Santosh Karki · IT & Cybersecurity Engineer · Dubai, UAE

Keeping organisations secure, compliant and running.

10+ years designing, securing and running Microsoft 365, identity, endpoint and network environments for regulated organisations in the UAE — so people can get on with their work and auditors have nothing to chase.

10+
years of IT in the UAE
300+
users secured end to end
M365
Azure · Defender XDR · FortiGate
Santosh Karki, arms crossed, in a dark blazer
Santosh KarkiSecurity-first IT, Dubai, UAE
Platforms I work with
  • Microsoft 365
  • Azure
  • Entra ID
  • Defender XDR
  • Intune
  • Teams
  • Windows 365
  • Fortinet
  • Veeam
  • Bitdefender
  • Aruba CX
  • PowerShell
About me

Built by struggle. Driven by purpose.

From a small village in Nepal to building a career in technology in Dubai — a journey shaped not by privilege, but by persistence.

Where it started

I was born into a world where opportunities were limited, money mattered, and dreams often had to wait behind responsibilities.

I grew up in a small village in Nepal, where life taught me lessons long before any classroom did. Financial struggles were part of everyday reality. Access to quality education wasn't always easy, and family responsibilities meant that personal ambitions couldn't always come first.

I learned early that wanting something and having the opportunity to pursue it were two very different things.

But I also learned something more important: your circumstances may define your starting point, but they don't have to determine your destination.

Read the full storyShow less

Finding my way into technology

I didn't enter the world of IT with a perfect plan, expensive resources, or a clear career path.

I entered it with curiosity.

I wanted to understand computers, how systems communicated, why things failed, and how to make them work again. That curiosity became an interest, the interest became a skill, and eventually, that skill became my profession.

The journey was far from straightforward. There were things I wanted to study but couldn't afford, opportunities I wasn't ready to take, and moments when responsibilities had to come before education.

So I learned differently.

Through practical experience, independent study, mistakes, troubleshooting, and countless hours spent figuring things out, I slowly built the knowledge that formal opportunities alone couldn't give me.

I didn't always have the resources to learn the easiest way. I had to find my own way.

From Nepal to Dubai

Moving to the UAE opened a new chapter, but it didn't erase the challenges.

Building a professional life away from home required adaptation, patience, discipline, and the courage to keep moving forward even when progress felt slow.

Over the years, I worked my way into increasingly complex IT responsibilities, gaining hands-on experience across systems administration, enterprise infrastructure, Microsoft 365, Azure, cybersecurity, networking, and business automation.

Today, with more than a decade of experience, I help organizations manage, secure, and modernize their technology environments.

But behind every technical solution is a much longer story: a young man from a small village who had to work for opportunities that others might have taken for granted.

I'm proud of the professional I've become. But I'm equally proud of the difficulties I refused to let define me.

More than a career

Technology is what I do, but it isn't everything I am.

I'm a husband, a father, and someone who understands the value of responsibility. Much of what drives me today comes from wanting to create a better future for my family while staying connected to the values I grew up with.

Outside work, I enjoy spending time with my children, exploring new places, and finding a little peace with a strong cup of black coffee.

And even when I'm away from the office, my curiosity rarely switches off. I enjoy building websites, experimenting with automation, exploring cloud technologies, and working on ideas that might one day become something bigger.

The journey continues

I don't claim to have achieved everything I dreamed of.

There are still goals to pursue, skills to master, risks to take, and chapters yet to be written.

I know what it feels like to have ambitions bigger than your circumstances. I know the weight of financial limitations, missed educational opportunities, and responsibilities that cannot be postponed.

Those experiences didn't make the journey easier. They made its purpose clearer.

I am not defined by the opportunities I didn't have. I am defined by what I chose to build with the opportunities I found.

Three things continue to shape my life

  1. Technology and Innovation

    Because I believe knowledge can open doors that circumstances once kept closed.

  2. Family and Responsibility

    Because success means very little if it doesn't improve the lives of the people who matter most.

  3. Entrepreneurship and Independence

    Because my ambition isn't only to build a career. It's to create something of my own, something meaningful, and something that lasts.

You don't need a privileged beginning to build a meaningful future. You need the courage to begin, the discipline to continue, and the determination not to surrender when the road becomes difficult.
My story began in a small village in Nepal. It is still being written.
Expertise

One engineer across the whole stack.

From the identity layer to the firewall to the person reading the phishing email, I cover the full chain that keeps an organisation safe.

01 / 06

Microsoft 365 & Identity

Every sign-in is checked before it reaches company data. I design hybrid identity and Microsoft 365 so the right people get in easily and everyone else is stopped at the door.

  • Hybrid Active Directory and Entra ID, kept in sync with Entra Connect
  • Conditional Access and MFA policies built around real risk
  • Intune enrolment, compliance policies and app deployment
  • Exchange hybrid, mailbox migrations and licensing that fits the budget
Entra IDExchangeIntuneEntra Connect
02 / 06

Security Operations

When something gets through, speed matters. I investigate alerts across endpoints, identities and email, contain the threat and explain what happened in plain language.

  • Defender XDR investigations across endpoint, identity and email
  • Phishing, business-email-compromise and device-code attack response
  • Session revocation, device removal and containment
  • Evidence-based incident reports for leadership
Defender XDRMDEMDIMDO
03 / 06

Network & Infrastructure

The network is the foundation everything else runs on. I build and run secure, segmented networks across sites, with cloud servers and backups that are there when you need them.

  • FortiGate firewall policy, SSL VPN and segmentation
  • Aruba CX switching across multiple sites
  • Azure-hosted servers and domain controllers
  • Veeam backup and restore
FortiGateAruba CXAzureVeeam
04 / 06

SharePoint & Power Platform

Paper forms and email chains become simple apps and automated flows. I build intranets and workflows with permissions that are set up correctly from day one.

  • Branded intranets with structured permission groups
  • Lists with item-level security for sensitive records
  • Approval flows and business apps in Power Automate and Power Apps
  • Repeatable, scripted provisioning with PnP PowerShell
SharePointPower AppsPower AutomatePnP
05 / 06

Compliance & Governance

Regulated organisations need security they can prove. I turn regulator requirements into clear controls, run testing engagements and keep the evidence ready.

  • Regulator cyber self-assessments
  • VAPT scoping, procurement and re-test management
  • Cross-border data-transfer rules under data-protection law
  • Documentation and evidence that auditors can follow
RegulatoryVAPTData protection
06 / 06

Security Awareness

Most attacks start with a person, not a server. I help people spot the fake invoice or login page before they click, using training they'll actually remember.

  • Phishing simulation campaigns
  • Organisation-wide training programmes
  • Plain-language advisories after real incidents
  • Short animated scam stories on @ITGuyStories
Attack SimulationTraining
Case studies

Real problems, contained and closed.

Client and organisation details are kept confidential. Each case is described by sector and outcome only.

IncidentProfessional services

Device-code phishing with MFA bypass

OutcomeContained · leadership report and staff advisory
Defender XDREntra ID
Read the full case study
IncidentProfessional services

Payment-diversion email fraud stopped

OutcomeFraud confirmed before payment · evidence pack shared
Exchange OnlineDMARCForensics
Read the full case study
IncidentProfessional services

Multi-wave impersonation campaign

OutcomePurged org-wide · domains blocked
Defender for Office 365
Read the full case study
BuildHealthcare

Staff intranet and workflow apps

OutcomeDelivered · repeatable scripted provisioning
SharePointPower AppsPower AutomatePnP
Read the full case study
CloudSMB · 20 users

Zero-trust cloud workspace

OutcomeArchitecture and delivery plan
M365 E5Windows 365Intune
Read the full case study
CloudSMB

Email platform migration

OutcomeMigrated to Microsoft 365
Exchange OnlineDNS
Read the full case study
BuildProfessional services

Endpoint & identity telemetry rollout

OutcomeEndpoints and DCs reporting to Defender XDR
MDEMDIAzure
Read the full case study
ComplianceRegulated sector

Pen test engagement & cyber self-assessment

OutcomeScope agreed · assessment submitted
VAPTRegulatoryData protection
Read the full case study
Toolbox

The platforms I work with daily.

Identity & Microsoft 365

  • Microsoft Entra ID
  • Active Directory
  • Exchange Online
  • Intune
  • Windows 365
  • SharePoint Online

Security

  • Defender XDR
  • Defender for Endpoint
  • Defender for Identity
  • Defender for Office 365
  • Bitdefender GravityZone
  • DMARC · SPF · DKIM

Network & Infrastructure

  • FortiGate
  • Aruba CX
  • Azure
  • Veeam

Automation

  • PowerShell
  • Power Apps
  • Power Automate
Experience

A decade of keeping UAE businesses online.

  1. IT & Security Lead (in-house)

    Regulated organisation · UAE
    Current
    • Own IT and security end to end for a multi-site organisation
    • Hybrid AD / Entra ID, Exchange hybrid, Intune and licensing strategy
    • Incident response, managed-SOC selection, VAPT and regulatory compliance
    • Organisation-wide security awareness programme
  2. IT Engineer & Administrator

    UAE
    10+ years
    • Infrastructure, networking and end-user support across UAE businesses
    • Microsoft 365 migrations, SharePoint builds and cloud design
Beyond the day job

@ITGuyStories

Short animated stories about the scams that actually hit offices in the UAE and GCC.

A faceless, animated cybersecurity-awareness channel that turns real attack patterns into stories anyone can follow — so the next fake invoice or login page gets spotted.

Watch on YouTube
Contact

Let's talk security.

Questions about Microsoft 365, identity or securing a small team? Send a short note and I'll get back to you.

Dubai, UAE · GST · UTC+4