I turn security signals intodecisive response actions.

Dentons

Threat Analyst

2021 — 2026 · Canada

Support enterprise security operations by developing detection logic, improving investigation workflows, building automation, and connecting security telemetry with business context.

• Built automated phishing and BEC response capabilities, helping maintain zero successful breaches and an estimated $1.5M-$3M+ in avoided exposure.
• Build and tune Splunk detections for authentication, email security, endpoint, firewall, vulnerability, SaaS, and cloud activity.
• Create Splunk SOAR playbooks for enrichment, evidence collection, triage standardization, and incident-response handoff.
• Use threat intelligence, vulnerability findings, and business context to improve prioritization and reporting.
• Define and track operational KPIs, including MTTD, MTTR, MTTC, alert quality, SLA compliance, and coverage.
• Internal Phishing Campaign - KnowBe4.
• Endpoint Security Management.
• Security Training and Documentation.
• Mentor junior analysts and engineers.
• Own incident response processes, leading detection, investigation, and resolution of security events.
• Build a HUB security integrating over API connections different tools.
• Partner cross-functionally with global security, IT, infrastructure, legal, privacy, and business stakeholders.

Calian (Formerly iSecurity)

Security Operation Analyst

2020 — 2021 · Canada

Hands-on SOC and security engineering role supporting enterprise and government clients. Focused on SIEM monitoring, alert triage, detection tuning, customer onboarding, vulnerability and risk analysis, threat hunting, scripting, incident documentation, and technical support across endpoint, network, cloud-adjacent, and third-party security technologies.

• Investigated and triaged multi-tenant security alerts across SIEM, endpoint, network, firewall, cloud, and third-party security platforms.
• Developed Bash and PowerShell scripts for log enrichment, evidence collection, repetitive triage tasks, and client onboarding workflows.
• Participated in on-call rotations and handled time-sensitive incidents with minimal supervision, supporting continuity for enterprise and public-sector customers.
• Collaborated with senior engineers, network teams, and client stakeholders to improve detection coverage, incident handoffs, and security posture across managed environments.
• Performed threat hunting using threat intelligence, hypotheses, SIEM telemetry, endpoint indicators, and behavioural analysis to identify suspicious activity and potential abuse.
• Documented incidents, playbooks, lessons learned, and operational procedures to increase SOC consistency and support training for new analysts.
• Contributed to containerized SOC stack deployment using K8s/Docker, Rancher, Elasticsearch, OpenSearch, and ELK components to improve scalability and ingestion flexibility.
• Designed, tuned, and maintained detection rules and threat-hunting dashboards to improve signal quality, reduce false positives, and increase analyst efficiency

Technology and Information Centre for Brazilian Navy - Brazilian Navy

Cybersecurity Lead

2015 — 2020 · Brazil

Supported infrastructure security, Linux services, vulnerability assessment, log management, collaboration platforms, and operational communications. Operated in lean, high-pressure environments requiring disciplined ownership, executive communication, and resilient security operations.

• Led cyber incident response and security operations across critical defence infrastructure, coordinating investigations from detection through containment, mitigation, stakeholder reporting, and post-incident analysis.
• Built and maintained centralized SIEM and log management capabilities using ELK and Graylog to support large-scale monitoring, investigations, dashboards, and response readiness.
• Partnered in Red Team and offensive simulation exercises to identify control gaps, validate defensive posture, and strengthen system, network, endpoint, and application resilience.
• Directed vulnerability assessment and remediation programs across more than 80,000 assets.
• Coordinated cyber defence readiness for high-profile global events, including World Youth Day, FIFA World Cup, and Olympic Games, maintaining zero successful compromises.
• Managed and mentored junior cyber engineers and analysts through technical reviews, training, task delegation, and operational coaching during high-stress events.
• Presented risk, incident status, and security recommendations to national and regional leadership, translating complex technical issues into clear operational and business impact.
• Guided identity and access management research and control improvements related to SSO, verification procedures, privilege lifecycle, access documentation, and least-privilege practices.

Technology and Information Centre for Brazilian Navy - Brazilian Navy

Cybersecurity Analyst

2012 — 2015 · Brazil

Improved information security management with skills in a diverse range of security technologies inside Data Center environemnt. Diagnosed daily ticket reports to identify and proactively resolve problems in SLA/SLO time.

• Developed and supported security solutions that reduced costs and enhanced overall security.
• Created security documentation including security assessment reports, system security plans, and contingency plans.
• Innovated event alerts, reports, and user behavior monitoring (UEBA) as a MDR provider, leading to improved incident response times.
• Automated routine tasks using PowerShell and Bash scripting.
• Implemented File Integrity Monitoring in conjunction with Host Intrusion Prevention Systems (HIPS) and Log Management.
• Analyzed suspicious incidents by examining Indicator of Compromise (IOC) data to identify potential security breaches.
• Conducted research on Identity and Access Management (IAM) to support the adoption of new technologies, including Single Sign-On, development of verification procedures, privilege management, lifecycle management, and documentation control.