PBPatrick Borges
LinkedIn Résumé

Systems & Infrastructure Administrator

Patrick Borges

Systems and infrastructure administrator in managed services, currently supporting a municipal government and two police departments while managing and training junior technicians. Built a police department's CJIS security and compliance program across three sites. Strong in Active Directory and hybrid identity, Windows Server, Linux, network and firewall engineering, and infrastructure automation, with prior manufacturing and healthcare IT experience.

Download résumé See experience
Emailpatrick.borges0514@gmail.com
Phone786-897-1651

Certified

  • Microsoft SC-300
  • CompTIA A+
  • CompTIA Tech+
  • ITIL 4 Foundation
  • CJIS Security Awareness, Level 4

In progress

  • CompTIA Network+
  • LPI Linux Essentials
  • Azure Fundamentals (AZ-900)

Experience

3 employers · 2022 to present

Setting
Managed services, with public-sector clients
Clients
A municipal government and two police departments, plus escalations from the firm's other clients

Across Lansight

Team lead and escalation

  • Manage and train junior technicians, setting daily priorities, reviewing completed work, and developing their skills across Active Directory, endpoint management, and networking.
  • Serve as escalation point for complex infrastructure and security issues across the firm's other managed-services clients.

Client

Municipal government & police department

  • Administer Active Directory and hybrid identity, network and firewall infrastructure, endpoint management, and public-safety systems for a municipal government and its police department.

Client · CJIS-regulated · 3 sites

Municipal police department

Built the department's CJIS security and compliance program across three sites

  • 3sites in one CJIS-regulated agency
  • 3audit control gaps closed by the new SIEM
  • 2site-to-site tunnels, one new and one restored
  • 4VLANs across the firewall fleet
Service map of the police department's environment. Each component opens the related workstream. Patrol unitsAnyConnect VPN Carrier A + Bdual-WAN failover Remote sitessite-to-site VPN Edge firewallsCisco ASA / Firepower · pfSense · 4 VLANs Active DirectoryAD DS · Group Policy · LDAPS Entra ID · M365 GCCsynced via Entra Connect EndpointsWazuh agents via GPO Microsoft Defendertelemetry into the SIEM Wazuh SIEM90d indexed · 365d archive
How the program's systems connect, simplified, with no names, addresses or hostnames. Select a component to open the work behind it.

Security monitoring

  • Deployed the agency's first centralized SIEM and log-aggregation platform (Wazuh on Ubuntu Server), closing three documented audit control gaps and configuring CJIS-compliant retention (90-day indexed, 365-day archive) via automated index lifecycle policy and scheduled pruning; built and signed off the agency's first formal recurring audit-log review.
  • Automated fleet-wide agent deployment through Group Policy using idempotent PowerShell staged in SYSVOL for zero-touch enrollment; integrated Microsoft Defender telemetry into the SIEM, validated the detection path end to end with controlled testing, and authored custom detection rules for alert tuning and false-positive suppression.
Log retention on the SIEM, in days
Indexed and searchable90 days
Archive365 days

Compliance and audit

  • Assessed a three-site, CJIS-regulated municipal police department against the FBI CJIS Security Policy and NIST 800-53 Moderate baseline for an FDLE audit, documenting control gaps with remediation roadmaps.
  • Authored the agency's change-controlled CM-2 Baseline Configuration (network topology, asset inventory, control implementation record) and its Cybersecurity Incident Response Plan (CIRP).
  • Performed FIPS 140-2/140-3 CMVP validation research across firewall, MFA, and mobile cryptographic modules, identifying firmware-to-certificate version mismatches that invalidated assumed compliance before audit submission.

Frameworks and deliverables

  • FBI CJIS Security Policy
  • NIST 800-53 Moderate
  • FDLE audit
  • FIPS 140-2 / 140-3 (CMVP)
  • CM-2 Baseline Configuration
  • CIRP

Network and remote access

  • Built the department's remote-access VPN from scratch on Cisco Firepower, authenticating against Active Directory over LDAPS via a dedicated unprivileged service account, and deployed AnyConnect to give patrol officers secure field access.
  • Engineered site-to-site VPNs linking remote sites to the main station (one new tunnel, one restored) and designed dual-WAN failover with a secondary carrier and segmented egress across a Cisco ASA/Firepower and pfSense fleet covering four VLANs.
  • Replaced three failing access switches and a legacy hub in the main network closet with managed Ubiquiti UniFi PoE switches, modernizing the access layer and consolidating powered devices.

Identity and systems

  • Resolved UPN suffix rewriting and alternate-login-ID authentication failures in the agency's hybrid identity (on-premises Active Directory synced to Entra ID and Microsoft 365 GCC via Entra Connect) and made OU placement an enforceable policy control.
  • Deployed a new Dell server, rolled out agency-wide MFA, configured patrol-unit GPS tracking, and owned user provisioning.
On-premisesActive Directory
Entra Connect
CloudEntra ID · M365 GCC
Hybrid identity: the directory the UPN fixes applied to

Public-safety systems

  • Led the migration of the department's Computer-Aided Dispatch (CAD) system from CentralSquare to Mark43, coordinating vendors and stakeholders to maintain continuity of mission-critical public-safety operations.
FromCentralSquare
ToMark43
Computer-Aided Dispatch (CAD) platform migration
Setting
Manufacturing and distribution, across offices and warehouses
  • 4distribution centers
  • 600+employees supported
  • 2,000+devices supported

Operations and endpoints

  • Managed IT operations across 4 distribution centers supporting over 600 employees and 2,000+ devices.
  • Administered Microsoft Intune and Active Directory, standardizing device compliance policy and streamlining onboarding.
  • Supported enterprise A/V systems and Microsoft Teams meetings for executive operations.
  • Reviewed change requests at the Change Advisory Board (CAB) for implementation risk and rollback readiness.

Network

  • Deployed Meraki switches and wireless access points, strengthening network reliability across offices and warehouses.
  • Implemented cabling and network-documentation SOPs, reducing repeat cabling faults and shortening fault isolation time.
Setting
Healthcare, across multiple health centers
  • 500+endpoints supported
  • 300staff members supported
  • 0access-related incidents

Endpoints and identity

  • Supported over 500 endpoints and 300 staff members across multiple health centers.
  • Optimized Microsoft Intune deployment workflows, tightening update compliance across the managed endpoint fleet.
  • Administered on-premises Active Directory and Azure AD (now Entra ID), managing user accounts, groups, GPOs, and security permissions with zero access-related incidents.

Infrastructure and vendors

  • Installed and configured servers and networking equipment to improve clinic performance and reduce recurring ticket volume.
  • Coordinated with vendors on infrastructure upgrades, improving uptime across clinic sites.

Skills

6 technical domains · 8 core competencies

Core competencies

  • Systems & Infrastructure Administration
  • Deployment & Lifecycle Management
  • Vendor Coordination
  • Root Cause Analysis
  • IT Operations Management
  • Process Optimization
  • End-User Support Excellence
  • Incident, Problem & Change Management

Directory, Identity & Endpoint

  • Active Directory Domain Services
  • domain controller deployment
  • OU design
  • Entra ID
  • Entra Connect
  • Microsoft 365 GCC
  • Microsoft Intune
  • Group Policy
  • AGDLP delegation
  • MFA (Duo, YubiKey)
  • PowerShell

Networking

  • Cisco ASA/Firepower
  • pfSense
  • Ubiquiti UniFi
  • Cisco Meraki
  • VLANs & subnetting
  • site-to-site and client VPN (AnyConnect, WireGuard)
  • dual-WAN failover
  • DNS (Pi-hole, Unbound, CoreDNS, DNSSEC)
  • DHCP
  • NAT
  • nmap

Systems

  • Windows Server
  • Hyper-V
  • VirtualBox
  • Ubuntu
  • Debian
  • Fedora
  • apt/dnf package management
  • LVM/XFS
  • systemd
  • SSH

Security

  • Wazuh SIEM
  • Huntress
  • Microsoft Defender
  • Microsoft Purview
  • log retention & audit review
  • attack-surface reduction
  • least-privilege access design
  • network auditing & asset inventory (Snipe-IT)

Containers & Observability

  • Docker
  • Docker Compose
  • Portainer
  • Uptime Kuma
  • node_exporter

Tooling

  • Git/GitHub
  • SQL fundamentals
  • AI prompting for technical workflows (Claude Code)

Credentials

5 earned · 3 in progress

Certifications earned

  • MicrosoftSC-300Identity and Access Administrator
  • CompTIAA+
  • CompTIATech+
  • Service managementITIL 4 Foundation
  • CJISSecurity AwarenessLevel 4 · IT/System Administrator

In progress

  • LPILinux Essentials010-160
  • CompTIANetwork+
  • MicrosoftAzure FundamentalsAZ-900

Education

  • Western Governors University (WGU)B.S. Cloud & Network EngineeringMicrosoft Azure · In Progress
  • Miami Dade CollegeIT Coursework

Homelab

4 builds · personal lab

Personal labBuilt and run on my own time, separate from client and employer environments.

Highly available DNS

  • Designed and operate a redundant two-node DNS architecture with no single point of failure, with both nodes advertised via DHCP for genuine client-side failover.
  • Separated the three DNS layers cleanly: filtering (Pi-hole v6), recursive resolution from root servers with DNSSEC validation (Unbound, no third-party forwarder), and authoritative internal-zone service (CoreDNS).
  • Built automated primary-to-secondary zone replication on a scheduled job with logging, and conditional forwarding so only internal-zone queries reach the authoritative server.
Lookup path: clients ask Pi-hole; internal-zone queries go to CoreDNS and everything else goes to Unbound, which resolves from the root servers with DNSSEC validation. Clients both nodes via DHCP Pi-hole v6 filtering internal zone everything else CoreDNS authoritative Unbound recursive · DNSSEC → root servers
One lookup, simplified. DHCP hands out both nodes, and the internal zone replicates primary to secondary on a schedule.

Network audit & attack-surface reduction

  • Conducted a full network audit correlating DHCP leases, router configuration, and nmap sweeps into a verified 34-node device inventory maintained as a versioned source of truth.
  • Identified a UPnP-created port mapping silently exposing a device management interface to the public internet; disabled UPnP and closed the exposure.
  • Reduced host attack surface by disabling unused radios and unnecessary boot-time services, and added logging to previously silent automation.
  • Deployed WireGuard as the sole remote-access path, with no services exposed through direct port forwarding.
  • DHCP leases
  • Router configuration
  • nmap sweeps
34devices in a verified, versioned inventory
Three sources cross-checked into one inventory

Windows Server & Active Directory lab

  • Built a multi-server Windows Server lab on VirtualBox with an isolated routed segment, promoting the forest root domain controller for a new AD DS forest with integrated DNS.
  • Modeled an OU hierarchy on production practice (Users, Groups, Workstations, Servers, Service Accounts) rather than relying on default containers.
  • Implemented AGDLP group nesting for role-based access delegation, validated against a test account.
forest root domain   AD DS + integrated DNS
├── Users
├── Groups
├── Workstations
├── Servers
└── Service Accounts
OU layout modeled on production practice

Linux administration

  • Builds and administers parallel lab VMs across both major package ecosystems, Fedora Server (dnf/rpm) and Debian (apt/dpkg), for cross-distribution fluency.
  • Performed live storage expansion on an LVM-backed XFS volume end to end, with headless CLI administration over SSH.
  1. 1Hypervisor disk resize
  2. 2Partition growth
  3. 3PV resize
  4. 4LV extend
  5. 5Online filesystem grow
The live XFS expansion, step by step

Contact

Hiring for a systems or infrastructure role? I'd like to hear about it.

Phone786-897-1651
Download résumé (PDF)