Juan Felipe
Castillo Collazos
More than five years administering Microsoft Entra ID, Active Directory and Microsoft 365 for organizations of up to 2,500 users — Conditional Access, MFA, SSO and Zero Trust access, designed with Information Security. Lately the perimeter too: OPNsense, Wazuh, Zabbix and VMware, held together with Python and PowerShell.
Profile
I work where people meet systems: deciding who gets access to what, under which conditions, and being able to prove it later in an audit. Most of that work has lived inside Microsoft Entra ID, Active Directory and Microsoft 365, for organizations of up to 2,500 users.
The other half is keeping the ground under that identity layer steady — firewalls, VPNs, directories, hypervisors and monitoring — and leaving behind documentation the next engineer can actually follow.
I am preparing the Microsoft SC-300 certification to formalize that focus on identity security.
2,500+
99.9%
30
−50%
Experience
Eight roles since 2020, from a first trainee post to running identity and infrastructure for two organizations at once.
CESPlus Cinema
- Administer corporate identity across Google Workspace, Zoho, Microsoft 365 and Slack, with SSO, MFA and periodic access audits.
- Secure domains, DNS and email routing with SPF, DKIM and DMARC.
- Design corporate VPN architectures — site-to-site, client-to-site and ZTNA — and enforce MDM policies in Intune and Google Endpoint for disk encryption, patching and EDR.
- Run the hardware lifecycle end to end, from procurement and imaging to security baselines, including cross-border LATAM shipping and customs.
- Build automations in Python, PowerShell and Google Apps Script, and roll out AI chatbots in Zoho SalesIQ and Slack to speed up ticket resolution.
- Lead help-desk support and SLA compliance across departments; negotiate vendor and MSP contracts.
LinkUp Talents
- Administer VMware vSphere and ESXi: VM deployment, resource allocation and infrastructure tuning for high availability.
- Deploy virtualized Active Directory domain controllers, enforcing GPO and role-based access control.
- Configure OPNsense firewalls for network segmentation, secure routing and perimeter rules.
- Run Wazuh SIEM for threat detection alongside Zabbix for performance monitoring; build Azure REST API integrations for real-time telemetry.
- Lead deployment, baseline hardening and ongoing administration of enterprise software and virtual servers.
Visa
- Administered VDI solutions end to end, including the policy and procedure design for enterprise deployment.
- Managed the Microsoft 365 hybrid deployment and its security policies; engineering escalation for Azure, Conditional Access and Intune.
- Partnered with the Information Security Office to validate deployments against corporate security requirements and to investigate security alerts.
- Documented policies, procedures and training plans for systems administration and operations teams.
Samana Group LLC
- Level 2 identity and access support across Microsoft 365, Active Directory, PeopleSoft (myHR, Finance), OneView, MAPS, NVS and Fexco.
- Wrote the resolution-process documentation for identity and access tickets on every supported platform.
Belcorp
- Managed and secured Azure, Microsoft 365, Entra ID and Intune for more than 2,500 users, sustaining 99.9% service availability for mission-critical operations.
- Led a 30-person support organization — 10 onsite engineers and 20 help-desk agents — cutting average resolution time (MTTR) by 15% and reaching 92% user satisfaction.
- Negotiated and managed service delivery with more than five external IT providers, securing a 10% saving on annual IT procurement.
- Reported SLA and OLA metrics and KPIs to executive leadership.
PeakSupport
- Administered Azure AD users, security and policies, Microsoft 365, Exchange, Entra ID, Autopilot and Intune across the full identity and device lifecycle.
1980TIC Cloud
- Administered Azure AD identity, security policies and Microsoft 365 and Exchange across a multi-client environment running on VMware ESXi, Proxmox, Linode and OVH.
- Oversaw more than 1,500 client support requests, cutting resolution time by 50% and reaching 86% customer satisfaction through new QA processes.
MarketMix
- Administered Windows Server 2012 and AWS EC2 infrastructure, Nagios monitoring and Sophos security policies.
Expertise
Six areas of practice. Each closes with the organizations where it was applied.
Identity & Access
Security Operations
Cloud, Virtualization & Monitoring
Automation & Scripting
Service Management
End-User Computing
Selected work
Four pieces of current work, described as they stand today — including what is still in progress.
One identity, four platforms
- A film-industry company running its operation across Google Workspace, Zoho, Microsoft 365 and Slack — each with its own sign-in and its own admin console.
- SSO and MFA across the stack, periodic access audits, and investigation of suspicious sign-ins and third-party OAuth grants, with account suspension when warranted. Domains, DNS and mail routing hardened with SPF, DKIM and DMARC.
Remote access and device posture
- Staff and equipment distributed across Latin America that need corporate resources without exposing them to the open internet.
- VPN architectures for site-to-site, client-to-site and zero-trust (ZTNA) access. MDM policies in Intune and Google Endpoint enforce disk encryption, patching and EDR; devices are imaged and security-baselined before they ship across borders.
Perimeter, detection and alerting
- Client server estates that needed segmentation at the edge, threat detection, and alerts that reliably reach a person.
- OPNsense firewalls with segmentation and perimeter rules; Wazuh for detection and Zabbix for performance. One Microsoft 365 SMTP configuration over STARTTLS shared by two Zabbix servers, Wazuh and Nextcloud, tested against a controlled recipient before production. Zenarmor in monitoring-only mode feeds daily and weekly Python reports for about twenty workstations.
Nextcloud, modernized in place
- A self-hosted Nextcloud 23 on Debian, PHP 7.4 and MariaDB 10.5 holding about 2.6 TB of company files — several major versions behind and out of support.
- Consecutive major upgrades instead of one jump, each gated by backups and snapshots, compatibility checks and validation before any destructive step, carrying Redis and ONLYOFFICE along.
Education & certification
- Microsoft Certified: Identity and Access Administrator Associate (SC-300)
- Software Engineering
- Technology Degree, Mechatronics (Mecydice)
Contact
Write about identity, access, or the infrastructure underneath.