Español →
Offensive security isn't about finding bugs — it's about proving what's actually exploitable. With 10+ years of experience spanning software development and security, I work across web, API, mobile, and cloud environments, helping teams identify real attack paths and turn findings into stronger security controls.
My focus is application security and penetration testing: exploiting business logic flaws, authentication and authorization weaknesses, and validating high-risk flows — then translating findings into remediation that engineering teams actually implement. I also leverage AI-augmented security workflows, including LLM-assisted vulnerability discovery and OWASP LLM Top 10 testing. I hold an MSc in Cyber Security with Distinction from the University of Birmingham and previously worked as a Security Engineer (Penetration Testing) at CERN.
Outside of work, I share what I learn with the community: speaking at well-known security conferences including DEF CON 34 (Las Vegas), BSides Colombia, and PWN or DIE (Ecuador), publishing research, and creating open security testing resources.
For more information, have a look at my curriculum vitae .
Conferences where I've presented original research:
DEF CON 34 — Las Vegas, USA (2026): Your APP Thinks I'm You: A Complete Kill Chain Against Mobile App Security — talk info
BSides Colombia (2026): Your Brain > Your Toolkit: Real Bugs, Zero Code, Zero Tools
PWN OR DIE — Ecuador (2026): Frustration Kill Chain: un framework para depurar rechazo en seguridad ofensiva
PWN OR DIE — Ecuador (2025): When Your Mind Becomes the Exploit: No Code, No Tools
Coordinated vulnerability disclosures across ConvertX and pdfcpu — discovered, exploited, and coordinated disclosure with the maintainers.
| CVE / GHSA | Project | CVSS | CWE | Status |
|---|---|---|---|---|
| CVE-2026-105080 | ConvertX v0.18.0 | 9.4 CRITICAL | CWE-94: Improper Control of Generation of Code ("Code Injection") | ✅ Fixed in v0.19.0 |
| GHSA-w2hj-54mc-76r4 · CVE pending | pdfcpu v0.15.0 | 7.5 HIGH | CWE-190: Integer Overflow or Wraparound | ✅ Fixed in v0.16.0 |
| GHSA-fjh6-rrhv-4g63 · CVE pending | pdfcpu v0.15.0 | 6.5 MEDIUM | CWE-770: Allocation of Resources Without Limits or Throttling | ✅ Fixed in v0.16.0 |
| GHSA-g766-88fx-58h8 · CVE pending | pdfcpu v0.15.0 | 5.9 MEDIUM | CWE-190: Integer Overflow or Wraparound | ✅ Fixed in v0.16.0 |
| GHSA-6524-w46v-6399 · CVE pending | pdfcpu v0.15.0 | 6.5 MEDIUM | CWE-129: Improper Validation of Array Index | ✅ Fixed in v0.16.1 |
GHSA advisories published; CVE assignment pending. Detailed writeups →
Open to research collaborations, conference speaking, and security consulting - feel free to reach out through any of the channels below.
