Cybersecurity specialist — Available for work
Blue Team analyst with a Red Team foundation and operational threat intelligence. Behind every alert there is someone trusting that their money, their data and their work are still where they left them. Defending that is what I do.
I correlate SIEM alerts, system and network logs, forensic findings, IOCs pulled from threat hunting and cyber intelligence context. Crossing those sources is what turns a lone alert into an investigation with a name, a scope and a response that holds up.
Additional training, with verification where available.
Where I have worked and where I have trained, kept apart.
Professional experience
Kyndryl
Administration of infrastructure spread across three cloud providers.
Hands-on practice
LetsDefend · Top 3 in Spain
View profileSimulated real-world cases end to end, from alert to report.
Hack The Box · Professional rank
View profileReal vulnerable machines, compromised end to end. Understanding the attack is what makes defending it possible.
Where the foundations come from.
Campus Internacional de Ciberseguridad · UCAM
Threat intelligence, APT group analysis and operational cyber intelligence. Final thesis on the modelling and characterisation of the Lazarus group.
IES Zaidín Vergeles
Systems, networking and virtualisation: the foundation everything that came later in security rests on.
Alerts closed, investigations opened and machines compromised in the lab. What has actually been done, counted rather than described.
A sample of what I have been working on.
Published book on the attack-defence cycle in cybersecurity, with hands-on simulations of both sides.
Full study of the Lazarus APT group: motivations, capabilities, infrastructure and behavioural patterns.
Web tool that analyses suspicious emails and explains, step by step, why they are suspicious.
How I work
I use these tools at an advanced level, as an accelerator rather than a replacement for judgement. And so that privacy is not lost along the way, anything sensitive stays in house: I run local models with Ollama, one per task, so no data from an analysis ever leaves my machine.
ChatGPT