Pentester at Hispasec since February 2026, with experience in Black Box and Grey Box assessments of web applications, APIs, infrastructure and exposed services. Computer Engineering graduate (UOC) certified CRTO, OSCP+, OSCP, HTB CPTS and CWP. My work is to find vulnerabilities, prove their impact with proofs of concept, retest after fixes and write reports that engineering teams can act on.
Specialization
Red Teaming & Offensive PentestingCompromise of corporate environments through realistic attacks: web exploitation, pivoting across segmented networks, Active Directory exploitation, post-exploitation and privilege escalation on Windows/Linux.
Malware DevelopmentDevelopment of offensive tools in C/C++ with Win32 API, process injection, hooking, AV/EDR evasion and Windows Internals research.
Security AutomationCustom Python, PowerShell and Bash scripts to accelerate enumeration, exploitation, flag validation and technical documentation.
Featured Achievements
- CRTO Certified - Red team operations with Cobalt Strike - October 2026
- OSCP+ Certified with perfect score (100/100) - February 2026
- CWP Certified - Wireless network auditing and security
- HTB CPTS - Professional pentesting methodology - 2025
- CTF-Lab Local - Corporate network pentesting lab designed as final degree project
Technical Stack
Web and API testing: OWASP Top 10, injections (SQLi, XSS, SSRF), access control (IDOR, authentication bypass), Burp Suite Pro, Caido
Infrastructure and Active Directory: Nmap, NetExec, BloodHound, Kerberoasting, AS-REP Roasting, NTLM Relay, DCSync, Kerberos delegation, Metasploit
Red Team and C2: Cobalt Strike, Sliver, Malleable C2, AD CS abuse (Certify), DPAPI, LAPS, MSSQL, domain trusts, AMSI/AppLocker/Defender evasion and OPSEC
Post-exploitation and pivoting: Mimikatz, Rubeus, PowerView, Ligolo-ng, Chisel, SSH tunneling
Development: Python, Bash, PowerShell, C/C++ (Win32 API), C#; malware development for training purposes (process injection, API hooking, AV/EDR evasion)
Sections
Education
Software Engineering Degree | 2023 - 2026
Universitat Oberta de Catalunya (UOC)Software Engineering track
Final Degree Project: CTF-Lab Local - Corporate network simulation for pentesting
Master's Degree in Cybersecurity | 2023 - 2024
CPIFP Alan Turing, MalagaEthical Hacking, Digital Forensics, Network Hardening, Compliance and Security Regulations
Higher Technician in Cross-Platform Application Development | 2021 - 2023
Colegio San Jose, MalagaJava, Databases, Operating Systems, Web Development
Featured Projects
CTF-Lab Local | Final Degree Project
September 2025 - January 2026 | Grade: 9/10
Featured Projects
Professional Experience
Pentester / Offensive Security Analyst | Hispasec | February 2026 - Present
- Black Box and Grey Box assessments of web applications, APIs, infrastructure and exposed services
- Controlled vulnerability identification, validation and exploitation
- Proof-of-concept development, impact assessment, retesting and technical recommendations
- External attack surface analysis covering exposed assets, domains, subdomains and associated risks
Cybersecurity Technician Intern | Grupo TOPdigital | June 2024 - July 2024
- Security monitoring, vulnerability analysis and web application security reviews
- Review of configurations, security policies and system hardening measures
- Technical documentation and results reporting
Web Developer Intern | TYM | March 2023 - June 2023
- Web feature development and maintenance using TypeScript and Angular
- Git-based collaborative development workflows