Trym Håkansson

Lead, Security Operations @ Crayon

Moss, Viken, Norway

Download CV (PDF)

Contact

Summary

Lead of Security Operations at Crayon, where I launched and scaled an MDR service from scratch: multi-tenant infrastructure, KQL detections, threat hunts, incident response.

Work spans Microsoft Sentinel, Defender XDR, Azure and M365 Lighthouse. Two years of cloud security consulting before that, mostly forensic investigations and identity security deployments.

Certifications

  • Microsoft Certified: Security Operations Analyst Associate
  • Microsoft Certified: Azure Fundamentals
  • NSM ICT Security Principles (Norwegian National Security Authority)
  • Vocational Certificate in ICT Services

Highlighted skills

  • Product Development
  • MDR
  • Strategic Leadership
  • Microsoft Sentinel
  • Defender XDR
  • KQL
  • Incident Response
  • Threat Hunting
  • Azure Security

Experience

Lead, Security Operations — Crayon

September 2025 – Present (Moss, Norway)

  • Launched Crayon's MDR service from zero. Built the offering, onboarded customers, scaled operations.
  • Designed multi-tenant security infrastructure across Azure and M365 Lighthouse.
  • Led incident response for enterprise clients, coordinating SOC and IT teams during active threats.

Security Engineer — Crayon

March 2025 – September 2025 (Norway)

  • Ran incident response and threat hunts across Microsoft Sentinel, Defender XDR, and Defender for Identity in hybrid environments.
  • Wrote KQL hunting queries for forensic analysis. Identified and contained advanced threats across customer tenants.
  • Built detection automation that cut response time and reduced false positives.

Cloud Security Consultant — Crayon

October 2023 – March 2025 (Grålum)

  • Handled incident response using Defender XDR and Microsoft Sentinel to contain active threats.
  • Built KQL detection queries that reduced false positive rates across customer environments.
  • Ran forensic investigations with Microsoft Purview and delivered reports that stakeholders actually acted on.
  • Deployed phishing-resistant MFA and automated IAM policies with Terraform.

Support Consultant — Crayon

October 2022 – September 2023 (Grålum)

  • Technical support and troubleshooting for Microsoft 365 and Azure environments.
  • Improved issue handling processes and built internal knowledge documentation.
  • Worked with senior engineers to resolve complex escalations faster.

IT Consultant — Byggfakta Group

January 2022 – October 2022 (Moss kommune, Viken, Norway)

  • Supported and maintained IT hardware/software for internal and external users.
  • Improved documentation and case escalation processes.
  • Focused on getting solutions right the first time and keeping users unblocked.

IT Consultant — Viken fylkeskommune

July 2021 – January 2022 (Sarpsborg kommune, Østfold, Norway)

  • Operated, troubleshooted, and supported school and office IT environments.
  • Implemented AV solutions and configured networks for educational purposes.

Information Technology Trainee — Østfold fylkeskommune

August 2017 – August 2019 (Moss kommune, Østfold, Norway)

  • First-line IT support and operations at Malakoff High School.
  • Two years of first-line IT support across a large high school. Learned how IT operations work at scale.

Education

Østfold University College — Information Technology (2020–2021)