About

I started by breaking systems to understand how they worked inside. I still do. Only now I get paid for it, and for teaching people how to keep them from breaking.

When a tool is missing, I write it. I have published more than a hundred, for free. GoLismero, Plecost and Dockerscan are widely used to audit systems, WordPress and containers. Vulnerable Node is a deliberately vulnerable app for learning to attack and defend Node.js. wordpress-docker-sec and nginx-wordpress-docker-sec are hardening setups that blind automated scanners, my own included. With LAPIS I turned into an academic paper, published on arXiv, how to describe an API so a model understands it with far fewer tokens.

I founded Navaja Negra and the OWASP Madrid chapter because Spain needed places to talk about security without the posture. I have presented research at RSA Conference and OWASP AppSec EU, and I am a regular speaker at RootedCON. Spain’s National Cybersecurity Institute (INCIBE) has asked me to judge its competitions several times. After one of my talks, several companies checked their systems the next day and found open doors that had been there for months.

I have spent twenty years where security and performance actually break: banks, telecoms, energy, insurers and startups across Europe, the US, India and the UK. I have been at BBVA and across much of Spain’s IBEX 35, with the systems running.

At Banco Santander I was Principal Engineer in the AI department while the area was being set up. The bank has 185,000 employees and OpenAI as a partner; my job was making it work on the inside. That is where I saw what happens when AI enters a real organization, and what nobody says at conferences.

At BBVA I was Cybersecurity Tech Lead. At 42Crunch, in the UK, I was responsible for one of its API security products.

Now I work on my own, as an independent technology advisor. I used to come in mostly for one-off projects. Now I stay with teams over time: they count on me every month to check their architecture, security and AI decisions and the technical problems that keep coming up. I like working this way because I end up knowing the team and its systems almost like someone on the inside. This is how it works.

The decisions I help with most fall into three areas.

Secure development: I sit with each team to work out where the attack will come from, I review the code and I design systems that do not open themselves. I do not run attack drills.

AI security: how to connect an AI to a company’s systems without it becoming the way in. With Alfonso Muñoz I wrote Secure MCP: A practical guide for developers, software architects and tech leads.

Performance: if a system is slow and nobody can explain why, that is where I start. I have taken processes from eight hours down to a tenth of a second, on the same hardware and without rewriting the product.

Team training: one-day workshops and six-week programmes.

And every day I send one email, Vamos al lío, about one thing I saw break that week. At Alice & Bob I teach people to build AI assistants and connect them to real systems without making a mess.

Email is the most direct way in for a concrete technical problem: [email protected]. I say whether I’ll take it on.