Same apprenticeship, three very different teams: infrastructure, security, and now AI/ML.
My path so far runs through infrastructure, security operations and detection engineering — now I'm on the AI/ML team, turning customer and pricing data into decisions.
About
2023 — presentStarted my apprenticeship at Sunrise with a foundational year at the BBC, building core IT fundamentals.
Worked on the Service Desk, handling first-line support and getting close to the day-to-day issues users actually run into.
Moved into the Security Abuse Team, shifting focus from support to protecting infrastructure and handling abuse cases.
Part of the Security Operations Center (SOC): worked with Microsoft Defender and Sentinel, ran incident response, and led a MITRE ATT&CK coverage project, writing and testing new detection rules in KQL.
Took on an unplanned assignment after a department restructuring: investigated the Badbox security issue and informed affected customers, then job-shadowed across teams to choose a direction for my fourth apprenticeship year.
Now on the AI/ML team, working on customer retention analytics and pricing.
Projects
selected workMITRE ATT&CK detection engineering
Analyzed how well our infrastructure was covered against the MITRE ATT&CK framework across Microsoft Sentinel and Elastic, then closed the gaps I found. Wrote and tested new KQL detection rules — including six targeting commonly exploited processes and one flagging anomalous MFA login attempts — always running a staging period before going live. Converted a set of Analytic Rules into cost-efficient Custom Detection Rules, and finished by mapping every rule back to its MITRE technique.
Customer retention & competitor intelligence (AI/ML)
Currently analyzing retention call topics against the survival scores used in pricing, with a focus on cases the model gets wrong. Building a Python tool that checks competitor offers and conditions daily, starting with Swisscom, Salt and Sunrise, and cross-referencing internal order data to surface discrepancies — building on how this was previously done manually.
Badbox security response
Picked up an unplanned assignment when my next rotation fell through: got up to speed on the Badbox threat from scratch and worked directly with affected customers to explain the risk and next steps.
Hybrid infrastructure with Azure VDI and Docker
Built a hybrid IT infrastructure with AD, print, and file servers, department-specific Azure Virtual Desktop environments, WordPress in Docker, and backups via Synology NAS — from planning through testing and documentation.
Confluence to TheHive: DOCX to Markdown migration
Migrated internal documentation from Confluence into TheHive-compatible Markdown using Pandoc, cleaning up complex sections and manually verifying every image and link.
NextCloud deployment on AWS Fargate
School project: containerized and deployed NextCloud on AWS Fargate as part of a cloud deployment module, alongside database optimization and monitoring topics.