(don't ask about the goat)
Two years inside one of Europe’s largest cybersecurity operations, promoted twice in under two. Collection tuned for enterprise organizations across Europe, USA and LATAM, and a dedicated intelligence project embedded with a Tier-1 global bank
Intelligence is only worth what the stakeholder can do with it. I define collection around each stakeholder’s PIRs and deliver products that end in a decision.
Daily, weekly and monthly threat and vulnerability reporting for both defenders and executives. Structured Analytic Techniques keep facts and analytical judgement clearly separated.
PIRs · Executive reporting · SATs · Vulnerability intel
Collection across open, deep and dark sources: Tor forums, paste sites, marketplaces and social platforms - with source evaluation and grading applied to everything that ships.
OSINT · SOCMINT · Tor collection · Source grading
Detection of phishing, fraud campaigns, brand abuse and credential exposure. End-to-end takedown coordination with registrars, ISPs and platforms.
Brand abuse · Credential exposure · Takedowns · Advisories
Custom Python tooling for collection, keyword alerting and structured reporting pipelines, cutting manual effort and shortening the path from signal to stakeholder.
Python · Git · Linux · LLM-assisted analysis
If it does not end in a decision, it was just news.
Experience
One of Europe’s largest cybersecurity operations. Promoted twice in under two years.
Feb 2026 - Present
Digital Risk Protection
Intelligence point of contact for enterprise organizations: elicit requirements and PIRs, tune collection to their threat landscape, advise on how to act on what is delivered.
Produce tailored daily, weekly and monthly threat and vulnerability reports for defenders and executive stakeholders.
Own service operations: onboard new intelligence modules and proactively detect, escalate and close capability gaps in the platform.
Jan 2025 - Jan 2026
Enterprise client portfolio
Ran OSINT and dark-web collection across open, deep and dark sources to detect phishing, fraud campaigns, brand abuse and credential exposure.
Administered TIP and monitoring platforms; built custom Python tooling to automate collection, keyword alerting and structured reporting.
Coordinated domain and social-media takedowns end-to-end with registrars, ISPs and platforms.
May 2024 - Dec 2024
Dedicated CTI project · Tier-1 global bank
Embedded analyst supporting the bank’s SOC and threat-hunting workflows: triaged IPs, hashes, domains and CVEs, mapping adversary TTPs to MITRE ATT&CK.
Delivered daily threat bulletins and situational-awareness reporting on financial-sector threats to client security stakeholders.
Applied Structured Analytic Techniques across all intelligence products.
OpenCTI MITRE ATT&CK OSINT Cybersixgill Python PIRs & requirements Dark-web monitoring Diamond Model SOCMINT Cyber Kill Chain TIP administration Structured Analytic Techniques Tor forums & paste sites Source evaluation & grading Executive reporting Vulnerability reporting Threat-hunting use cases SIEM / ticketing Talkwalker Git Linux LLM-assisted analysis Prompt engineering Spanish (native) English (full professional)
Graphic design and front-end are the other half of how I think. Same instinct as intelligence work: strip it down until only the signal is left.
Type-led layouts, monochrome palettes, editorial composition. The kind of design that gets out of the way of the message.
Fast, animated, hand-built sites. Static-first architecture, real accessibility, and motion that has a reason to exist, like this page.
Hardened headers, no third-party tracking, minimal attack surface. Knowing how sites get abused is a design constraint, not an afterthought.
Falcon Intelligence Specialist
CrowdStrike University · 2026
Introduction to SecOps
Palo Alto Networks · 2026
Six further cybersecurity certifications
Available on request
Cursus, Computer Programming
42 Málaga · 2023-2025
Game Development (Programming)
American University of Malta · 2022-2023
Contact
Open to CTI roles. Based in Málaga, working remote across the EU.
contact@phi618.cloud