Pablo Gutiérrez
Cybersecurity & IAM Engineer
Transitioning to Pentester
Currently a Cybersecurity & IAM Engineer specializing in Blue Team operations, actively transitioning to offensive security. Preparing for OSCP certification while maintaining rigorous practice through Hack The Box and developing security automation tools. My extensive IAM background provides a unique perspective on defensive postures—understanding access controls, user management, and data protection—which strengthens my offensive security capabilities.
About Me
With a foundation in Telecommunications Engineering, I've always been drawn to understanding how systems communicate and interconnect. I specialize in Penetration Testing, though I'm currently working on a Blue Team where I focus on identity and access management and automating the security of the information we protect. This dual experience gives me valuable insight into both offensive and defensive security perspectives.
I've always wanted to be an ethical hacker—to protect systems before malicious actors do, giving organizations time to correct vulnerabilities and protect their information. My Master's thesis project involved designing, building, and comprehensively auditing a full Active Directory lab environment from scratch, which deepened my expertise in attack methodologies like Kerberoasting, AS-REP roasting, and various privilege escalation vectors.
Within penetration testing, I specialize in Active Directory, but I cover the full cycle from OSINT and network scanning to privilege escalation, lateral movement, and brute force attack techniques to achieve our goals.
Core Focus Areas
- ▸Blue Team: IAM
- ▸Red Team: Penetration Testing
- ▸Security Automation
- ▸AI & Machine Learning
- ▸Python, Bash & PowerShell
Work Experience
Cybersecurity Analyst
- ▸Managing user lifecycle and access control (account provisioning, deprovisioning and permissions governance) across critical systems
- ▸Developing Python/SQL automations using the Databricks SCIM API for programmatic role and group assignments
- ▸Automating access documentation into Confluence and designing a Neo4j + PyVis graph model to visualize and analyze permission relationships
- ▸Ensuring compliance with ENS, ISO 27001 and GDPR through stakeholder reviews and least-privilege validation
- ▸Daily use of Azure IAM, participation in AWS onboarding, and creation of internal scripts in Python, PowerShell and Bash to streamline security operations
KEY SKILLS:
Quality Assurance Coordinator
- ▸Leading the QA team in mobile and architecture car validation for SEAT & CUPRA applications, while balancing technical and managerial responsibilities
- ▸Coordinating daily activities and distributing tasks among team members
- ▸Acting as a point of contact for client communication and feedback loops
- ▸Delivering weekly and monthly project tracking reports and presentations
- ▸Continued executing technical validations alongside organizational duties
KEY SKILLS:
Quality Assurance Engineer
- ▸Performed comprehensive validation and testing for automotive applications and vehicle architecture for SEAT & CUPRA brands
- ▸Mobile app validator for SEAT & CUPRA brands
- ▸Vehicle architecture validator for SEAT & CUPRA
- ▸Creation of Test Plans and Test Cases
- ▸Log reading for applications, back-end, and vehicles
- ▸Use of tools such as Wireshark, dataloggers, Datadog, Kibana, Figma, Zeplin, and Jira, among others
- ▸Automation of mobile applications with XCode, Python, Appium and Selenium
KEY SKILLS:
Education & Certifications
Master`s in Artificial Intelligence
THESIS:
"Design and Implementation of an AI-Based Automated System for Job Offer Management and Prioritization"
Open ThesisKEY SUBJECTS & SKILLS:
- •Development of LLMs to analyse responses from cybersecurity tools to ensure a short path to finding vulnerabilities
- •Machine Learning, Deep Learning and LLM-based systems applied to automation and data analysis
- •Development of AI-driven SaaS tools and workflow optimization solutions
- •Integration of AI models to support intelligent decision-making across different industries
Master's in Cybersecurity
THESIS:
"Building and Breaking an Active Directory Environment"
Open ThesisKEY SUBJECTS & SKILLS:
- •Ethical hacking, technical security audits and malware analysis
- •Digital forensics and security incident management
- •Secure development practices and penetration testing of systems and networks
- •SIEM monitoring, event correlation and attack mitigation
- •Security frameworks: ENS, ISO 27001, GDPR
Bachelor's degree in Electronic Telecommunications Engineering
THESIS:
"Neuronal Network for Random Number Generation"
Open ThesisKEY SUBJECTS & SKILLS:
- •Electronics, telecommunications, networking and digital systems
- •Design, implementation and validation of technical engineering projects
- •Technical analysis, measurement, calculation and report writing
- •Problem-solving, applied programming and multidisciplinary teamwork
Certification Path
CJCA
Certified Junior Cybersecurity Analyst
Hack The Box
Foundation certification validating core cybersecurity analysis skills and practical knowledge.
CPTS
Certified Penetration Testing Specialist
Hack The Box
Advanced pentesting certification focused on real-world attack paths and comprehensive security assessments.
OSCP
Offensive Security Certified Professional
Offensive Security
Industry-leading penetration testing certification emphasizing hands-on exploitation and reporting skills.
Long-term certification roadmap aligned with offensive security career goals.
Skills Matrix
Offensive Security
- •Penetration Testing: Burp Suite, OWASP ZAP, Metasploit
- •Network Reconnaissance: Nmap, Masscan, Gobuster
- •Active Directory: Impacket, BloodHound, linPEAS, winPEAS
- •Web Security: SQL Injection, XSS, SSRF, IDOR
- •Post-Exploitation: psexec.py, enum4linux, ldapsearch
- •Active CTF Player & Student
- •Forensic Analysis & Log Analysis with Autopsy
Security Engineering & IAM
- •Identity and Access Management (IAM)
- •Azure Databricks Security & IAM Automation
- •Active Directory Security & Administration
- •Compliance: GDPR, ISO 27001, ENS Framework
- •Centralized Data Governance Platforms
- •Security Policy Implementation & Auditing
Cloud & Infrastructure
- •Azure Databricks & Azure Cloud Services
- •AWS Cloud Platform
- •Active Directory & Windows Server
- •Network Security & Firewall Management
- •Deployment: Vercel, Railway, GitHub Actions
- •Linux & Windows Administration
Programming & Automation
- •Languages: Python, Bash, PowerShell, SQL
- •Web Development: JavaScript, TypeScript, HTML, CSS, PHP
- •Engineering: MATLAB, Simulink, LabVIEW
- •Mobile Testing: Appium, Selenium, XCode
- •Infrastructure Automation: Databricks, Jira, Confluence
- •System Automation: Task Schedulers, Privilege Management
- •IDEs: VS Code, Cursor
AI & Machine Learning
- •Prompt Engineering & LLM Integration
- •Neural Networks & Deep Learning
- •Machine Learning Models & Algorithms
- •Workflow Automation: n8n, Make
- •ChatBot Development & AI Image Generation
- •Data Analysis & Visualization
Featured Projects
A selection of featured projects showcasing security automation, IAM solutions, and offensive security practice.
Security Automation ToolKit - Minsait Cyber
PrivateCreated a custom 'BloodHound' for Databricks using Python and PyVis library. The tool visualizes a network of connections between users, groups, service principals, permissions, catalogs, schemas, tables, and more. Features include route finding to determine if a user can access a specific table, searching for all schemas and tables with group privileges, and comprehensive permission mapping.
STACK:
RESULT:
Comprehensive security visualization tool for Databricks environments with permission analysis capabilities
Databricks IAM Automation - Minsait Cyber
PrivateDeveloped a Python automation system that reads documentation from Confluence about access and permission configurations for projects. The system processes form-based JSON inputs and automatically applies the correct permissions to Databricks resources, streamlining IAM workflows.
STACK:
RESULT:
Automated IAM permission management for Databricks projects based on Confluence documentation
HackTheBox WriteUps
PublicRepository containing my documented Hack The Box machine write-ups. Professional approach, OSCP-oriented, and focused on real-world penetration testing. Contains 30 Easy machines and 3 Medium machines with step-by-step explanations, tool usage, and mitigation strategies.
STACK:
RESULT:
33 machines completed (30 Easy, 3 Medium) with comprehensive OSCP-oriented write-ups