Jamie Mamroe

• Leverages 7 years of cybersecurity experience

• Specializes in Microsoft 365, Exchange Online, Entra ID, and Google Workspace incident response and digital forensics
• Leads and supports investigations involving business email compromise (BEC), cloud account compromise, ransomware, and insider threats 
• Frequent speaker and thought leader on identity-focused attacks, Microsoft 365 security, and emerging incident response trends

Jamie Mamroe is an Incident Responder at LevelBlue. Jamie leverages more than seven years of experience in digital forensics and incident response, specializing in Microsoft 365 forensics, identity-based attacks, and cloud-centric investigations. At LevelBlue, she advises organizations across a wide range of industries on responding to complex cyber incidents, including business email compromise (BEC), cloud account compromise, ransomware, and insider threats. Jamie serves as a subject matter expert in Microsoft 365 forensics, with extensive experience investigating incidents involving Microsoft 365, Exchange Online, Entra ID, Google Workspace, and other cloud collaboration platforms. She specializes in analyzing authentication activity, email compromise, OAuth abuse, and modern identity attack techniques, helping organizations understand how attackers exploit trusted cloud services while developing effective response and remediation strategies.

In her role at LevelBlue, Mamroe serves as an Incident Responder within the Digital Forensics and Incident Response (DFIR) practice, supporting organizations across a wide range of industries as they respond to cyber incidents. She leads and supports investigations involving BEC, cloud account compromise, ransomware, insider threats, and other complex security events, helping clients determine the scope of compromise, identify attacker activity, and develop effective containment and remediation strategies. Her work frequently involves analyzing Microsoft 365, Exchange Online, Entra ID, and Google Workspace environments to reconstruct attacker activity and assess the impact of identity-based attacks.

Mamroe has particular expertise in Microsoft 365 forensics, cloud identity investigations, and email security. She specializes in analyzing authentication activity, mailbox access, OAuth applications, enterprise applications, and cloud audit logs to identify attacker tactics, techniques, and procedures (TTPs). She regularly collaborates with legal counsel, cyber insurance carriers, and executive stakeholders to deliver clear technical findings and actionable recommendations that enable organizations to recover quickly and strengthen their security posture.

Prior to LevelBlue, Jamie served as Incident Responder at Cybereason before it was acquired by LevelBlue in November 2025.

Before this, Jamie was a Senior Vice President at Kroll, a risk and financial advisory firm. During that time, she led and supported hundreds of digital forensics and incident response engagements for organizations across the financial services, healthcare, manufacturing, legal, technology, and public sectors, specializing in Microsoft 365, Exchange, cloud identity, and email security investigations.

Earlier in her career, Jamie served as a Crime Analyst supporting regional law enforcement investigations, where she analyzed intelligence, criminal trends, and investigative data to assist law enforcement agencies. She also worked as a 911 dispatcher and dispatch trainer, developing the ability to remain calm under pressure while coordinating emergency response during high-stress situations.

Jamie holds a Bachelor of Science in Cybersecurity with a concentration in Network Forensics and Intrusion Investigations from Utica University and an Associate of Science in Criminal Justice from Finger Lakes Community College. She graduated summa cum laude from Utica University and was recognized with the New York State Sheriffs' Association Institute Award while attending Finger Lakes Community College. Jamie holds the GIAC Certified Forensic Examiner (GCFE) and GIAC Certified Forensic Analyst (GCFA) certifications.

Professional Associations

• Women in CyberSecurity (WiCyS) – Member
• International Women's Cyber Alliance (IWCA) – Member and speaker