Work01
2022 — now
Corvalis Bank — Lead Security Engineer
Built the in-house penetration testing programme and a detection pipeline for cloud workloads.
- Mean time to detect down from 3 days to 4 hours.
2019 — 2022
Northgate Security — Penetration Tester
Led web, API and cloud assessments for fintech and health clients, from scoping to retest.
2017 — 2019
Telvia — SOC Analyst
Triage, investigation and playbooks for a 24/7 security operations centre.
Selected work02
cloudlint
A scanner that flags risky IAM policies in pull requests, before they reach production.
Go, AWS
Logging that catches attackers
Conference talk on useful detections for small teams.
Skills03
- Offensive
- Web and API penetration testingCloud configuration reviewThreat modelling
- Defensive
- Detection engineeringSIEM tuningIncident response
- Governance
- ISO 27001 readinessSecure development lifecycle
Education04
2015 — 2017
Atlantico Institute of Technology — MSc, Information Security
Also05
- Certifications
- GIAC Certified Incident Handler (GCIH) GIAC, 2024Certified Information Systems Security Professional (CISSP) ISC2, 2021Offensive Security Certified Professional OffSec
- Languages
- English fluentPortuguese native