Toronto, ON · CompTIA Security+ · Open to work
IT Support · Help Desk · Desktop & Network Support · Junior Sysadmin · SOC Analyst
I bring a strong customer service background and a homelab that covers the technical side: a working service desk, Active Directory, Microsoft 365 automation, Windows troubleshooting tools, a Cisco network and Splunk detections, all documented in public on GitHub.
I'm looking for my first IT role in Toronto: IT support, help desk, desktop or network support, with junior systems administration and SOC work as the next step.
My background is in customer service, which is where I learned the part of IT support that isn't technical: listening, staying calm, explaining things clearly and following through.
I earned my CompTIA Security+ in October 2026 and I'm working toward the Cisco CCNA (expected November 2026) and ITIL 4 Foundation (expected December 2026). The homelab is where I practise the technical side, from working a ticket queue to building a VLAN network to writing the PowerShell that fixes a stuck print queue.
CompTIA Security+ ceIssued by CompTIA · October 2026Verify on Credly ↗
Twelve connected homelab projects. Tickets in the help desk lab point to the runbook, script or network scenario that fixes them, and the Active Directory lab is the base the rest build on.
A GLPI service desk running in Docker with a queue of 25 realistic tickets from a fictional office: lockouts, new hires and leavers, printers, VPN, phishing and BitLocker. A PowerShell script loads them through GLPI's REST API, and the repo has the SLA policy, escalation template and knowledge base template used to work the queue.
View repository ↗PowerShell tools for the most common desktop tickets: a slow-PC health check, a step-by-step network diagnosis, safe disk cleanup, a print spooler reset and a Windows Update repair. Plus runbooks, printer deployment with Group Policy, a sysprep reference image and remote support.
View repository ↗Onboarding and offboarding scripts written with Microsoft Graph PowerShell: create users with licenses and groups, then block sign-in, revoke sessions, keep the mailbox as shared and remove licenses in a safe order. Guides cover MFA with Conditional Access, Intune enrollment, compliance and BitLocker recovery.
View repository ↗A 4-VLAN office network for Packet Tracer with 802.1Q trunks, router-on-a-stick routing, DHCP, NAT, a guest network that can't reach staff systems, port security and DHCP snooping. It comes with 12 break-and-fix scenarios written the way tickets arrive: as user complaints.
View repository ↗A two-domain-controller Windows Server 2022 forest with AD-integrated DNS and DHCP, modelled on a mid-size company: departmental OUs with delegated rights, bulk user provisioning from CSV with PowerShell, and Group Policy for password baselines, drive mappings and software restriction.
View repository ↗PowerShell tools for patch-compliance reports, audits of disabled accounts that still hold group memberships, and stale computer object cleanup (dry-run by default), plus an Ansible playbook for patch inventory. 10 automated tests run on every push and caught 2 real bugs.
View repository ↗Zabbix deployed in Docker to watch the domain controllers and endpoints, configured through its API. In an outage test the alert fired in 195 seconds and cleared 113 seconds after recovery.
View repository ↗Windows Event Log and Sysmon telemetry forwarded into Splunk, with custom SPL detections for brute force (T1110), PsExec lateral movement (T1021.002) and encoded PowerShell (T1059.001). Tested against 37,364 real Windows attack events: a PsExec rule that missed renamed tools was rewritten to be behaviour-based (0 to 8 detections on 4 hosts).
View repository ↗Runs real attacker techniques against the AD lab with Atomic Red Team: Kerberoasting (T1558.003), LSASS credential dumping (T1003.001) and encoded PowerShell. It then checks whether the Splunk detections fire and adds new rules where there are gaps.
View repository ↗Network security monitoring with Zeek, Suricata and Kibana, covering what's visible on the wire rather than on the host. Traffic generated in the lab (port scans, beaconing) is triaged and written up in an analyst log.
View repository ↗The full vulnerability management cycle against intentionally vulnerable targets: OpenVAS scanning, manual verification, and a report with CVSS-scored findings and prioritized remediation, compared across DVWA security levels.
View repository ↗Static and dynamic analysis of public samples in an isolated, snapshotted sandbox VM. Each write-up covers PE inspection, process, registry and network behaviour, extracted IOCs and a MITRE ATT&CK mapping.
View repository ↗I'm looking for IT support, help desk, desktop support and network support roles in the Greater Toronto Area, as well as junior sysadmin and SOC analyst roles. Happy to walk through any of these labs.