I'm an Application Security Engineer with a Master's degree in Computer Science from PUC-RS. My work sits at the intersection of offensive security and engineering — building automation to reduce real-world risk by thinking the way an attacker does.
I work in the financial sector, where I develop open-source tooling for Kubernetes security assessments, run Purple Team exercises, and conduct penetration testing across web applications and compiled deliverables.
Outside of work, I train on Hack The Box and Wiz Cloud Security Challenges. Currently focused on exploit development, working toward OSED and OSEE.
My primary interests are application security, cloud-native attack surfaces, and the Kubernetes threat landscape — areas where I have contributed publicly available tooling adopted by security teams.
Kubernetes Breach Assessment Tool — evaluates the blast radius of a compromised pod. Maps privilege escalation paths and lateral movement opportunities from an attacker's perspective.
Kubernetes Authorization Listing — enumerates all RBAC permissions within a cluster. Surfaces over-privileged service accounts and exploitable misconfigurations quickly and without noise.
Open to collaboration, security research discussions, and responsible disclosure coordination.
Working on something in the Kubernetes, cloud-native security, or offensive tooling space? I'm interested.