Detection & Response
Correlate endpoint, network and application signals to investigate activity and prioritize risk.
- Microsoft Defender
- Zeek
- SIEM / Monitoring
- Log Analysis
- Threat Intelligence
CYBERSECURITY / SÃO PAULO, BRAZIL
Lucas
Morato.
Security at every layer.
Security Operations, AppSec and Security Engineering. Development, automation and analytical thinking applied to protecting systems.
Postgraduate studies in CybersecurityPUCPR17+years in technology and digital projects
#1 BrazilHack The Box · Season 8
80+courses, certificates and credentials
PUCPRpostgraduate studies in Cybersecurity
HACK THE BOX / RECOGNITION
#1BRAZILSeason 8 · peak national ranking achieved
Knowledge put to the test.
A track record of practice across machines, challenges and advanced labs. Enumeration, vulnerability exploitation, Active Directory and lateral movement in controlled environments.
Linux & WindowsWeb & APIsActive DirectoryPrivilege Escalation
Technical portfolio01 / EXPERTISE
From code to operations.
A development background for investigating risk, strengthening applications and automating security workflows.
Monitoring, log analysis and threat investigation. Knowledge of SOC/SecOps, incident response and vulnerability management.
Web application and API assessments, code review, authentication and authorization. Security integrated into development and the software lifecycle.
Web pentesting, enumeration, infrastructure assessment and vulnerability validation. Hands-on lab practice with Active Directory and lateral movement.
Application and server hardening, access control and automation. Development experience applied to scripts, integrations and security workflows.
APPLIED RESEARCH
From exposed services to the source of risk.
Linux, networks and applications through the same lens: identify services, inspect requests and correlate evidence in the lab.
- Service enumeration
- HTTP and API analysis
- Linux investigation
02 / SECURITY OPERATIONS LAB
Inside the operation.
Logs, networks, applications and systems. A demonstration environment connecting investigation, analysis and response.
morato / security-workspaceLab environment
DETECTION & RESPONSE
Visibility to investigate.
SAMPLE PAUSED
Correlated events1,24824-hour sample
Alerts under review6 / 62 high · 3 medium · 1 low
Lab assets12Linux · Windows · APIs
Detection rules24Authentication, network and endpoint
EVENT VOLUMESynthetic telemetry
00:0006:0012:0018:0023:59
TELEMETRY SOURCES
Linux / auditd
Windows / events
Network / Zeek
Applications / API
INVESTIGATION QUEUE
TIMEEVENT / ASSETSEVERITY
03 / APPSEC LAB
Security, demonstrated.
An HTTP header analysis: from an exposed configuration to the implementation of protective controls.
HTTP / RESPONSE HEADERS
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Server: sample-app
Cache-Control: no-storeCONTROL ANALYSIS
Sample ready for analysis.
Analysis is limited to the controls in this sample. It does not represent a complete security audit.
LOCAL SAMPLES · NO EXTERNAL SCANS
HACK THE BOX / CONTINUOUS PRACTICE
Machines. Challenges. Full scenarios.
Continuous practice across machines, technical challenges and advanced Hack The Box labs. From web applications to corporate networks and Active Directory, investigating and testing within controlled environments.
Selected completed Pro Labs
01Advanced Hades
02P.O.O.
03Zephyr
04Dante Pro Labs
SECURITY IN DEPTH
Connected layers. Integrated protection.
Applications, identity and infrastructure belong to the same attack surface. Visibility and controls need to connect.
APPLICATIONS / IDENTITY / INFRASTRUCTURE
04 / SECURITY TOOLKIT
Tools. Context. Depth.
From the command line to application code, a technical foundation connecting development, infrastructure and security.
Offensive Security
Reconnaissance, service analysis, application assessment and validation in authorized environments.
- Burp Suite
- Nmap
- Metasploit
- Wireshark
- Active Directory
Application Security
Code review, authentication, authorization and security practices throughout development.
- OWASP Top 10
- API Security
- SAST / DAST
- Secure Coding
- Secure SDLC
Systems & Infrastructure
System hardening, service analysis, permissions, networks and digital environment protection.
- Linux
- Windows
- Docker
- TCP/IP · DNS
- FortiGate · Palo Alto
Cloud & Identity
Identity, access control and security foundations in cloud infrastructure.
- AWS
- Microsoft Azure
- IAM
- Cloud Security
- Azure AD
Automation & Development
Scripts, integrations and data processing applied to technical and security workflows.
- Python · Bash
- TypeScript · JavaScript
- PHP · SQL
- PostgreSQL · Redis
- REST APIs · n8n
05 / SECURITY MINDSET
Investigate methodically. Protect with context.
Observe
Assets, services and telemetry. Understand the environment before assessing risk.
Investigate
Correlate logs, behavior and context to form testable hypotheses.
Validate
Review code and configurations; test hypotheses within authorized scope.
Strengthen
Hardening, access control, remediation and automation to reduce exposure.
06 / EXPERIENCE
Engineering with context.
More than 17 years in technology, digital development, automation and complex projects. Today, practice and training focused on cybersecurity.
Selected technical contributions from the résumé.
Download résuméLucas Morato CyberSecurity
Applications, automation and cybersecurity
Development of security scripts and utilities. Assessments of APIs, authentication, authorization and web applications. Server hardening and integration of OWASP practices into development.
Point Comunicação
Technology and operations contributions
Participation in endpoint and digital environment protection initiatives. Automations, scripts and integrations for operational processes. Multidisciplinary team leadership and complex project management.
Novine
Web development and application security
Founded and managed a digital company. Full stack development, code review and remediation of vulnerabilities including SQL Injection and XSS. Input validation and server and database hardening.
07 / ACADEMIC BACKGROUND
Cybersecurity at PUCPR.
Postgraduate studies in Cybersecurity, Software Architecture & Data Science at PUCPR. An academic foundation connecting security, software engineering and data analysis, complemented by continuous practice.
PUCPR
Postgraduate studiesCybersecurity, Software Architecture & Data Science
PUCPR · 2021–2022
Bachelor’s degree in Web Development
Universidade Anhembi Morumbi · 2008–2012
Languages
Native Portuguese. Advanced English for reading and technical research; intermediate English for conversation and meetings.
CONTINUING EDUCATIONView credentials on LinkedIn
Cisco
SOC · Threat Investigation · Network Security
IBM
Incident Response · Forensics · Penetration Testing
Microsoft
Defender · IAM · Azure Security
Palo Alto Networks
Network Security · Cloud Security
Fortinet
FortiGate Administrator
Detection & Response · Python · Linux
AWS
IAM · Cloud Security · DevOps
EC-Council
Cybersecurity · Generative AI · Zeek
ISACA
Auditing Generative AI · Risk Mitigation
NEXT CONVERSATION
Let’s strengthen
your security team.
Opportunities in Cybersecurity, Security Operations, AppSec and Security Engineering.
lmorato@gmail.com+55 (11) 98767-2927São Paulo, Brazil · Remote work