Assistance in cyber-security incidents (e.g., phishing, spear phishing, DDoS, compromised users, malware, social engineer, credential harvesting), focused on Azure environments, which include the following tools and technologies:

• Sentinel
• Microsoft Cloud App Security
• Azure Advanced Threat Protection
• O365 environment (data loss prevention, filters, phishing campaigns, safe attachments)
• Identity Management/Protection
• Security Center
• Web Application Firewall
• Security Scores
• Playbooks

Legendary support for on-premises customers around the world who rely on the Atlassian Suite platform. Besides working on support cases, creating how-to documentation, and assisting our global team upon removing technical roadblocks, my day to day also included:

• Creation and curation of training according to our needs
• Go-to person for analyzing pentest reports and security issues brought by our customers
• Case reviewing support cases, aiming for the development of several abilities (e.g., soft skills, troubleshooting, empathy, sense of urgency) on what we’re looking for as legendary support
• Coaching engineers when noticing opportunities for improvement such as management of time/backlog
• Investigation of performance issues, including GC logs, thread dumps, and heap dumps

Responsible to manage our customers’ infrastructure, focused on Unix environments (AIX, HP-UX, Linux), and also implementing Nagios as a monitoring solution.

Azure risk detection events handler, parsing data to a SIEM solution, hence providing awareness of different event types (e.g., leaked credentials, atypical travel, anonymous proxy), allowing security teams to work on them in a timely manner.

Integration established via app role authentication over HashiCorp Vault and Azure App with permissions to Microsoft Graph (IdentityRiskEvent.Read.All and IdentityRiskyUser.Read.All) so that events can be fetched accordingly.

Check it here

Awareness to SOC/Blue teams regarding shadow IT projects indexed by Google and sensitive information/files that should not be public available with integration to SIEM solutions via syslog.

Check it here

Rest API integration with Microsoft Cloud App Security, abuseipdb, and Jira, so that cyber security events can be tracked efficiently

Check it here

Parse of Jira and Tomcat logs, isolating possible bottlenecks for the on-premises environment. Also uses regex to filter for full GCs and slow JQL.

Demo Session

Documentation and remediation for template injection

• Security Advisory
• Evidence
• Remediation

Remediation upon blocking particular HTTP method

• Remediation

Given the configuration settings of “pingback” within WP, you may enumerate internal services and servers in the same network than the target, assuming the mentioned module is vulnerable.

Check it here

Security Project focused on red team activities to use google dorks (e.g., site:mysite.com), and test error-based SQL injection with GET HTTP requests behind web proxy through Google.

Check it here