-on automation, resilient systems, technology evaluation, and security authorization. Retired Army Chief Warrant Officer 3.

  • TS/SCI
  • CISSP
  • SSCP
  • GCIH
  • GCIA
  • GCWN
  • GSNA
  • GSEC
  • GPEN
  • SecurityX

Fountain, CO Open to remote

Michael Chandler, smiling, outdoors

// what i do

Hands-on security engineering, start to finish.

I have yet to run into a technical problem I couldn't figure out, and I pick up new tools fast. Most of my career has been taking something that isn't working, finding out why, and leaving it better documented and harder to break.

Lead and advise

A lot of my value is helping leaders make the right call. I have led IT teams supporting 4,000 users, told decision makers plainly when a popular solution was the wrong one, and carried modernization projects from the first briefing to a working, approved system. I also make a point of building people up. I have mentored about a dozen junior personnel, trained my own successor, and helped another organization stand up its Elastic Security stack.

Security strategy, technology evaluation, enterprise modernization, IT project and program management, team leadership, training and mentoring

Build and harden

I like building the environment myself and then locking it down, from the client all the way up. That means secure Windows baselines with Group Policy and DISA STIGs on the endpoints, router and firewall configs that only let through what the mission needs, and a VMware environment running AD, DNS, SQL Server, SharePoint, and SCCM underneath it all. I automated the routine work with PowerShell so the team could focus on real problems, and that network earned a 100% result on its cybersecurity inspection.

Windows baselines, MDT, WAIK, Windows PE, DISM, Sysprep, Group Policy, DISA STIGs, router and firewall configs, VMware ESXi, Active Directory, SCCM, PowerShell, Linux

Detect and respond

Monitoring only helps if the data actually shows up and something is watching for the right things. I got Elastic Security working when the scripts and certificates kept breaking it, wrote custom KQL detection rules to catch what the defaults missed, designed monitoring for kits running over thin links, and more recently built log pipelines in Cribl and Google SecOps.

Elastic Security, KQL detection rules, Palo Alto, ACAS/Nessus, Cribl, Google SecOps, YARA, Digital Forensics

Get it authorized

A secure system still has to get approved. I have worked the documentation, the vendors, and the approving authorities, and chased policy exceptions when that was the only way to close a gap.

RMF, ATO, IATT, eMASS, DoDI 8510.01, DoDI 8500.01, NIST SP 800-53, NIST SP 800-37, CNSSI 1253

// experience

Where I've done it.

U.S. Army, May 2005 to Jul 2026. Retired as a Cyberspace Defense Warrant Officer (CW3).

  1. Cybersecurity Engineer, SkillBridge Fellowship

    GuidePoint Security Remote Feb 2026 to May 2026

    • Designed and tuned security data pipelines with Cribl and Google SecOps, turning client requirements into log ingestion and routing workflows.

  2. Cybersecurity Engineering Lead

    U.S. Army Hawaii Aug 2023 to Jul 2026

    Comparable civilian role: Senior Security Engineer and Team Lead

    • Integrated Elastic Security into a secure environment, fixing the Linux scripts and certificate settings that kept breaking the deployment and data pipeline.
    • Designed monitoring for deployable cyber defense kits running over limited bandwidth links across the Asia-Pacific region.
    • Hardened a Palo Alto firewall with least privilege rules for a cyber exercise. The red team never got through it.
    • Led two cyber defense analysts, mentored about 12 junior personnel, and helped another organization stand up its own Elastic stack.

  3. Services Branch Lead

    U.S. Army Germany Jul 2020 to Jun 2023

    Comparable civilian role: IT Infrastructure Engineering Manager

    • Directed three project managers and three to six engineers across three teams, delivering infrastructure projects in an environment of more than 40,000 users.
    • Guided data center modernization, including Cisco ACI, and wrote the funding justifications to keep projects moving on a tight budget.
    • Tested a proposed CSfC remote access solution, found identity and scaling gaps, and recommended against it, which saved duplicate account and implementation work.
    • Handled two digital forensics cases at leadership's request to support legal proceedings and an ongoing investigation.

  4. IT Infrastructure and Security Lead

    U.S. Army Colorado Jul 2016 to Dec 2019

    Comparable civilian role: IT Infrastructure Manager

    • Led about 12 people across service desk, server administration, and cyber defense, supporting 4,000 users in seven units.
    • Fixed imaging compatibility problems and standardized deployment, cutting imaging from six hours to under one hour per computer.
    • Coordinated account and credential provisioning ahead of PKI based MFA, taking secure network access readiness from 15% to 95%.
    • Hardened Windows 10 images with Group Policy and DISA benchmarks, supporting a 100% cybersecurity inspection result.

  5. Executive Communications Support

    U.S. Army Asia-Pacific Apr 2013 to Jun 2015

    Comparable civilian role: Executive IT Support Engineer

    • Kept IT and communications running around the clock for a four-star general on the road.
    • Reworked legacy router and switch configs into a backpack-sized travel kit, raising availability from 95% to 99%.
    • Helped deliver a secure audiovisual upgrade a month ahead of schedule and cut more than $10,000 in costs that weren't needed.

  6. Earlier roles

    U.S. Army and Nexus Information Systems

    • Signal Support Systems Specialist in the Army, supporting network, voice, and collaboration systems.
    • Computer Service Technician at Nexus Information Systems (Sep 2003 to May 2005), doing on-site support for more than 5,000 users at Wells Fargo and BlueCross BlueShield.

// clearance and certifications

Verified credentials.

// skills

Tools I use.

Security

  • Elastic Security
  • Palo Alto firewalls
  • ACAS / Nessus
  • Windows hardening
  • Security architecture
  • Digital forensics
  • Wireshark
  • KQL detection rules
  • YARA

Pipelines and SIEM

  • Cribl
  • Google SecOps
  • Log ingestion and routing

Infrastructure

  • VMware ESXi
  • TrueNAS
  • Windows Server
  • Active Directory
  • DNS
  • SQL Server
  • SharePoint
  • Exchange
  • SCCM
  • WDS
  • MDT
  • WAIK
  • Windows PE
  • DISM
  • Sysprep
  • Cisco ACI
  • Docker
  • Google Cloud infrastructure

Automation and controls

  • PowerShell
  • Linux scripting
  • Group Policy
  • PKI based MFA
  • DISA STIGs
  • Terraform
  • AI-assisted coding
  • Ansible

AI

  • Grok Bot
  • Google Antigravity
  • Claude Code
  • ChatGPT Codex

Governance

  • RMF
  • ATO
  • IATT
  • eMASS

// education

Education and training.

  • 2023B.S. Cybersecurity and Information Assurance
    Western Governors University
  • 2020Cyberspace Defense Warrant Officer (255S), Warrant Officer Advanced Course
    U.S. Army
  • 2016Information Services Technician (255A), Warrant Officer Basic Course
    U.S. Army
  • 2006Signal Support Systems Specialist (25U), Advanced Individual Training
    U.S. Army
  • 2003A.A.S. Information and Network Technology
    Brown College

// contact

Let's talk.

Based in Fountain, CO, and open to fully remote roles. The best way to reach me is a message on LinkedIn.

Connect on LinkedIn Download resume (PDF)