Matthew Taylor
Resume

Network & Security Infrastructure

Matthew Taylor

I design, build, and secure multi-site networks, from firewall policy down to the cable plant.

Seven-plus years across the U.S. Air Force and enterprise IT. I currently own the network for a four-office firm: FortiGate and SonicWall firewalls, site-to-site IPsec VPN, identity-based remote access, and the documentation that keeps it maintainable.

View experienceDownload resume
Hub-and-spoke site-to-site VPN topologyA central headquarters firewall connected by encrypted IPsec tunnels to two remote-office edge firewalls, with a temporary tunnel to a legacy file server used during a provider transition.IPSECIPSECTRANSITIONHQFortiGateRemote ASonicWallRemote BSonicWallLegacy MSPFile server
Fig. 01Multi-site VPN design, simplified
  • Active Top Secret clearance
  • CompTIA Security+
  • IAT Level II
  • U.S. Air Force Reserve

01 · About

Built deliberately, documented properly.

I started as a Cyber Defense Operator in the U.S. Air Force, configuring Cisco and Juniper gear on secure and non-secure networks, deploying satellite communication nodes, and hardening Windows Server to STIG baselines for a 1,000+ user environment.

Today I handle network and systems work for a law firm across four offices, and I continue serving in the Air Force Reserve as a Cyber Defense Operations Specialist. I like infrastructure that is built deliberately: segmented, least-privilege, automated where it helps, and documented so the next person can understand it.

Active Top Secret (TS) security clearance

Areas of focus

Network infrastructure
Routing and switching across Cisco, Juniper, and Meraki; VLAN design, trunking, OSPF/BGP, and structured cabling.
Network security
Next-generation firewall policy, IPS and SSL inspection, site-to-site IPsec and SSL VPN, centralized logging.
Identity & access
Active Directory and Group Policy, Microsoft Entra MFA and SSO, identity-based remote access.
Hardening & vulnerability management
STIG compliance, ACAS vulnerability scanning, and routine patching under change control.
Automation
Python and PowerShell for deployment, configuration, and network tasks.
Documentation
Topology diagrams, IP addressing schemas, and configuration baselines.

02 · Skills

Technical skills

The platforms and practices I work with, grouped by area and listed as they appear in my day-to-day work.

Core networking

  • TCP/IP & subnetting
  • DNS / DHCP
  • VLANs & 802.1Q trunking
  • Static & dynamic routing (OSPF, BGP)
  • NAT & ACLs
  • Spanning tree
  • Wireless networking

Network security & platforms

  • Fortinet FortiGate
  • SonicWall
  • Cisco IOS & Meraki
  • Juniper
  • Site-to-site IPsec / SSL VPN
  • Firewall policy optimization & logging
  • IPS profiles & SSL inspection

Systems & identity

  • Active Directory & Group Policy
  • Microsoft Entra ID (MFA, SSO)
  • Windows Server
  • Red Hat Linux
  • Remote Desktop Services & FSLogix
  • PXE / FOG imaging
  • OneDrive Known Folder Move

Security tools & compliance

  • ACAS
  • Tanium
  • STIG compliance
  • Change control

Automation & scripting

  • Python
  • PowerShell

Communications & physical layer

  • RingCentral VoIP administration
  • Tactical SATCOM
  • TACLAN
  • Structured cabling & fiber
  • Network design documentation

03 · Experience

Professional experience

Most recent first. Open a role to see responsibilities and the platforms involved.

  1. –

    Albuquerque, NM

    Network and systems owner for a four-office firm: firewalls, VPN, identity, endpoints, and escalation support for 70+ users.

    • Designed and deployed the remote-office networks and connected two remote offices to headquarters via site-to-site IPsec VPN between SonicWall edge firewalls and the central FortiGate; authored the IP addressing schema and topology documentation.
    • Administer FortiGate policies and centralized logging across the multi-site enterprise, optimizing rule sets for least-privilege access, security monitoring, and threat detection.
    • Deployed Fortinet SSL VPN integrated with SSO for identity-based remote access for hybrid staff.
    • Configured FortiGate IPS security profiles and SSL inspection at the network edge.
    • Maintained secure access to legacy resources during the transition by building a site-to-site tunnel to the prior MSP's file server.
    • Built out the office network rack and structured cabling plant end to end, terminating 48+ runs in 2 days with labeled, managed cable paths.
    • Migrated unmanaged machines to the domain to centralize endpoint management; configured Remote Desktop Services with FSLogix for remote users.
    • Created Group Policy Objects enforcing access controls across all domain-joined machines, and enforced Microsoft Entra MFA and SSO across all firm applications.
    • Cut computer deployment time by building a PXE/FOG imaging server with a standardized golden image and Python/PowerShell post-image automation.
    • Migrated the firm from Folder Redirection to OneDrive Known Folder Move.
    • Administer, monitor, and troubleshoot the firm's RingCentral VoIP platform across four offices.
    • Serve as the escalation point for complex network and system issues for 70+ users across four offices.
    • FortiGate
    • SonicWall
    • IPsec / SSL VPN
    • Entra ID
    • Active Directory
    • RDS / FSLogix
    • FOG
    • Python
    • PowerShell
    • RingCentral

  2. –

    Colorado Springs, CO

    Secure local network and wireless infrastructure, vulnerability scanning, and account management.

    • Maintain and secure local network infrastructure and wireless communications; administer Cisco Meraki switching and wireless devices and process network access requests.
    • Perform vulnerability scanning with ACAS and apply patches, hotfixes, and security configurations across USAFR network devices and systems.
    • Manage Active Directory accounts, group policies, and access permissions.
    • Cisco Meraki
    • ACAS
    • Active Directory
    • Group Policy

  3. –

    Clovis, NM

    Aircraft cabling and communication systems on the U-28 Draco.

    • Installed and terminated fiber, RJ45, and coaxial cabling on U-28 Draco aircraft.
    • Maintained radio and satellite communication systems for reliable voice and data transmission.
    • Fiber
    • RJ45
    • Coax
    • SATCOM

  4. –

    Clovis, NM

    Six years of routing, switching, deployable communications, and system hardening on secure and non-secure networks.

    • Configured and troubleshot Cisco and Juniper routers and switches (VLANs, trunking, routing, and ACLs) on secure and non-secure networks, applying NSA-approved encryption practices.
    • Deployed satellite deployable nodes providing secure and non-secure voice, video, and data communications.
    • Operated the iGov TACLAN system with SDN to support communication lines for deployed MQ-9 operations.
    • Hardened Windows Server systems to STIG configuration baselines and maintained compliance through routine patching and change control.
    • Supported network and system administration for a 1,000+ user enterprise environment.
    • Managed the IT equipment account (ITAMS) for 4 years.
    • Cisco IOS
    • Juniper
    • TACLAN
    • SATCOM
    • Windows Server
    • STIG

04 · Projects

Selected work

Case studies from infrastructure I have designed and built. Employer work is described at a level that does not expose its configuration.

P/01Professional work

Multi-site network and site-to-site VPN

Connected two remote offices to headquarters over IPsec, with a documented addressing plan and a transition tunnel to the outgoing MSP.

  • FortiGate
  • SonicWall
  • IPsec
  • Structured cabling

Employer environment, no public repository

Problem
Remote offices needed secure, reliable access to headquarters resources, and the firm needed continued access to files held by its prior managed service provider during the handover.
Approach
Site-to-site IPsec tunnels between SonicWall edge firewalls at each remote office and the central FortiGate, built on a single IP addressing schema with topology documentation written alongside the build.
Implementation
  • Designed the remote-office networks and authored the IP addressing schema.
  • Built IPsec tunnels between SonicWall edge firewalls and the central FortiGate.
  • Stood up a separate site-to-site tunnel to the prior MSP's file server to keep legacy resources reachable during the transition.
  • Built the headquarters rack and structured cabling plant: 48+ runs terminated in 2 days with labeled cable paths.
Outcome
  • Remote offices connected to headquarters over encrypted tunnels.
  • Topology and IP documentation in place for ongoing operations.

P/02Professional work

Edge security and identity-based access

Layered next-generation firewall inspection with SSO-backed remote access and MFA across the firm.

  • FortiGate
  • Fortinet SSL VPN
  • Microsoft Entra ID
  • IPS
  • SSL inspection

Employer environment, no public repository

Problem
Hybrid staff needed remote access tied to their identity, and the network edge needed inspection beyond basic port and protocol rules.
Approach
Fortinet SSL VPN integrated with SSO, Microsoft Entra MFA and SSO enforced across firm applications, and FortiGate IPS profiles with SSL inspection at the edge. Firewall rule sets were reviewed for least privilege, with centralized logging.
Implementation
  • Deployed Fortinet SSL VPN with SSO for identity-based remote access.
  • Configured FortiGate IPS security profiles and SSL inspection.
  • Enforced Microsoft Entra MFA and SSO across all firm applications.
  • Optimized firewall rule sets for least-privilege access and enabled centralized logging for monitoring.
Outcome
  • Remote access is tied to user identity rather than shared credentials.
  • MFA enforced across all firm applications.

P/03Professional work

Endpoint imaging and domain consolidation

A PXE/FOG imaging server and golden image, plus a move of unmanaged machines under domain and Group Policy control.

  • FOG
  • PXE
  • PowerShell
  • Python
  • Group Policy
  • RDS
  • FSLogix
  • OneDrive KFM

Employer environment, no public repository

Problem
Machines were set up by hand and many sat outside the domain, so builds were slow and inconsistent and access controls could not be applied centrally.
Approach
A PXE/FOG imaging server with a standardized golden image and Python/PowerShell scripts for post-image configuration. Unmanaged machines were joined to the domain, with GPOs enforcing access controls.
Implementation
  • Built a PXE boot and FOG imaging server with a standardized golden image.
  • Wrote Python and PowerShell automation for post-image configuration.
  • Migrated unmanaged machines to the domain and created GPOs enforcing access controls.
  • Configured Remote Desktop Services with FSLogix profiles for remote users.
  • Moved user data from Folder Redirection to OneDrive Known Folder Move.
Outcome
  • Reduced computer deployment time.
  • Endpoint management centralized under the domain.

05 · Credentials

Education & certifications

Certifications & clearance

  • Security+

    CompTIA

  • Information Assurance Technical (IAT) Level II

    DoD 8570 / 8140

  • Security clearance

    Active Top Secret (TS) security clearance

Education & training

  • Community College of the Air Force

    Professional military education & technical training

    • Cyber Network Specialist Craftsman School
    • Cyber Network Specialist Apprenticeship School
    • Airman Leadership School

06 · Contact

Let's talk.

I'm interested in network engineering and network security roles. Email is the quickest way to reach me.