Threat Hunter
& Detection Engineer

Independent development of a technical portfolio focused on Threat Hunting, Detection Engineering, SOC Operations, and DFIR, with an emphasis on reproducible investigations, log analysis, structured documentation, and practical security labs.

• • Development of Threat Hunting hypotheses using MITRE ATT&CK and Cyber Kill Chain.
• • Construction of labs with Elastic Security, Elasticsearch, Kibana, Filebeat, Docker, Docker Compose, and WSL.
• • Documentation of KQL queries, log analysis, technical evidence, IoCs, observable artifacts, and reproducible procedures.
• • Continuous DFIR practice and endpoint analysis with Velociraptor, Sysmon, Wireshark, and Windows/Linux artifacts.

Participation in incident response operations across multicloud environments, including Azure, AWS, and OCI, with activities involving detection, triage, investigation, escalation, mitigation, and operational documentation.

• • Cloud incident management, advanced triage, event analysis, operational escalation, and technical documentation.
• • Investigation and correlation of events using Microsoft Sentinel, KQL, Microsoft Defender, Defender for Cloud, AWS GuardDuty, AWS Detective, and AWS CloudTrail.
• • Analysis of IoCs, anomalous behaviors, attack patterns, cloud events, and security findings.
• • Operational validation and tuning of alerts to reduce false positives and improve SOC / Cloud Security workflows.
• • Coordinated work with Security, IaaS, Development, Networking, IAM, and Architecture teams.

Initial and later complementary role focused on Secure SDLC, application security testing, vulnerability analysis, and Linux hardening, with occasional participation in AppSec and pentesting projects.

• • Execution of security testing on applications and services using OWASP ZAP, Burp Suite, and Nessus.
• • Identification, validation, and documentation of vulnerabilities aligned with the OWASP Top Ten and Secure SDLC best practices.
• • Support in hardening analysis and review of security configurations on Linux systems.
• • Preparation of technical and executive reports to communicate findings, risks, impact, and remediation recommendations.

Participation in a training program focused on developing technical skills in DevSecOps, Cloud Security, automation, secure operations, and collaborative work in technology environments.

• • Practical training in DevSecOps fundamentals, Cloud Security, automation, and secure operations.
• • Development of initial automations with Bash and Python.
• • Introduction to technical documentation, continuous improvement, change control, and collaboration with technical teams.
• • Strengthening of technical foundations in Linux, scripting, applied security, and workflows oriented toward technology services.