Lab

I’m Daniel Malaco, an Information Security Engineer in Porto, Portugal. Since 2020 I’ve been at Ascendi, designing and operating the security architecture of critical road infrastructure: next-generation firewalls, SIEM, endpoint protection, identity management, threat intelligence and incident response — the full cycle, from designing the control to analysing the event.

I came to security through networks. For several years I designed, installed and commissioned IP networks for metro and rail systems across four countries — the Doha Metro in Qatar, the Santos VLT in Brazil, and the Odense and Bergen light metros in Denmark and Norway. In transport infrastructure a network failure is not an inconvenience: it is a stopped system and thousands of people going nowhere. That is where I learned to design for redundancy, document for whoever comes next, and test everything in staging before touching production.

In 2020 I turned my focus from networks to the people attacking them. At Hardsecure I deployed next-generation firewalls and ran internal penetration tests — finding vulnerabilities before someone else could exploit them — and I carried that offensive perspective into the defensive work I do today. I take it seriously outside working hours too: SANS SEC504, DFIR and ransomware summits, and a CTF won in Lisbon in 2022.

I like building the tools I use: the ones on this site all run in the browser, and at home I keep a homelab with a k3s cluster on Raspberry Pis that serves as the guinea pig for anything I want to try before it gets anywhere near production. This site is part of that — static, bilingual, tracker-free, with its security posture documented and verifiable.

Experience

The essentials are above; the detail of each role lives here, collapsed.

Information Security Engineer · Ascendi Nov 2020 → present

• Context: security of critical road infrastructure, in Portugal.
• Role: designing, deploying and operating information security architecture, handling tasks/incidents in ITSM.
• Technologies: NGFW, AV/EDR, VA, SIEM, IAM, WAF, SEG.
• Outcome: ongoing maintenance of the security of networks, systems and applications through policies and procedures; identifying threats and vulnerabilities and implementing controls to mitigate them via monitoring and security-event analysis.
• External reference: the security infrastructure I helped build was the subject of a Fortinet Customer Story about Ascendi — the article doesn’t name me (it quotes the Head of IT), but I was part of the team behind the work it describes.

Cyber Security Engineer · Hardsecure Feb 2020 → Sep 2020

• Context: next-generation firewall deployment and internal penetration testing.
• Role: installing, configuring and supporting NGFW equipment.
• Technologies: next-generation firewalls (NGFW), network scanning and enumeration.
• Outcome: located vulnerabilities in networks before they could be exploited.

Systems Engineer · Efacec Jan 2019 → Feb 2020

Odense Letbane (Denmark)

• Context: light-metro project in Denmark.
• Role: designing, installing and commissioning IP networks and security.
• Technologies: system requirements, design and installation documents, lab staging, test and commissioning procedures.
• Outcome: the light metro’s IP network and security layer taken from design through commissioning — lab staging, test procedures, and a documented handover to operations.

Bergen D42 (Norway)

• Context: light-metro project in Norway.
• Role: designing, installing and commissioning IP networks and security.
• Technologies: system requirements, design and installation documents, lab staging, test and commissioning procedures.
• Outcome: system requirements turned into documented design, installation and commissioning of the D42 stretch — the technical groundwork for the line entering service.

Junior Consultant · Altran / Network Engineer · Thales Jan 2017 → Dec 2018

Doha Metro (Qatar)

• Context: metro project in Qatar.
• Role: designing, installing and commissioning IP networks and BBRS systems (mobile WiFi for trains).
• Technologies: IP networks, BBRS systems, rail/metro environments.
• Outcome: IP networks and the BBRS system (the mobile WiFi that follows the trains) delivered from specification through commissioning, on a metro built from scratch.

VLT Santos (Brazil)

• Context: light rail vehicle (VLT) project in Brazil.
• Role: designing, installing and commissioning IP networks and BBRS systems (mobile WiFi for trains).
• Technologies: IP networks, BBRS systems, rail/metro environments.
• Outcome: IP network and BBRS delivered from design through commissioning, adapting the same rail stack to an urban light-rail system.

Education

• MSc in Electrical and Computers Engineering — FEUP, Faculty of Engineering of the University of Porto (2009–2016), specialised in Network and Communication Services.

Certifications

Fortinet (Credly), SANS SEC504 and the summits, Microsoft, CyberDefenders and more — the full list, with current status and independent verification on Credly, lives on its own page: Certifications.

ATT&CK coverage

The MITRE ATT&CK techniques I cover defensively, tactic by tactic, with the tool or experience behind each one — the same résumé, in the industry’s native language: ATT&CK heatmap.

Skills

Area	Detail
Frameworks	MITRE ATT&CK, CIS benchmarks & controls, CISA CPG, OWASP Top 10, ISO 27001
Perimeter	NGFW, WAF, Security Email Gateway (SEG)
Endpoint	Antivirus (AV), Endpoint Detection & Response (EDR)
Identity	IAM, Active Directory
Detection & response	SIEM, vulnerability assessment (VA), penetration testing
Resilience	Business Continuity Planning (BCP)
Languages	Python, Bash, PowerShell, Golang, C/C++
Platforms	Linux, Windows, AWS, Azure, Rapid7 InsightVM, ServiceNow

Applied frameworks

The frameworks below show up in the work as tools, not as goals. I use them to structure decisions, prioritise controls, and speak the same language as auditors, vendors and regulators. The table says where each one comes in and at what depth — none of them is explained here.

Framework	Where it comes into the work	Depth
ISO 27001	Reference for security policies and procedures, and for organising technical controls by domain.	Reference
NIS2	Regulatory context of the sector I work in — critical transport infrastructure; it informs control and reporting priorities.	Context
CIS Controls & Benchmarks	Baseline for hardening systems and network equipment, and a reference when checking configurations.	Applied
CISA CPG	Point of comparison for prioritising baseline controls in critical infrastructure.	Reference
OWASP Top 10	Common vocabulary for classifying findings from vulnerability assessment and internal testing, and for tuning WAF rules.	Applied
MITRE ATT&CK	Mapping detection coverage and structuring incident analysis — technique by technique in the heatmap.	Applied

On the depth column. Applied — in regular use, in controls I operate. Reference — consulted during design and prioritisation, with no formal process attached. Context — the sector’s regulatory backdrop, not a programme I run. No row implies certification, formal audit or declared compliance: it is only where the framework comes into the work.