About me
Cybersecurity specialist · Cantabria
I am a cybersecurity specialist at Fonestar, an industrial company in Cantabria, Spain, so I look after the security of an SME from the inside: together with the IT team I handle vulnerabilities, system hardening, internal policies and staff training.
I got hooked as a kid on the hacking magazines my father used to buy me, and before working in cybersecurity I spent years fixing computers and supporting individuals and small businesses. That stage is the one I use most now, because before you defend an infrastructure you need to know where it breaks.
Between 2024 and 2026 I trained in cybersecurity while working, and in 2026 I joined the Cantabria Tech Talent programme, where I was one of 68 selected out of 765 candidates. The programme took me to Fonestar as an intern, and the internship turned into a contract. At the opening event I was one of the two first-cohort students invited to the panel discussion.
For my master's final project I built my own lab, five machines across four network segments, instead of using a ready-made one. That is where the rule I have worked by ever since comes from: no control counts as working until you have triggered the failure it claims to prevent, because security tools claim plenty of things they have never checked.
With that idea I build my own tools by directing AI agents. I am currently developing Argos, a platform that brings together in one place what an SME needs to put its security in order: inventory, vulnerabilities, compliance, backups, training and much more. Talos came out of it, a small open-source tool that audits how a Linux or Windows server is hardened with 147 checks in under ten seconds.
I also believe education is the cheapest security barrier there is, so since February 2026 I have been an INCIBE cyber-volunteer, giving awareness workshops in schools in Cantabria, some for pupils and some for adults.
Career
Certifications
eJPTv2
INE SecurityJunior penetration testing certification, entirely hands-on. The exam is a black-box lab: you have to map the network, enumerate services, exploit web and system vulnerabilities, and move laterally until the targets are compromised. There are no multiple-choice questions.
August 2025Verify
Courses and credentials
- AWS Academy Graduate, Cloud FoundationsAWS AcademyMarch 2026
- Agentic Workflow, pentesting con IANetSentinelFebruary 2026
- Networking Devices and Initial ConfigurationCisco Networking AcademyOctober 2025
- Conceptos básicos de redesCisco Networking AcademyJuly 2025
- Introducción a la ciberseguridadCisco Networking AcademyJuly 2025
- Introducción a Packet TracerCisco Networking AcademyNovember 2024
- Programa PrometeoThePower EducationSeptember 2024
What I work with
Security, by NIST CSF 2.0 function
- gobernarGovern
- Phased security master plan, following the INCIBE guide and aligned with NIST CSF 2.0
- Spain's National Security Framework (ENS): categorisation and statement of applicability
- Tracing every action to the non-conformity it resolves
- Risk analysis and management
- ISO 27001 and OWASP Top 10 as reference
- Support on compliance audits
- Training and awareness: videos, micro-lessons and talks
- identificarIdentify
- Automated asset inventory, CMDB and approved software catalogue
- Recurring external reconnaissance: OSINT, subdomain enumeration, host probing and URL crawling with the ProjectDiscovery stack
- Nuclei with custom templates, and directory and parameter fuzzing with ffuf
- Penetration testing: reconnaissance, enumeration, exploitation and post-exploitation
- Nmap, Wireshark, Burp Suite, OWASP ZAP, Metasploit, Hydra, CrackMapExec
- Vulnerability analysis: Nessus, OpenVAS, Trivy, Semgrep, Gitleaks, SonarQube
- Patch analysis and version diffing
- Threat modelling with IriusRisk
- protegerProtect
- Linux and Windows server hardening: key-based access, root disabled, one account per person. Talos audits it
- Identity and access: self-hosted password manager and own identity provider federated with Entra (Zitadel)
- Infrastructure as code with Terraform on Hetzner, validating the plan before applying
- Website security: Plesk, WordPress application firewall, ModSecurity, automatic updates
- Firewalls and network segmentation, virtual private networks
- Endpoint and information protection policies
- Device management: evaluation, pilot and rollout of remote administration
- Security controls in continuous integration: secrets, static analysis, dependencies, image and dynamic analysis
- detectarDetect
- Wazuh: deployment, agents, rules and dashboards
- Log analysis on Windows and Linux
- Alert triage and security event review
- Indicators of compromise and console hunting
- Phishing simulation with GoPhish
- responderRespond
- Incident response: containment, eradication, credential rotation and documentation
- Forensics: acquisition, hash verification and chain of custody
- File carving and timeline analysis with Autopsy
- Incident and expert reports
- recuperarRecover
- 3-2-1 backup strategy: Veeam on Linux, NAS with RAID and off-site replication
- S3-compatible object storage and encrypted backups
- Provider comparison on own criteria, and vendor incident handling
- Restore drills and continuity plans
- High availability and orderly shutdown on power loss
Cross-cutting
- Development
- Go
- TypeScript and JavaScript
- Python
- Bash and PowerShell
- SQL: PostgreSQL, MySQL and SQLite
- React, Next.js and Astro
- Git, GitHub Actions and Jenkins
- Systems and networking
- Linux: Debian, Ubuntu, Kali
- Windows client and server
- Proxmox, VMware, Docker and TrueNAS
- TCP/IP, name resolution and SSH
- Nginx and reverse proxying
- Cloudflare and Hetzner
- Artificial intelligence
- Claude Code and Antigravity: agents with permissions, custom skills and verification
- Skills and plans written as data, so the agent does not improvise
- Checkers that break the build when an agent skips a rule
- Delegating across different models for adversarial review
- AI security: indirect prompt injection and adversarial benches against own agents
- Ollama and LM Studio for whatever does not leave the machine
How I work
I direct agents, I do not ask them for code
The rules an agent has to comply with I write as files, and on top of them go checkers that break the build when one is skipped. The design, the judgement and the verification are mine; the volume of mechanical work is theirs. That is how Talos has 147 checks written as data.
What audits only reads
Talos writes nothing on the server it scans: not a registry key, not a config file, not a service restart. It can run in production without asking for a maintenance window.
A control that gets in the way ends up switched off
I would rather have one that is followed ninety per cent of the time than a perfect one somebody bypasses on day two. On CybESphere I withdrew two I had put in myself, for exactly that reason.
A guard nobody has seen turn red is a hypothesis
Argos has 124 tests whose only job is to turn red when someone breaks a convention. In an adversarial round I found four that were green without measuring anything. Since then every guard gets broken on purpose before it counts.
I document what fails
A Wazuh agent that stops reporting because its clock has drifted teaches more than the finished dashboard. And in the Metabase lab I started on the wrong version, which cost me an afternoon.