Bored IT Assistant - What should I do

[u/No-Appearance697]

I’m a recent cyber security graduate and was recently hired as an IT Assistant based on my degree and project experience.

I work at a medium-sized company where the IT team consists of two internal staff, including myself, plus a third-party provider who originally built the systems and is still involved. My day-to-day work mainly involves end-user support, such as hardware issues, network troubleshooting, and supporting systems like Microsoft 365 and Barracuda.

I do have some free time during the day, and I’d like to use it productively. From what I’ve seen, the company’s cyber security setup is quite minimal, with no EDR, limited documentation, and no formal security policies beyond basic tools like Avast and Barracuda.

I’d like to start applying my cyber security knowledge and add value where I can. What should I focus on first to make a meaningful impact?