Daniel Ferreira · The Hague, Netherlands
AI harness engineer.
18+ years of engineering, architecture and getting things shipped. Today: leading IT and OT security operations, applying agentic AI to detection and response, and developing the teams behind them.
Explore the work01 / The person behind the work
I’m Daniel, a cybersecurity leader with a software engineer’s instinct to build. When writing code by hand was relevant, I was very good at SQL Server databases, C# .NET, Splunk SPL and Microsoft KQL. My engineering foundation spans big-data architectures for cyber, Databricks and messaging integrations.
Currently at SKF, I head the Security Operations Centre (SOC) for IT and OT across roughly 20 factories. My teams cover detection engineering, incident response, threat intelligence, threat hunting, vulnerability management, offensive security and platform engineering.
I stay close to the code, coach my teams and turn technical risk into clear decisions. Curious by default. Hands-on by choice. Absolutely passionate about talent development. Contagious energy.
Spain / EU citizenship · English & Spanish
A little more about me
02 / Selected work
Security platforms, useful tooling and one CV that prefers a terminal. A few things I’ve built and shared.
Massive productivity hike. Shipped at SKF: identity-first, password-less architecture with specialised agents and subagents, Cyber MCP with SSO, an AI API Gateway and token optimisation strategies. Markdown-first procedures, data governance controls, audits, approvals and human oversight underpin a ~5x increase in security engineering and operational delivery.
Explore the architecture External linkBuilt in-house at Shell as part of the global vulnerability-management mission. Brought discovery and risk assessment together, shared the approach at Splunk .confGO Netherlands, and influenced a Splunk product feature through direct engineering engagement.
Read the presentation External linkProfessional experience, delivered through a terminal interface for agent-friendly access. The same person behind this page, with fewer pixels.
View the repository External linkA collection of practical tooling covering Infoblox Grid, Exchange permissions, FireEye HX, Yahoo Finance and more. Built from a hands-on engineering background and a healthy reluctance to repeat manual work.
Browse the repositories External linkAutomates ownership tagging, lets owners contest assignments, detects affected stacks and sends owners a suggested one-line patch. Replaces at least two internal ServiceNow tools valued together at €100,000 per year.
Select a project to explore the work.
03 / The working toolkit
Leadership, people and communication first. Security, engineering and cloud expertise to put decisions into practice.
Scroll down to explore, or swipe sideways.
Leading IT and OT security teams, aligning technical decisions with shared goals.
Coaching direct reports, contractors and managed service partners, with annual peer feedback.
Sharing security engineering work at Splunk .conf21, .confGO Netherlands and Integrate 2019.
Security roadmaps, stakeholder management, architecture decisions and vendor assessments grounded in business risk.
Threat hunting, STRIDE modeling, intelligence-led SPL and KQL detections, and incident response playbooks.
Risk-based vulnerability management, endpoint security and offensive testing across IT and OT.
Enterprise agents, Cyber MCP and identity-first SOC automation, with review gates and human oversight.
C#, PowerShell and Bash for secure applications, API testing and security workflow automation.
Azure architecture, PaaS hardening and multi-cloud posture management with Wiz.
SQL Server, Databricks and security data pipelines, with enterprise messaging and SIEM integrations.
04 / Evidence, not adjectives
A few outcomes worth putting a number on. The context matters as much as the headline.
~5x
At SKF, the Agentic SOC platform combined identity-first architecture, specialised agents, an internal Cyber MCP and documented procedures. Security engineering and operational delivery increased by ~5x.
See the platform External linkv4
My current vulnerability-prioritisation work uses CVSS v4 alongside exploitability, business impact and operational trade-offs to focus remediation where it matters.
~$500k
Delivered roughly 500,000 USD in annual savings through serverless architecture, lower-cost integration and messaging solutions, and product selection. Today, lower token consumption and AI-driven automation carry that cost discipline forward.
2x
CIO Awarded. Recognised twice for detecting material cyber risk and preventing ransomware-like opportunities. Hands-on threat hunting and investigation that surfaced weaknesses in security controls.
~350k
Led vulnerability management for roughly 350,000 IT and OT devices. Built an internal discovery and risk-assessment platform and presented the work publicly at Splunk .confGO Netherlands.
Read the discovery presentation External link2019
Pitched the first version of an AI chatbot for SOC operations at Integrate 2019 in London. Built around C#, Bot Framework, Microsoft LUIS and Azure integration services. The curiosity started well before the current wave.
05 / Experience
SKF AB group
Head of SOC for IT and OT across roughly 20 factories. Leading detection, response, intelligence, hunting, vulnerability management, offensive security and platform engineering. Shipped the Agentic SOC platform and internal Cyber MCP; security engineering and operational delivery increased by ~5x.
Shell plc
Led SOC cyber architecture for group IRM and ERP, protecting 10+ cloud tenants. Defined threat models, default security controls and architecture roadmaps across SIEM, SOAR, EDR, vulnerability management, IAM and cloud posture. Delivered multiple six-figure savings through architecture changes.
Shell plc
Led global SOC vulnerability management from discovery to remediation and reporting. Automated the end-to-end process and reduced critical attack surface by 99%. Built an internal Shodan-like search engine for IT and OT devices at scale.
Shell plc
Delivered the global SOC team’s ML, AI and NLP strategy. Pitched an AI chatbot for SOC operations at Integrate 2019 in London, using C#, Bot Framework, Microsoft LUIS and Azure services. Before ChatGPT became a meeting agenda item.
Shell plc
Investigated unknown threats and gaps in security controls using SIEM detections, threat intelligence and incident evidence. Found two threats that prevented ransomware opportunities; recognised by the Shell Group CIO.
SIA, Indra group
Red-team and offensive security work across Active Directory, web applications and perimeter security. Obtained Domain Admin privileges during a red-team assignment for a large Spanish bank.
Shell plc
Architected, developed and distributed Microsoft SQL Server and C# applications. Built a C# integration application and BI solution rolled out across northern Latin America.
06 / Education & credentials
Oct 2013 – Jul 2014
Universidad Europea
Madrid, Spain
Published dissertation · 85.60/100
View dissertation External linkJan 2007 – Dec 2011
Universidad Tecnologica del Centro UNITEC
Valencia, Venezuela
Cum Laude · #1 Honour Roll · 87.17/100 · EU officially accredited
07 / Microsoft certifications
These certifications have been critical to my success in cyber. They give me a structured foundation for architecture and security decisions.
I apply that foundation to translate complex risk into clear choices, from cloud design to day-to-day security operations.
Holder since 2017
Verify credential External linkAzure architecture credential, backed by hands-on cloud integration and security engineering.
Holder since 2022
Verify credential External linkCybersecurity architecture credential, supporting a career designing and operating enterprise security systems.
A good conversation is a useful start
Technical CISO, Security Operations Manager, Security Applied-AI Manager. Let’s talk about these roles and the teams you want to build.
I lead cybersecurity teams and build the systems that help them do their best work.
Willing to relocate to the United Kingdom (UK), United Arab Emirates (UAE), or Spain.