[email protected]:~$ pt --view

$ whoami

Alexandre Leite Lopes

Cybersecurity Engineer — SOC & SIEM

“"I'm going to make him an offer he can't refuse.".”

4+ yrs
Professional Experience in Cybersecurity
3
Main Sectors: healthcare, space & defense, banking

$ cat about.md

About

A '99 dude, most likely passionate about cybersecurity, muay thai, football, and cinema — always trying to improve, both as a professional and as a person.

Located in Portugal (born and raised), he graduated in computer engineering and moved into cybersecurity early in his career. He started on the blue team side, and admits that's probably where he sees his future — he's drawn to the challenge of detecting attacks and tracing them back to their root cause. For now, though, he has a personal interest in sharpening his pentesting skills and understanding the hacker's mindset: he's been working through HackTheBox labs for the past few months, with the goal of eventually earning a certification such as CPTS or OSCP.

Currently working for VWFS as a team coordinator with main responsibilities in SIEM engineering, log source management, and platform support.

$ cat experience.log | sort -r

Experience

SIEM Engineer
Oct 2025 — Present
Volkswagen Financial Services
  • Coordinate and lead a 7-person SIEM team responsible for day-to-day operations across 20,000+ log sources, ensuring correct onboarding, event delivery, and parsing.
  • Act as the resolution point for SIEM-related issues and incidents, working closely with the SOC team on use-case optimization and platform/heavy-log troubleshooting.
  • Own platform support for the QRadar SIEM estate (Event Processors, Data Nodes) and the rsyslog-based collector/distribution layer — the single entry point for all events destined for the SIEM.
  • Coordinate onboarding and deployment of standardized logging configurations (Windows, Linux, AIX, Network, Antivirus, Custom Apps) across markets spanning every continent.
  • Monitor platform health and log ingestion via Grafana; maintain SOPs and documentation in GitLab.
  • Build and maintain CI/CD pipelines to deploy and keep log source configurations synchronized across SIEM and the CMDB.
  • Currently supporting the team's transition to Elastic Cloud.
QRadarrsyslogGrafanaGitLab CI/CDElastic Cloud
Cybersecurity Engineer
May 2024 — Oct 2025
Claranet
  • Detection engineer on a high-profile engagement for a confidential space technology & satellite customer, improving threat visibility and hardening the incident response process.
  • Led the Threat Hunting service — proactively hunting recently-exploited vulnerabilities, APT behavior patterns, and customer-specific threat profiles.
  • Restructured SIEM data ingestion and detection rules, mapping coverage against the MITRE ATT&CK matrix.
  • Owned Central Log Management — onboarding new log sources and validating ingestion into the SIEM.
  • Built Logic Apps automations and playbooks to cut manual analysis time.
  • Wrote SOPs and use-case documentation for the incident response team; supported them on critical incidents and RCA.
  • Delivered weekly and monthly findings briefings directly to the customer.
Microsoft SentinelRapid7 VMSOC RadarDefender XDRLogic Apps
SOC Analyst
Mar 2023 — May 2024
Avanade/Accenture — Spanish SOC team
  • Joined as an L1/L2 analyst and moved into a solid L2 role within months, handling incident response for an international healthcare organization.
  • Analyzed and responded to security incidents; built automated playbooks in PowerShell and Python.
  • Ran threat intelligence enrichment and day-to-day EDR / SIEM / SOAR management.
Microsoft SentinelCynet EDRServiceNowDefender
Cloud Security Engineer
Jun 2022 — Mar 2023
Avanade
  • Support infrastructure migration for BUPi, a Portuguese government land-registry program, to Azure — owning WAF configuration, Defender for Cloud, and compliance alignment (PCI DSS, NIST).
  • Deployed and maintained Azure infrastructure on projects for Santander and Galp.

$ ls certifications/

Certifications

ECIH
Certified Incident Handler
EC-Council
SC-200
Microsoft Security Operations Analyst
Microsoft
AZ-500
Microsoft Azure Security Technologies
Microsoft
SC-100
Microsoft Cybersecurity Architect
Microsoft
SC-300
Microsoft Identity and Access Administrator
Microsoft
SC-400
Information Protection Administrator
Microsoft
AZ-700
Azure Networking Solutions
Microsoft

$ ls ~/htb/ --recursive

HackTheBox — machines & sherlocks

19
Machines attempted
18
Rooted / fully owned
6
Sherlocks (DFIR) solved

Machines root + user flags · full writeups kept in Notion

Support rooted
Active Directory · Easy
Anonymous SMB → decompiled a custom UserInfo.exe for an LDAP bind password → secret hidden in the info attribute → WinRM. GenericAll over the DC object abused via RBCD to impersonate Administrator and DCSync.
RBCDDCSyncGenericAll
Timelapse rooted
Active Directory
Anonymous SMB → cracked a zip/PFX pair → WinRM with the recovered client certificate → plaintext credential from PSReadLine history → extracted the LAPS password → Administrator.
PFX crackPSReadLineLAPS
Baby in progress
Active Directory
Anonymous LDAP enumerated every domain user → an onboarding password left in a description field → reset an expired account via changepasswd → authenticated WinRM foothold. Privesc write-up pending.
anon LDAPpassword-must-change
Management rooted
Linux · Medium
OpenAM deserialization RCE → keystore secrets → GLPI DB credential decrypt (XChaCha20) → password reuse to a system user → sudo rdiff-backup wildcard argument injection.
CVE-2021-35464rdiff-backupcred reuse
Devvortex rooted
Linux
vhost fuzzing → Joomla unauth config leak hands over DB creds → admin template edit for RCE → cracked a DB password hash → sudo apport-cli pager shell escape.
CVE-2023-23752CVE-2023-1326
GoodGames rooted
Linux · Easy
Login SQLi → cracked admin MD5 → internal dashboard vulnerable to Jinja2 SSTI → RCE as container root → Docker bind-mount + shared UID to drop a SUID bash on the host.
SQLiSSTIDocker escape
Two Million rooted
Linux · Easy
Reversed the invite API → BFLA flaw to self-promote to admin → OS command injection in the VPN generator → OverlayFS kernel LPE to root.
BFLAcommand injectionCVE-2023-0386
Precious rooted
Linux · Easy
pdfkit URL-to-PDF command injection → plaintext creds in a bundler config → a sudo-able Ruby script doing YAML.load → deserialization gadget → root.
CVE-2022-25765YAML deserialization
Writeup rooted
Linux · Easy
Unauth CMS Made Simple blind SQLi → cracked the admin hash → staff-group write to /usr/local/bin + root running run-parts by bare name on login → PATH hijack.
CVE-2019-9053PATH hijack
Sau rooted
Linux
Request Baskets SSRF to reach an internal-only service → Maltrail unauthenticated OS command injection → sudo systemctl status pager shell escape.
CVE-2023-27163CVE-2023-26604
Connected rooted
Linux · Easy–Medium
Unauth FreePBX SQLi created a rogue admin → Endpoint Manager arbitrary file upload for RCE → incron watching a world-writable dir + a pipe missing from a metachar blocklist → root.
CVE-2025-57819CVE-2025-61678incron
Enigma rooted
Linux
World-readable NFS export leaked webmail creds → password reuse across mailboxes → OpenSTAManager authenticated file-upload RCE → OliveTin root-owned command injection.
NFS leakCVE-2026-38751CVE-2026-27626
Paperwork rooted
Linux
Leaked source of a custom LPD service → print-job command injection → JetDirect/PJL path traversal to pivot users → a root daemon leaking file descriptors via SCM_RIGHTS → root.
command injectionpath traversalSCM_RIGHTS
Cohort rooted
Linux
SSRF loopback-filter bypass (127.1) → leaked an internal nginx vhost → marimo pre-auth WebSocket RCE → PackageKit TOCTOU race to a SUID bash.
SSRFCVE-2026-39987CVE-2026-41651
Paper rooted
Linux
Escalated to root through CVE-2021-3560, a polkit race condition in allow_active authentication.
CVE-2021-3560polkit
Knife rooted
Linux / Web
Backdoored PHP 8.1.0-dev triggered via a custom User-Agentt header for RCE → escalated to root through a GTFOBins sudo entry for knife.
PHP backdoorGTFOBins sudo
Touch rooted
Windows
Unauth /api/status leaked a device serial (= admin password) → broke out of a locked-down kiosk via a native error dialog → MySQL UDF running as SYSTEM.
broken access controlkiosk breakoutMySQL UDF
Driver rooted
Windows · Easy
Default web-panel creds → malicious .scf on a reviewed share captures a NetNTLMv2 hash via Responder → crack → PrintNightmare to SYSTEM.
SCF / ResponderCVE-2021-1675
Jerry rooted
Windows · Easy
Default Tomcat Manager credentials → deployed a JSP reverse-shell WAR via the text API → landed directly as NT AUTHORITY\SYSTEM.
TomcatWAR deploydefault creds

Sherlocks blue-team / DFIR investigations

TeamPCP solved
Malware analysis · Hard
Reversed a malicious PyPI transformers package: four-layer sandbox evasion, a GitHub dead-drop C2, a cloud-credential stealer, and a geopolitical rm -rf / wiper. Full MITRE ATT&CK and IOC breakdown.
supply chaininfostealerATT&CK
Compromised Network Printer solved
Network forensics · Medium
132k-packet PCAP triaged with tshark — isolated a PRET/PJL attack on port 9100 exfiltrating held print jobs and backup RDP credentials from an HP printer, plus a failed IMDS credential grab.
PCAPtsharkPJL / PRET
Presentation As a Malware solved
Malware analysis · Easy
Legacy .ppt with an auto-exec VBA macro → mshta download chain → schtasks persistence. Static deobfuscation converged with VirusTotal sandbox output on the same dropped artifact.
VBA macromshtaschtasks
Investigate Web Attack solved
SOC / log analysis
Reconstructed a full attack from a bWAPP access.log: Nikto recon → login brute force → PHP code / OS command injection → a backdoor local account created via net user.
access.logNiktocommand injection
Brutus solved
DFIR / log analysis
auth.log + wtmp investigation of an SSH brute force on a Confluence host — traced the root compromise, correlated sessions across both artifacts, and found the cyberjunkie persistence account.
auth.logwtmpSSH brute force
Ore solved
DFIR / cloud
Cat-Scale triage of a Grafana EC2 box: CVE-2021-43798 config leak → SSH credential reuse → world-writable root cron hijack → XMRig miner, reconstructed through Linux Sysmon after the dropper self-shredded.
CVE-2021-43798cron hijackXMRig

Each entry has a full, step-by-step writeup (recon → foothold → privesc, with root-cause and remediation notes) maintained privately in Notion.

$ cat education.md

Education

Master's in Cybersecurity
University of Aveiro
Thesis on a risk-based MFA strategy.
2022 — 2025
Bachelor's in Computer Engineering
Polytechnic Institute of Coimbra (IPC)
2017 — 2021

$ ./contact.sh --open

Get in touch

Always up for a conversation — feel free to reach out on LinkedIn.

> linkedin.com/in/alexandre-leite-lopes