Paul Fregonese
Cybersecurity automation engineer with 8+ years at a managed security provider protecting ~10,000 endpoints for about 100 regulated financial-services firms — building detection and auto-remediation across macOS and Windows fleets, and owning Duo MFA across 128 client tenants.
# About Me
Cybersecurity automation engineer with over 8 years at a managed security provider, protecting ~10,000 endpoints across roughly 100 regulated financial-services clients. I build detection and auto-remediation across macOS and Windows fleets, and own Duo MFA across 128 client tenants.
I run root-cause investigations through to vendor fixes — including tracing an Apple kernel bug on M5 Macs back to Apple's NECP network-filter path, filing the Apple Feedback report, and coordinating the fix across Sophos, Addigy, and Apple. I script in PowerShell, Bash, and Python, and I'm the team's escalation point, including after-hours incidents.
I've also deployed and maintain Claude Desktop and Claude Code across a client's Mac and Windows fleets — CVE remediation, version-compliance reporting, and turning manual security operations into fully automated, self-closing pipelines.
Compliance & Evidence
SOC 2 audit evidence, encryption and local-admin audits for regulated financial clients
Automate Everything
Python, PowerShell, Bash — self-closing detection and auto-remediation at fleet scale
AI-Augmented Ops
Deployed and maintain Claude Desktop & Claude Code across client Mac and Windows fleets
# Experience
Lead Cybersecurity Automation Engineer
FCI Cyber Inc. — Paramus, NJ- Own Kaseya VSA (two instances), Addigy MDM, and Duo MFA for a managed security provider serving about 100 regulated financial-services clients; handled 529 tickets across 100 clients from Nov 2025 to Sep 2026.
- Closed a cross-tenant access gap: found zero access tags across 128 Duo MSP subaccounts — all 17 master admins could reach every client tenant — isolated the internal tenant and moved 12 admins to scoped Account Switcher access.
- Root-caused an Apple kernel bug: traced recurring kernel panics on M5 Macs to Apple's NECP network-filter path, filed Apple Feedback FB22810584, built fleet-wide detection, and coordinated Sophos, Addigy, and Apple.
- Built fleet detection and auto-repair: found 99 of 322 Macs with silently failed ScreenConnect agents and repaired ~90; dated a Kaseya agent binary deletion to the minute through forensics, then deployed agent-health detection and automatic repair.
- Deployed and maintain Claude Desktop and Claude Code across a client's Mac and Windows fleets, including CVE remediation and recurring version-compliance reporting.
- Built compliance tooling — language-independent BitLocker and local-admin audits, SOC 2 audit evidence, and account lockout/password policy enforcement after a client security assessment.
- Manage vendor escalations with Apple, Sophos, Kaseya, Addigy, and Cisco/Duo; serve as the team's technical escalation point, including after-hours incidents.
Level 1 Support Engineer
FCI Cyber Inc. — Paramus, NJ- Produced comprehensive reports and documentation from nightly regression testing.
- Identified security vulnerabilities and led implementation of automated testing infrastructure.
- Developed best-practice policies for onboarding, scaling, backups, and disaster recovery.
Co-Owner
Blue Apple Computer Repair LLC — Cliffside Park, NJ- Managed 200+ endpoints as primary remote helpdesk and cybersecurity support.
- Designed and implemented wired and wireless network infrastructures for office environments.
- Provided end-to-end technical support to businesses and individuals.
# Technical Arsenal
Endpoint Management
Security Platforms
Languages & Scripting
Compliance & IR
Identity
AI Tooling
# Certifications
CISM
CEH
CySA+
ET15 — Endpoint Engineer v6.0
S15 — Endpoint Technician v6.0
Sales Professional Certification for Partners
Claude Code in Action
Claude with the Anthropic API
Introduction to Model Context Protocol
AI Fluency: Framework & Foundations
Claude 101
# Get In Touch
Want to connect, collaborate, or talk cybersecurity and automation? Reach out anytime.