Michael Nault
GRC and IT Compliance | NIST SP 800-53 · PCI DSS · Microsoft Entra ID | Security+
Orlando, FL | naultmichael@gmail.com
naultmichael.com | linkedin.com/in/michael-nault-mgncoding2020 | github.com/MgnCoding2020
Summary
Entry-level GRC and IT compliance candidate. At an Amazon new-site launch, raised weekly SOX audit compliance from about 63–70% to 99%+ within one month and held it. Builds hands-on compliance programs — risk registers, control matrices mapped to NIST SP 800-53 and PCI DSS 4.0.1, audit evidence, POA&Ms, vendor risk assessments and access reviews — and administers a live Microsoft Entra ID and SharePoint tenant with exported evidence. CompTIA Security+, Network+, A+ and ITIL 4; finishing a B.S. in Cybersecurity and Information Assurance (WGU, January 2028).
Certifications and Education
- CompTIA Security+, Network+, A+ (2025) | ITIL 4 Foundation in IT Service Management (2026)
- Western Governors University, B.S. Cybersecurity and Information Assurance (in progress, expected January 2028)
- University of Central Florida, Full Stack Web Development Bootcamp Certificate
Skills
- Governance, risk and compliance: risk registers, control matrices, NIST SP 800-53 and 800-171, PCI DSS 4.0.1 crosswalk, POA&M tracking, audit evidence, vendor risk assessment, SOX audit compliance
- Identity and access: access reviews, Privileged Identity Management, least privilege, RBAC, Microsoft Entra ID, MFA, Conditional Access (report-only testing), Microsoft 365 and SharePoint
- Audit and monitoring: unified audit logging, eDiscovery and legal hold, Sysmon, Wireshark, Nmap
- Technical controls: DISA STIG hardening, SCAP Compliance Checker and STIG Viewer, Windows 10/11 and Server 2022
- Scripting and tools: PowerShell, Python (basic), GitHub Actions, Git, Playwright
Compliance Projects
Self-directed. The GRC program and hardening labs below are simulations for fictional organizations; the Entra ID and SharePoint work is in a live tenant. Full write-ups at naultmichael.com
GRC Security Program: Burn and Churn Coffee
| 2025 – 2026- Built a security program for a fictional card-accepting small business: asset inventory, risk register, and a 15-control matrix across 11 NIST SP 800-53 families, crosswalked to PCI DSS 4.0.1.
- Wrote 4 policies, 4 procedures and 4 incident-response playbooks, plus Python evidence checks for privileged-access and incident-log exceptions, tracked in a POA&M.
- Assessed a simulated payroll vendor (inherent risk High, 4 findings, approved with conditions at Moderate residual risk) and ran a quarterly access review across 5 business systems.
Cyber Home Lab: Entra ID and SharePoint governance
| 2025 – 2026- Administered a live Microsoft Entra ID tenant: users, groups, licenses and scoped admin roles; built Conditional Access policies including report-only evaluation and a phishing-resistant MFA policy, exported to JSON as evidence.
- Ran a Privileged Identity Management cycle end to end (eligible, activated, removed) and a full access review (created, pending, completed), evidenced with screenshots, PowerShell transcripts and a sign-in log export.
- Enabled and queried the unified audit log, and configured an eDiscovery case with legal hold and search over a restricted SharePoint evidence site with unique permissions and a per-site external-sharing override.
HomeEDR: Control Evidence Pipeline
| 2025 – 2026- Mapped scheduled PowerShell drift monitoring to 4 NIST SP 800-53 controls (AU-6, CM-6, CM-7, SC-7), with an evidence matrix regenerated by a GitHub Action and a POA&M of 5 findings from a dedicated VM lab.
- Extended it into a 20-script incident-triage toolkit and a 13-document playbook series.
STIG and NIST SP 800-171 Labs
| 2025- Ran a SCAP scan of a pre-hardening Windows 10 VM against the DISA Windows 10 STIG: 225 rules assessed, 137 open findings, about 35% baseline compliance.
- In a separate lab, implemented and validated 4 STIG controls (firewall, inbound restriction, firewall logging, account lockout) mapped to NIST SP 800-171, with PowerShell evidence export.
Workspace: Microsoft 365 Intranet
| 2026- Verified against a live Microsoft 365 tenant (Sept 2026): MSAL sign-in with no client secret, SharePoint reads and writes, and user roles derived from Entra ID group membership via Microsoft Graph.
- Found and fixed a stored XSS flaw across 60 unsafe insertion points; backed by 454 automated checks.
Professional Experience
Amazon Fulfillment Centers, Orlando, FL and Knoxville, TN
| Oct 2020 – PresentFulfillment Associate, Pick and Pack (MCO1)
| May 2024 – Present- Pick and pack customer orders across singles, multi-item and SLAM stations to rate and quality standards.
Quality Process Assistant, New Site Launch (TYS1)
| Jul 2023 – Apr 2024- Raised weekly SOX audit compliance from about 63–70% to 99%+ within one month, and held it, through structured tracking and training on every shift.
- Wrote exception-handling SOPs that cut unresolved inventory exceptions from 50+ pods across four floors to 1–2 per floor.
- Analyzed ICQA count error trends and drove process fixes that cut DPMO from about 37k to 10k.
- Walked the building daily to find stalled inventory, reporting counts, photos and changes to the Operations Manager and AGM.
- Created trouble tickets to route quality issues to owning departments; trained associates and problem solvers on count, escalation and audit procedures.
Stow Process Assistant (MCO1)
| Jun 2021 – Jul 2023- Led daily start-ups for 60–80 associates, staffed the floor and coached on quality; the team ranked #1 in productivity in the building.
- Held stow DPMO at 5–7k, under the site's 10k limit; inbound quality ranked top 3 of 90+ network sites.
- Guided Area Managers through filing trouble tickets to other departments, and mentored newly promoted PAs.
Fulfillment Associate (MCO1)
| Oct 2020 – Jun 2021- As a Process Guide, supported Area Managers and PAs with audits, floor readiness and headcount moves.
Massey Services, Kissimmee, FL
| Feb 2017 – Aug 2020Pest Prevention Specialist and Customer Support
- Kept the service and regulatory records required for state licensing across a recurring base of 215–280 clients; scheduled service and resolved issues by phone and on site.