About

I started by breaking systems to understand how they worked inside. I still do. Only now I get paid for it, and for teaching people how to keep them from breaking.

When a tool is missing, I write it. I have published more than a hundred, for free. GoLismero, Plecost and Dockerscan are widely used to audit systems, WordPress and containers. Vulnerable Node is a deliberately vulnerable app for learning to attack and defend Node.js. wordpress-docker-sec and nginx-wordpress-docker-sec are hardening setups that blind automated scanners, my own included. With LAPIS I turned into an academic paper, published on arXiv, how to describe an API so a model understands it with far fewer tokens.

I founded Navaja Negra and the OWASP Madrid chapter because Spain needed places to talk about security without the posture. I have presented research at RSA Conference and OWASP AppSec EU, and I am a regular speaker at RootedCON. Spain’s National Cybersecurity Institute (INCIBE) has asked me to judge its competitions several times. After one of those talks, several companies checked their systems the next day and found open doors that had been there for months.

I have spent twenty years where security and performance actually break: banks, telecoms, energy, insurers and startups across Europe, the US, India and the UK. I have been at BBVA and across much of Spain’s IBEX 35. Not as a visitor: inside, with the system running.

At Banco Santander I was Principal Engineer in the AI department while the area was being set up. The bank has 185,000 employees and OpenAI as a partner; my job was making it work on the inside. That is where I saw what happens when you put AI into a real organization, and what nobody says at conferences.

At BBVA I was Cybersecurity Tech Lead. At 42Crunch, in the UK, I was responsible for one of its API security products.

Now I work on my own and I only do three things.

Secure development: I sit with your team to work out where you will be attacked, I review the code and I design systems that do not open themselves. I do not run attack drills.

AI security: how to connect an AI to your systems without it becoming the way in. With Alfonso Muñoz I wrote Secure MCP: A practical guide for developers, software architects and tech leads.

Performance: if a system is slow and nobody can explain why, that is where I start. I have taken processes from eight hours down to a tenth of a second, on the same hardware and without rewriting the product.

And every day I send one email, Vamos al lío, about one thing I saw break that week. At Alice & Bob I teach people to build AI assistants and connect them to real systems without making a mess.

If you have a concrete problem, email me. I will tell you if I take it.