My goal is to grow in SOC, DFIR and security engineering.
Build, secure, defend.
Almost everything I do revolves around those three verbs. My background is in cloud deployment and systems administration, so I first learned to build infrastructure (microservice architectures on AWS and Azure, databases, caching, orchestration with Kubernetes) and to automate it with CI/CD pipelines on GitHub and GitLab.
Specialising in cybersecurity took that practice towards a DevSecOps approach: embedding controls into the development cycle itself, with code analysis, dependency scanning and container review before anything reaches production.
Then I learned to defend what I had built.
I have built complete Blue Team environments: SIEM with Wazuh and its detection rules, response automation through SOAR, OPNsense firewalls, EDR and VPN, plus honeypots exposed to the internet. Coming from systems administration gives me an edge here: once you know what a healthy machine looks like, you spot what falls outside the norm much sooner.
But what really hooks me is what happens after the attack.
My honeypot takes real intrusion attempts every day, and each one leaves a trail to reconstruct: where it got in, which commands it ran, what it downloaded and how far it went. For that I rely on memory analysis and the MITRE ATT&CK framework, which lets me classify every move by known tactics and techniques.
And what comes out of it doesn't stay in the lab: I report the attacking IP addresses and upload the malware samples to public threat intelligence platforms, including several binaries no antivirus engine had recorded before.
In fact...
Let's talk achievements and numbers:
Figures gathered from my own honeypots and labs, current as of August 2026. Happy to go into detail on any of these contributions if it is of interest.
This is Dirtylands, a Cowrie + Dionaea project whose value proposition is fast deployment. It offers working commands, a realistic environment, rigour and project maturity. It is also fully able to report every event via Telegram and the malicious activity to the respective platforms, and provides observability.
Translated into 5 languages: Spanish, French, English, German and Bulgarian.
Forensic report on the "Sysinternals" lab from CyberDefenders.org. An .E01 image examined with Autopsy and Registry Explorer, an HTTP download impersonating Microsoft, execution as SYSTEM, the SHA-1 recovered from Amcache, the Rozena trojan, C2 and service persistence. Includes chain of custody and forensic conclusions.
Forensic report on a network traffic capture (.PCAP) from a host infected with Lumma Stealer. Analysed in Wireshark, the host identified through DHCP and Kerberos, HTTP beaconing to the C2, exfiltration of compressed credentials and five malicious domains verified on VirusTotal. Includes IoCs and chain of custody.
Forensic report on a RAM dump (.dmp) from a host compromised by StrelaStealer. Examined with Volatility 3: orphan processes, a Living off the Land chain through PowerShell, the fileless loading of a DLL over WebDAV, the connection to the C2 and code injection into Thunderbird to steal credentials.
Lab 1: IAM lab built with Keycloak on Docker and WSL. OAuth 2.0 and OpenID Connect flows, the anatomy of the three tokens, PKCE, introspection, rotation and revocation. It also includes errors triggered on purpose, along with the server's real response.
Lab 2: FastAPI resource server that validates the JWTs issued by Keycloak against its JWKS, checking signature, issuer, audience, expiry and roles. It includes six kinds of failure triggered on purpose, along with the API's real response.
Lab 3: Active Directory federation in Keycloak over LDAPS. The domain controller runs on Hyper-V and Keycloak on Docker inside WSL2. Users who only exist in AD sign in with OIDC, and their attributes and groups reach the token. Includes mappers, lifecycle and orphaned accounts.
Honeypot deployed on Azure with dynamic port knocking via iptables and real-time Telegram alerts.
Full DevSecOps pipeline on GitLab CI/CD, integrating SonarQube, GitLeaks, Snyk, and OWASP ZAP for end-to-end code quality and security scanning. Automated real-time pipeline status notifications are sent via Discord.
Lift & shift migration of a locally built multi-tier Java web app to AWS (IaaS). Tomcat app servers behind an Elastic Load Balancer with Auto Scaling, MariaDB, Memcached and RabbitMQ as backing services, private DNS on Route 53, artifacts deployed from S3 and access scoped with IAM.
A managed Kubernetes cluster deployed on AWS with EKS, starting from a brand-new account. It covers hardening access with IAM users and MFA, a CloudWatch billing alarm, the VPC and its public subnets, the node group with the roles it needs, and the real errors that turned up along the way.
A project where I work through the basics of Ansible, completing every module of the Udemy course. On top of that I had to face the scenario where the .pem keys of my EC2 machine are lost, and I try to solve it.
This GitHub project is part of the 'DevOps Beginners to Advanced' course on Udemy. The project involves using Vagrant, Nginx, Tomcat, RabbitMQ, Memcached, and MySQL to build a website.
This project demonstrates the creation of a CI/CD pipeline using AWS services to manage, build, and deploy a web application on AWS Elastic Beanstalk, integrating AWS CodePipeline, AWS CodeBuild, and connectivity with an AWS RDS database. Additionally, Bitbucket is used as the git repository for the source code.
This GitHub project is part of the "DevOps Beginners to Advanced" course on Udemy. Our previous AWS project deployed a multi-tier webapp with Memcached, MySQL, Tomcat, RabbitMQ and a load balancer. Now we are rebuilding it all with AWS services such as ElastiCache, Amazon MQ, RDS and Beanstalk.
