Information Security Leader, Architect, and Researcher with 20+ years of experience, with a strong focus on Application Security, Product Security, and AI/Agent Security. I build pragmatic security programs, assessments, and frameworks aligned to risk, governance, and engineering velocity. Hands-on across manual and automated security testing, Pentesting, DevSecOps, SAST, DAST, SCA, and the occasional bug bounty (once a year, in free time 😄).
🏆 Ex-DELL, Ex-U.S. Bank, Ex-EDS (HP), Ex-Avaya, Ex-Volkswagen Digital Solutions (MAN Trucks and Buses). Currently Director of Information Security at Reltio, leading Product Security, AppSec, and AI/Agent Security for a B2B SaaS data unification and context intelligence platform (now joining the SAP family).
🎤 Speaker at OWASP Lisbon on AI agent security ("Hack Your Agents Before They Hack You"). 🔨 APIDetector presented at BlackHat Arsenal 2024.
Projects I've built and maintain:
- 🔐🤖 Awesome AI Security — A curated list of AI/LLM security tools, frameworks, guides, papers, and training, focused on open-source and community resources.
- 🛰️ APIDetector — Fast scanner for exposed Swagger / OpenAPI endpoints across web domains and subdomains. Presented at BlackHat Arsenal 2024.
- 🧪 Awesome Pentest Tools in Colab — A curated set of Penetration Testing and DevSecOps tools ported to Google Colab, so you can try, run, and test them in seconds without local setup.
- 💉 Payloads — Curated payloads for Prompt Injection, XSS, SQL Injection, and other classic and AI-era attack classes.
- 🧬 Nuclei Templates — My personal collection of Nuclei templates for vulnerability detection.
AI / LLM / Agent Security · Application Security · Product Security · Penetration Testing · DevSecOps · SAST / DAST / SCA · Cloud Security (AWS, Azure, GCP) · Threat Modeling · Secure SDLC
Bhack 2021: Hackeando suas próprias aplicações -- Como utilizar técnicas de Bug Bounty em seu DevSecOps (https://www.youtube.com/watch?v=1dmZaQ52KIw)
DEFCON Red Team Village: Mayhem 2021 Portuguese Track: Segurança de Aplicações: Aprendendo com os erros (dos outros) (https://www.youtube.com/watch?v=CDaJ8gmLUrM)
IFPRFOZ: Segurança de Aplicações (o que você precisa saber) (https://www.youtube.com/watch?v=9TNNiO5IMHQ)
[SAST] [DAST] [DevSecOps] [Pentesting]
Discovered and reported several vulnerabilities in projects like Spotify, Symantec, Defense Industrial Base Vulnerability Disclosure Program (DIB-VDP) and Adobe.