Available for consulting & full-time roles

Santiago Restrepo Sánchez

Cybersecurity & Infrastructure Engineer

Securing and running the infrastructure your business depends on.

I help organizations harden their networks, detect threats early and run reliable cloud and on-prem infrastructure — combining 10+ years of hands-on operations with a security-first mindset.

Work with me View portfolio
10+
years in IT, infrastructure and security
0
incidents or unplanned downtime in 2 years
70%+
fewer security incidents
50%
faster critical transactions after an Azure migration
97%
client satisfaction in support
12
hands-on security projects published here

// services

How I can help your organization

Hands-on engineering backed by a decade of running production infrastructure — from the firewall to the database.

Security Assessment & Hardening

Find the weaknesses before attackers do, then fix them with a prioritized, realistic plan.

Infrastructure & Network Engineering

Design, build and operate resilient networks, VPNs and virtualized data centers.

Cloud Migration & Security

Move to Azure or AWS without losing control — and prove your cloud is configured securely.

Database Administration & Security

Fast, reliable and secure SQL Server, PostgreSQL, MySQL and Oracle environments.

// portfolio

Hands-on labs & security projects

Reproducible labs with write-ups, code and downloadable source.

All projects
Network Security & AdministrationThreat Detection & SIEMVulnerability Assessment & PentestingScripting & AutomationCloud & Modern SecurityDatabase SecurityDevSecOps & AppSec
Network Security & Administration Intermediate

Segmented SMB Network on OPNsense

Two-site network for a fictional 40-person company: default-deny zones on OPNsense, Suricata IPS, DNS filtering, IPsec between offices and OpenVPN with TOTP, with the firewall policy written as code and verified by an automated checker.

IPsecOPNsenseOpenVPNProxmoxPython
Threat Detection & SIEM Intermediate

Detection-as-Code with Sigma

Fifteen ATT&CK-mapped Sigma rules for Windows, Linux and Azure. Every pull request lints them, converts them to Splunk, Elastic and Sentinel queries, and runs them against positive and negative sample events on two engines (Zircolite and Elasticsearch) before a ruleset lets the change merge.

ES|QLElasticsearchGitHub ActionsKQLMicrosoft Sentinel
Threat Detection & SIEM Intermediate

Wazuh SIEM Home Lab

Single-node Wazuh SIEM for a fictional 40-person company: Windows, Linux and firewall telemetry, eight detection use cases mapped to MITRE ATT&CK, and reproducible, version-pinned tooling.

Atomic Red TeamOPNsensePythonSysmonWazuh
Vulnerability Assessment & Pentesting Intermediate

Vulnerability Management Workflow (Greenbone, EPSS, KEV)

Greenbone scans three outdated lab hosts with SSH credentials; findings are prioritized with CVSS, EPSS, CISA KEV and asset criticality under a written policy, tracked with SLA due dates, remediated and rescanned. Measured in CI against containers.

CISA KEVCVSSDebianDockerEPSS
Vulnerability Assessment & Pentesting Advanced

Active Directory: Assess, Harden and Validate

Defensive Active Directory engagement for a fictional small company: eleven typical weaknesses, assessment with PingCastle, BloodHound CE and Microsoft's baseline, PowerShell hardening scripts, and a generated report.

Active DirectoryBloodHound CEPesterPingCastlePowerShell
Scripting & Automation Intermediate

Ansible CIS Hardening for Ubuntu 24.04

Ansible roles harden Ubuntu 24.04 to CIS Level 1 – Server; OpenSCAP scans before and after, a second run proves idempotency, and CI fails on a low score, a claimed control that still fails, a regression or a run that changes something.

AnsibleCIS BenchmarksGitHub ActionsMoleculeOpenSCAP

// credentials

Certifications

Vendor and industry training that backs up the hands-on work.

Skills & certifications
CCNA 200-301
Cisco
Microsoft 365 Certified: Fundamentals
Microsoft
Professional Google Workspace Administrator
Google Cloud
Fortinet NSE: Beginner to Expert
Fortinet (training)

// let's talk

Need a security assessment, an infrastructure lead or an extra pair of expert hands?

Tell me about your environment and goals. I usually reply within one to two business days.

Get in touch