# Daniel Ferreira Cyber Security — Expert. AI harness engineer. Cybersecurity operations leader · Software engineer · Security architect · AI harness engineer I lead cybersecurity teams and build the systems that help them do their best work. The Hague, Netherlands Leading Cyber Security Operations at SKF 18+ years of engineering, architecture and getting things shipped. Today: leading IT and OT security operations, applying agentic AI to detection and response, and developing the teams behind them. [Daniel Ferreira \| Cybersecurity Leader, SOC & Applied AI](https://daniel.ferreira.fm/) ## 01 / The person behind the work Serious about the work. I’m Daniel, a cybersecurity leader with a software engineer’s instinct to build. When writing code by hand was relevant, I was very good at SQL Server databases, C# .NET, Splunk SPL and Microsoft KQL. My engineering foundation spans big-data architectures for cyber, Databricks and messaging integrations. Currently at SKF, I head the **Security Operations Centre (SOC)** for IT and OT across roughly **20 factories**. My teams cover detection engineering, incident response, threat intelligence, threat hunting, vulnerability management, offensive security and platform engineering. I stay close to the code, coach my teams and turn technical risk into clear decisions. Curious by default. Hands-on by choice. Absolutely passionate about talent development. Contagious energy. Spain / EU citizenship · English & Spanish ### The short version Security leader. Engineer at heart. **What keeps me curious** - Agentic AI - Security architecture - Useful automation - Coaching people - Building things that work Still hands-on. Still learning. - **18+** — Years of professional experience - **12+** — Years in cybersecurity - **~5x** — Output Engineer - **3 FTEs** — +15 indirect reports ## 02 / Selected work Built for the real world. Security platforms, useful tooling and one CV that prefers a terminal. A few things I’ve built and shared. ### Agentic SOC platform AI / Security operations 24/7 AI-enabled SOC operations, delivered to every engineer in the SOC. **Massive productivity hike.** Shipped at SKF: identity-first, password-less architecture with specialised agents and subagents, Cyber MCP with SSO, an AI API Gateway and token **optimisation** strategies. Markdown-first procedures, data governance controls, audits, approvals and human oversight underpin a ~5x increase in security engineering and operational delivery. OpenCode · MCP · Azure Foundry · OpenAI / Anthropic · SSO [Explore the architecture](https://cv-daniel.ferreira.fm/portfolio-agentic-SOC.html) ### An internal Shodan-like engine Before the patch is out, search the whole network “like Google”. A search and risk-assessment platform for discovering IT and OT devices at scale. Built in-house at Shell as part of the global vulnerability-management mission. Brought discovery and risk assessment together, shared the approach at Splunk .confGO Netherlands, and influenced a Splunk product feature through direct engineering engagement. Splunk · SPL · IT / OT · Security metadata [Read the presentation](https://github.com/daniel0x00/splunk.conf-keynotes/blob/91b0886a7b179cf2d63827b7fa81ddb05ae5f237/Splunk%20.confGO%202022%20Hilversum%20-%20Your%20META%28DATA%29%20is%20QUEEN%20for%20Cyber-Security%20Vulnerability%20Management.pdf) ### A CV for the command line Developer tooling / Personal project A terminal-based CV that agents can consume and interact with through the command line. Professional experience, delivered through a terminal interface for agent-friendly access. The same person behind this page, with fewer pixels. Terminal UI · Command line · Agent interaction [View the repository](https://github.com/daniel0x00/tui-cv) ### PowerShell, put to work Automation / Published tooling Published packages and code for the recurring jobs that deserve a script. A collection of practical tooling covering Infoblox Grid, Exchange permissions, FireEye HX, Yahoo Finance and more. Built from a hands-on engineering background and a healthy reluctance to repeat manual work. PowerShell · Infoblox Grid · Exchange · FireEye HX [Browse the repositories](https://github.com/daniel0x00?tab=repositories) ### End-to-end vulnerability & response automation Security / Response automation From affected-stack detection to ownership and a suggested fix. Automates ownership tagging, lets owners contest assignments, detects affected stacks and sends owners a suggested **one-line patch**. Replaces at least two internal ServiceNow tools valued together at **€100,000 per year**. Ownership tagging · Stack detection · Patch suggestions ## 03 / The working toolkit The periodic table of getting things done. Leadership, people and communication first. Security, engineering and cloud expertise to put decisions into practice. - **Leadership** — Leadership & management: Leading IT and OT security teams, aligning technical decisions with shared goals. - **People management** — Leadership & management: Coaching direct reports, contractors and managed service partners, with annual peer feedback. - **Public speaking** — Leadership & management: Sharing security engineering work at Splunk .conf21, .confGO Netherlands and Integrate 2019. - **Security strategy** — Security: Security roadmaps, stakeholder management, architecture decisions and vendor assessments grounded in business risk. - **Detection & response** — Security: Threat hunting, STRIDE modeling, intelligence-led SPL and KQL detections, and incident response playbooks. - **Attack surface** — Security: Risk-based vulnerability management, endpoint security and offensive testing across IT and OT. - **Agentic AI** — AI & engineering: Enterprise agents, Cyber MCP and identity-first SOC automation, with review gates and human oversight. - **Software & automation** — AI & engineering: C#, PowerShell and Bash for secure applications, API testing and security workflow automation. - **Cloud security** — Cloud & data: Azure architecture, PaaS hardening and multi-cloud posture management with Wiz. - **Data & integration** — Cloud & data: SQL Server, Databricks and security data pipelines, with enterprise messaging and SIEM integrations. ## 04 / Evidence, not adjectives Achievements. Beyond the job title. A few outcomes worth putting a number on. The context matters as much as the headline. ### Engineer. Empowered by AI. **~5x** — Security engineering & delivery increase At SKF, the Agentic SOC platform combined identity-first architecture, specialised agents, an internal Cyber MCP and documented procedures. Security engineering and operational delivery increased by ~5x. [See the platform](https://cv-daniel.ferreira.fm/portfolio-agentic-SOC.html) ### Vulnerability prioritisation. **v4** — CVSS My current vulnerability-prioritisation work uses CVSS v4 alongside exploitability, business impact and operational trade-offs to focus remediation where it matters. ### Delivered in savings, per year. **~$500k** — USD saved per year Delivered roughly 500,000 USD in annual savings through serverless architecture, lower-cost integration and messaging solutions, and product selection. Today, lower token consumption and AI-driven automation carry that cost discipline forward. ### Finding what needed to be found **2x** — Shell Group CIO Award winner **CIO Awarded.** Recognised twice for detecting material cyber risk and preventing ransomware-like opportunities. Hands-on threat hunting and investigation that surfaced weaknesses in security controls. ### Vulnerability management at scale **~350k** — IT & OT devices in scope Led vulnerability management for roughly 350,000 IT and OT devices. Built an internal discovery and risk-assessment platform and presented the work publicly at Splunk .confGO Netherlands. [Read the discovery presentation](https://github.com/daniel0x00/splunk.conf-keynotes/blob/91b0886a7b179cf2d63827b7fa81ddb05ae5f237/Splunk%20.confGO%202022%20Hilversum%20-%20Your%20META%28DATA%29%20is%20QUEEN%20for%20Cyber-Security%20Vulnerability%20Management.pdf) ### An early conversation with AI **2019** — AI chatbot for SOC operations pitched Pitched the first version of an AI chatbot for SOC operations at Integrate 2019 in London. Built around C#, Bot Framework, Microsoft LUIS and Azure integration services. The curiosity started well before the current wave. ## 05 / Experience A career in making it work. ### Head of Cyber Security Operations SKF AB group · The Hague, Netherlands Nov 2025 – present Head of SOC for IT and OT across roughly 20 factories. Leading detection, response, intelligence, hunting, vulnerability management, offensive security and platform engineering. Shipped the Agentic SOC platform and internal Cyber MCP; security engineering and operational delivery increased by ~5x. ### Lead Cyber Security Architect Shell plc · The Hague, Netherlands Apr 2023 – May 2025 Led SOC cyber architecture for group IRM and ERP, protecting 10+ cloud tenants. Defined threat models, default security controls and architecture roadmaps across SIEM, SOAR, EDR, vulnerability management, IAM and cloud posture. Delivered multiple six-figure savings through architecture changes. ### Lead Cyber Security Vulnerability Analyst Shell plc · The Hague, Netherlands Apr 2020 – Apr 2023 Led global SOC vulnerability management from discovery to remediation and reporting. Automated the end-to-end process and reduced critical attack surface by 99%. Built an internal Shodan-like search engine for IT and OT devices at scale. ### Senior Cyber Security Data Scientist Shell plc · The Hague, Netherlands Jun 2019 – Apr 2020 Delivered the global SOC team’s ML, AI and NLP strategy. Pitched an AI chatbot for SOC operations at Integrate 2019 in London, using C#, Bot Framework, Microsoft LUIS and Azure services. Before ChatGPT became a meeting agenda item. ### Cyber Security Threat Hunter Shell plc · The Hague, Netherlands Nov 2016 – Jun 2019 Investigated unknown threats and gaps in security controls using SIEM detections, threat intelligence and incident evidence. Found two threats that prevented ransomware opportunities; recognised by the Shell Group CIO. ### Senior Cyber Security Consultant · Pentester / Red Team SIA, Indra group · Madrid, Spain Apr 2016 – Jul 2016 Red-team and offensive security work across Active Directory, web applications and perimeter security. Obtained Domain Admin privileges during a red-team assignment for a large Spanish bank. ### Database Administrator / Software Developer Shell plc · Valencia, Venezuela Dec 2008 – Feb 2012 Architected, developed and distributed Microsoft SQL Server and C# applications. Built a C# integration application and BI solution rolled out across northern Latin America. ## 06 / Education & credentials The foundations. The ongoing learning. ### Cybersecurity Master’s Degree Universidad Europea · Madrid, Spain 2014 · Oct 2013 – Jul 2014 Published dissertation · 85.60/100 [View dissertation](https://github.com/daniel0x00/r2dr2-udp-drdos-tool) ### Bachelor of Information Technology Universidad Tecnologica del Centro UNITEC · Valencia, Venezuela 2011 · Jan 2007 – Dec 2011 Cum Laude · #1 Honour Roll · 87.17/100 · EU officially accredited ## 07 / Microsoft certifications Certified. Applied every day. ### Critical to my cyber career. These certifications have been critical to my success in cyber. They give me a structured foundation for architecture and security decisions. I apply that foundation to translate complex risk into clear choices, from cloud design to day-to-day security operations. ### Microsoft Certified: Azure Solutions Architect Expert Holder since 2017 · Active Azure architecture credential, backed by hands-on cloud integration and security engineering. [Verify credential](https://learn.microsoft.com/api/credentials/share/en-gb/daniel0x00/AC29E0E751C6D24D?sharingId=AE96336F33648BCE) ### Microsoft Certified: Cybersecurity Architect Expert Holder since 2022 · Active Cybersecurity architecture credential, supporting a career designing and operating enterprise security systems. [Verify credential](https://learn.microsoft.com/api/credentials/share/en-gb/daniel0x00/6E4E954136076FE?sharingId=AE96336F33648BCE) ## Contact A good conversation is a useful start Something worth building? Technical CISO, Security Operations Manager, Security Applied-AI Manager. Let’s talk about these roles and the teams you want to build. Willing to relocate to the United Kingdom (UK), United Arab Emirates (UAE), or Spain. [gourd-farrier.6p@icloud.com](mailto:gourd-farrier.6p@icloud.com) This email is a privacy relay and may change over time. Your message reaches me; expect a reply from my real address ending in @ferreira.fm. [LinkedIn](https://www.linkedin.com/in/daferreira/) [GitHub](https://github.com/daniel0x00) [Download CV · PDF](https://daniel.ferreira.fm/assets/D.A.Ferreira.pdf) The HTML and Markdown share one editorial source. The supplied PDF is an earlier edition and may not contain the latest website updates. [AI agent guide](https://daniel.ferreira.fm/agents.md)