Information security specialist with a system administration background. 5 years at a hosting company: I went from first-line support to security specialist and built the company's security program from scratch — from an Active Directory domain hardened by CIS Benchmark to an in-house SOC on Wazuh.
I've been into security since school. I know infrastructure from the inside, so I understand both how attacks work and how to defend against them. In my spare time I do bug bounty, solve CTFs and build my own security tools. I love Linux, free software, hard problems and automating everything that can be automated.
Built the company's information security from scratch: from the office network to an in-house SOC.
Computer engineering and software, specialization: systems engineer.
Self-hosted platform for security audits and bug bounty: perimeter recon, an intercepting proxy, scanning and vulnerability tracking, reports and continuous monitoring. An AI assistant built on 120+ in-house testing playbooks.
Collects software inventory and vulnerabilities from servers, enriches them with CVSS, EPSS, CISA KEV and exploit data, and filters out false positives caused by vendor backports. Work orders, reports and a read-only AI assistant.
Demo on request
Exports vulnerabilities from Wazuh (Elasticsearch/OpenSearch) to DefectDojo via the Generic Findings Import API. Supports rescans and cron runs.
GitHub →
Installs and runs a curated toolset to map the attack surface of websites, portals and organizations.
GitHub →
A collection of Nuclei templates and wordlists for bug bounty and security testing. Used in reconWTF.
GitHub →
Reverse domain lookup by A records for AS/ASN/CIDR/IP lists: finds domains and servers tied to an autonomous system or range.
GitHub →
An assistant for hosting sysadmins and support staff to quickly assess a domain, its DNS and web server.
GitHub →
This website: resume, portfolio and blog built with Hugo and deployed automatically via GitHub Actions.
GitHub →A fault-tolerant SIEM cluster for 300+ agents, HAProxy load balancing, agent groups, securing the SOC itself and lessons from running it.
Read the case →Building a domain from scratch and hardening workstations: CIS Level 1 group policies, LAPS, AppLocker, BitLocker and regular audits.
Read the case →A week of hidden access to corporate mailboxes, silent forwarding via Sieve and groundwork for BEC fraud: a log-based timeline and lessons learned.
Read the case →Millions of alerts a day, three rules producing 90% of them. How to turn a firehose into an incident queue.
Read the case →A site crashed every time an editor saved a post. Tracing nginx → Apache → MySQL, table locks, and queries cut from 82 seconds to 13 ms.
Read the case →