Implemented policy-based segmentation and gateway security to reduce lateral movement and enforce least-privilege access across services.

• Built and tuned rulesets, NAT, IPS, and VPN for branch/campus connectivity.
• Hygiene: change windows, staged rollouts, backup/restore, config baselines.
• Monitoring: alerting thresholds, incident playbooks, periodic reviews.