I correlate SIEM alerts, system and network logs, forensic findings, IOCs pulled from threat hunting and cyber intelligence context. Crossing those sources is what turns a lone alert into an investigation with a name, a scope and a response that holds up.

200 days: the global average time to detect a security breach.

I am Dario González Blanco, a cybersecurity specialist and systems administrator. I came to security after falling for a phishing attack in 2022, and since then I have worked so it does not happen to anyone else: from a systems and networking foundation to a master's in cyber intelligence.

Curious how I got here?

Read my story
Portrait of Dario
As a kid, holding a phone
Holding the book Las dos caras de la Moneda
ASIR graduation
With my classmates
Hiking with friends by a river
Out on the street on a summer day
With my family by a reservoir
Lifting a Pump It Up trophy
At the IES Zaidín Vergeles graduation
Holding the Cambridge Certificate of Proficiency in English
At the gym
Close-up portrait
Cover of “Las dos caras de la Moneda”
Having lunch with my family
With my family in the countryside by a reservoir
Wearing my IT graduation stole
Out for a walk in the city
Walking in the countryside
Behind the wheel of a convertible
With my family at sunset
Holding trophies at a Pump It Up tournament
Selfie on graduation day
At a talk with students

Additional training, with verification where available.

All certifications
  • CompTIA

    CompTIA Security+ (SY0-701)

  • Security Blue Team

    Blue Team Level 1 (BTL1)

  • INE Security

    eJPT — Junior Penetration Tester

  • Cambridge Assessment English

    Certificate of Proficiency in English (CPE) — Level C2

Swipe to browse · tap to open one

Where I have worked and where I have trained, kept apart.

See the full experience

Professional experience

  1. Kyndryl

    MultiCloud Administrator

    Administration of infrastructure spread across three cloud providers.

Hands-on practice

  1. LetsDefend

    Security operations

    Simulated real-world cases end to end, from alert to report.

  2. Hack The Box

    Offensive security

    Real vulnerable machines, compromised end to end.

Where the foundations come from.

See the full education
  1. Campus Internacional de Ciberseguridad · UCAMCampus Internacional de Ciberseguridad · UCAM

    Master's in Cyber Intelligence

    Threat intelligence and APT group analysis.

  2. IES Zaidín Vergeles

    Higher Diploma in Network Systems Administration

    Systems, network and virtualisation administration.

Alerts closed, investigations opened and machines compromised in the lab. What has actually been done, counted rather than described.

  • +100

    SIEM alerts triaged

  • +30

    Threat hunting investigations

  • +50

    Machines compromised

  • +5

    Years studying the field

A sample of what I have been working on.

All projects
  • Las dos caras de la Moneda

    ASIR final project · 2025

    Las dos caras de la Moneda

    Published book on the attack-defence cycle in cybersecurity, with hands-on simulations of both sides.

  • Lazarus modelling and characterisation

    Master's thesis · 2026

    Lazarus modelling and characterisation

    Full study of the Lazarus APT group: motivations, capabilities, infrastructure and behavioural patterns.

The tool, running

Design and development · 2026

Phishinspect

Web tool that analyses suspicious emails and explains, step by step, why they are suspicious.

View project

How I work

I use these tools at an advanced level, as an accelerator rather than a replacement for judgement. And so that privacy is not lost along the way, anything sensitive stays in house: I run local models with Ollama, one per task, so no data from an analysis ever leaves my machine.