About

I started by breaking systems to understand how they worked inside. I still do. Only now I get paid for it, and for teaching people how to keep them from breaking.

Then I wrote tools so I would not have to break them by hand every time. I have published more than a hundred, for free. Some ship by default in the system security professionals use all over the world. Others are used by teams that will never know my name.

I founded Navaja Negra and the OWASP Madrid chapter because Spain needed places to talk about security without the posture. I have spoken at RootedCON, RSA and Codemotion. After one of those talks, several companies checked their systems the next day and found open doors that had been there for months.

I have spent twenty years where security and performance actually break: banks, telecoms, energy, insurers and startups across Europe, the US, India and the UK. I have been at BBVA and across much of Spain’s IBEX 35. Not as a visitor: inside, with the system running.

At 42Crunch, a British security company with real weight in the field, I built a product from scratch.

At Banco Santander I was the technical lead of the AI team while they built the new area. The bank has 185,000 employees and OpenAI as a partner; my job was making it work on the inside. That is where I saw what happens when you put AI into a real organization, and what nobody says at conferences.

Now I work on my own and I only do three things.

Secure development: I sit with your team to work out where you will be attacked, I review the code and I design systems that do not open themselves. I do not run attack drills.

AI security: how to connect an AI to your systems without it becoming the way in. With Alfonso Muñoz I wrote Secure MCP, the book on Amazon.

Performance: if a system is slow and nobody can explain why, that is where I start. I have taken processes from eight hours down to a tenth of a second, on the same hardware and without rewriting the product.

And every day I send one email, Vamos al lío, about one thing I saw break that week. At Alice & Bob I teach people to build AI assistants and connect them to real systems without making a mess.

If you have a concrete problem, email me. I will tell you if I take it.