Open to work
Eduardo Olivares Hernández
I investigate alerts and automate the response.
Cybersecurity Analyst · SOC · Cloud Security & IAM · Email & Collaboration Security · AI Security & LLM Red Teaming
Cybersecurity analyst at Dagram: alert triage in Trend Micro Vision One, Python report automation and identity and access management support. My focus is cloud security and IAM, with AI security running through both.
whoami
Cybersecurity Analyst · SOC · Cloud Security & IAM · Email & Collaboration Security · AI Security & LLM Red Teaming
stack
Trend Micro Vision One · Fortinet · Python · IAM
pwd
Badalona, Barcelona (Spain) · Spanish · Catalan · English B2
Edu Olivares
SOC · Cloud · IAM · AI
- SOC
- Cloud
- IAM
- AI Sec
triage flow
- Logs FortiGate · FortiAnalyzer · email
- XDR Trend Micro Vision One
- Triage Validate and prioritise with AI
- Response Contain, escalate and document
- Cloud Security
- Security Awareness (SAT)
- Phishing Simulation
- AI Security
- LLM Red Teaming
- Prompt Injection
- OWASP Top 10 for LLM Apps
- MITRE ATLAS
- NIST AI RMF
- OWASP
- Penetration Testing
- Red Teaming
- Web Application Security
- Threat Detection
- Incident Response
- XDR / SIEM
01 / Background
Experience
Professional background in cybersecurity and systems
-
Dagram
Jan 2026 - Present
Cybersecurity Analyst
CurrentApr 2026 - Present
Daily triage of Trend Micro Vision One (TrendAI) alerts, using AI to speed up investigations. I automated the threat, vulnerability and monthly reports in Python: work that used to take weeks by hand now runs in under 1 hour. I design and run the phishing simulation campaigns and the security awareness training (SAT) program, support identity and access management (onboarding, offboarding and access reviews), and contain and remediate confirmed threats, with SOPs and compliance documentation ready for audits.
- Trend Micro Vision One
- XDR/SIEM
- Python
- IAM
- Email Security
- Phishing Simulation / SAT
- Threat Intelligence
Cybersecurity Technician (L1/L2)
Jan 2026 - Apr 2026
Configured and managed FortiGate firewalls and FortiAnalyzer for centralized network security across client environments. Built custom Python scripts for automated security reporting and log analysis, increasing SOC operational efficiency. Implemented security policies and executed incident response protocols in corporate environments. That work is what got me moved up to Cybersecurity Analyst four months in.
- FortiGate
- FortiAnalyzer
- Python
- Incident Response
- Log Analysis
-
IT Technician
Institució Cultural Laietània
Oct 2024 - Apr 2025
Technical support for 100+ users, resolving most issues in under 24 hours. Managed Active Directory and the LAN. Wrote Python scripts to get repetitive tasks off my plate.
- Active Directory
- Python
- Windows Server
- Help Desk
-
Fitness Instructor
Escola del Vent
May 2024 - Sep 2024
Led groups of up to 13 people through high-intensity sessions. Learned to make fast calls when something goes wrong and to explain the same thing three different ways depending on who is listening, something I use every day writing security reports for technical and non-technical readers.
- Liderazgo
- Comunicación
- Gestión de personas
02 / Tech stack
Technologies and areas of expertise
- Cloud Security
- Threat Detection
- Machine Learning
- Next.js
- LLM Red Teaming
- JavaScript
- Windows Server
- Email & Collaboration Security
- XDR / SIEM
- ONNX
- SQLite
- OWASP Top 10 for LLM Apps
- Rust
- Redes
- Phishing Simulation
- Trend Micro Vision One
- Firewalls
- NIST AI RMF
- Bash
- Vulnerability Management
- Criptografía
- Análisis de Phishing
- AI Security
- Python
- Active Directory
- Identity & Access Management (IAM)
- Incident Response
- Prompt Engineering
- Tailwind CSS
- Prompt Injection
- TypeScript
- Linux
- Security Awareness (SAT)
- Threat Intelligence
- Azure AI
- Git
- MITRE ATLAS
- SQL
- Chrome Extensions
- Fortinet (FortiGate/FortiAnalyzer)
- OWASP
- Penetration Testing
- Red Teaming
- Web Application Security
All skills
Cloud, Identity & Email
- Cloud Security
- Identity & Access Management (IAM)
- Email & Collaboration Security
- Security Awareness (SAT)
- Phishing Simulation
AI Security & Red Teaming
- AI Security
- LLM Red Teaming
- Prompt Injection
- OWASP Top 10 for LLM Apps
- MITRE ATLAS
- NIST AI RMF
- OWASP
- Penetration Testing
- Red Teaming
- Web Application Security
Security & Blue Team
- Threat Detection
- Incident Response
- XDR / SIEM
- Threat Intelligence
- Trend Micro Vision One
- Fortinet (FortiGate/FortiAnalyzer)
- Vulnerability Management
- Criptografía
- Análisis de Phishing
Languages & Development
- Python
- JavaScript
- TypeScript
- Rust
- SQL
- Bash
AI & Data
- Machine Learning
- Prompt Engineering
- ONNX
- Azure AI
Systems & Networking
- Active Directory
- Windows Server
- Linux
- Redes
- Firewalls
Web & Tooling
- Next.js
- Tailwind CSS
- SQLite
- Git
- Chrome Extensions
03 / Portfolio
Projects
Selected technical work and personal projects
Loading projects...
llm-chatbot-pentest
Autonomous red teaming of LLM chatbots: fingerprints the target, generates payloads mapped to the OWASP Top 10 for LLM Applications and scores them with an independent judge model. Will not run without explicit authorization and a defined scope. CLI and web dashboard.
- Python
- OWASP LLM Top 10
- PyRIT
- Red Teaming
PhishLab — Phishing Template Library
<p>Internal tool I use to prepare security-awareness exercises: every template is composed from annotated blocks and calibrated across six independent detection signals (urgency, typos, generic greeting, sender domain, mismatched link, brand inconsistency), so the final report can say exactly which signal a given person missed, not just whether they clicked.</p><p>Guided 4-step wizard (email, landing, branding, export), a library filterable by signal, company or category, and import of real captured material (.eml or pasted HTML), sanitized automatically before saving.</p><p>What you see here is the public demo: fictional brands, no export. The full tool (real brands, GoPhish export) is available on request -- reach out if you would like to try it for real.</p>
- JavaScript
- ES Modules
- Node.js
- GoPhish
phishing-triage
Measures over 7,822 real emails whether disagreement between 4 classifiers helps prioritize which email an analyst reviews first. The result was not the expected one: it loses against a simpler signal, the ensemble's own mean uncertainty.
- Python
- scikit-learn
kev-digest
Automated CISA KEV catalog monitoring: checks every three hours which vulnerabilities have confirmed active exploitation, flags known ransomware use, and keeps a versioned Markdown log. Dependency-free Python on GitHub Actions.
- Python
- GitHub Actions
CREM Report Generator
Python engine that automates monthly security reports over Trend Micro Vision One, with CVE enrichment (NVD, CISA KEV, EPSS) and a desktop dashboard.
- Python
- Flask
- PyQt6
Blue Team Hub
Cybersecurity toolkit for SOC analysts: IOC defanger, YARA rule generator, interactive incident-response playbooks, and automated CISA KEV catalog monitoring.
- Astro
- Tailwind CSS
- TypeScript
- GitHub Actions
NorthGate Browser
Browser (Mullvad/Firefox fork) with an on-device phishing classifier in ONNX/Rust. Early stage.
- Rust
- ONNX
- Firefox
- Machine Learning
BinCat
Secure token management system in Python using Fernet encryption and SQLite storage.
- Python
- Cryptography (Fernet)
- SQLite
Dewi App
Award-winning web prototype (8th TecnoCampus Hackathon) to monitor water consumption in real time.
- Next.js
- TypeScript
- Tailwind CSS
BadaVeu
GovTech PWA for citizen participation and urban incident management in Badalona.
- TypeScript
- PWA
Chess Copilot
Chrome extension that analyzes chess.com games with Stockfish 16 in WebAssembly and shows the best moves in the native side panel. Fully local, no backend or telemetry; built for practice and analysis, not rated games.
- JavaScript
- Stockfish
- WebAssembly
- Chrome Extension
Password Centinel
Fully local password manager for Chrome: AES-256-GCM encryption, built-in TOTP/2FA and breach checking via Have I Been Pwned, without sending data to any first-party server.
- JavaScript
- Chrome Extension
- Have I Been Pwned API
NoWait
Browser extension that automatically bypasses link-shortener wait screens and blocks IP loggers. 90+ site-specific bypasses, injected only where they're actually needed.
- JavaScript
- Chrome Extension
- Manifest V3
PromptMaster Universal AI
Chrome extension that optimizes your prompts for ChatGPT, Claude and Gemini.
- JavaScript
- Chrome Extension
- Prompt Engineering
04 / Credentials
Certifications
Training and verified credentials
Loading certifications...
06 / Frequently asked
Frequently asked questions
What people usually ask before reaching out
Who is Eduardo Olivares?
Eduardo Olivares Hernández is a cybersecurity analyst in Barcelona, Spain, focused on cloud security, identity and access management (IAM) and email and collaboration security. He works at Dagram, where he triages alerts in Trend Micro Vision One, automates security reporting with Python and supports IAM work. He also works on AI security (LLM chatbot red teaming). He holds certifications from Trend Micro, Fortinet and Microsoft.
What experience does Eduardo Olivares have in cloud security and IAM?
He holds the Trend Micro Vision One Cloud Security, Identity Security and Email & Collaboration Security Foundation certifications. At Dagram he supports identity and access management (onboarding, offboarding and access reviews) and runs the phishing simulation campaigns and the security awareness program. Cloud security and IAM is the area he is specializing in.
Where is Eduardo Olivares based? Does he work in Barcelona or remotely?
He works in Barcelona and lives in Badalona, in the Barcelona metropolitan area. He is open to on-site or hybrid roles in Barcelona and to remote work.
What experience does Eduardo Olivares have in AI security and LLM red teaming?
He approaches AI security from both sides. Offensively, he built llm-chatbot-pentest, an open-source tool for autonomous red teaming of LLM chatbots: it fingerprints the target, generates payloads mapped to the OWASP Top 10 for LLM Applications, scores them with an independent judge model, and will not run without explicit authorization and a defined scope. Defensively, he works on the AI risks that reach a SOC: prompt injection, data leakage through AI assistants, shadow AI and the permissions handed to AI agents. His references are the OWASP Top 10 for LLM Applications, MITRE ATLAS and NIST AI RMF.
What does Eduardo Olivares study and where does he want to go professionally?
He is finishing an Associate Degree in Network Systems Administration with a Cybersecurity track (expected 2027) at Col·legi Cultural, and then plans to study Computer Engineering. Long term, he wants to specialize in cloud security and IAM, with AI security running through both, and eventually lead a security team.
What does a SOC analyst actually do?
A SOC (Security Operations Center) analyst continuously monitors an organisation’s systems to detect attacks. Day to day that means triaging alerts from XDR and SIEM platforms, investigating which ones are real threats, containing incidents and documenting what happened so it does not repeat.
Which security technologies and tools does he work with?
Day to day: Trend Micro Vision One (XDR), Fortinet FortiGate and FortiAnalyzer, Threat Intelligence feeds and Active Directory. He automates reporting with Python: the threat, vulnerability and monthly reports that used to take weeks of manual work now run in under 1 hour. He also applies AI to threat analysis and phishing detection.
What cybersecurity certifications does he hold?
In Trend Micro Vision One he holds the Cloud Security, Identity Security, Email & Collaboration Security, SecOps, AI Security and Threat Intelligence Foundation certifications, plus Platform Advanced. From Fortinet, NSE 3 and FortiGate 7.6 Operator; from Microsoft, Azure AI Fundamentals (AI-900). The full, verifiable list is in the certifications section of this site.
Is he available for new job opportunities?
If he is open to offers, a green "Open to work" badge appears next to his photo on the home page. The fastest way to reach him is the contact form on this site or LinkedIn; he usually replies within 48 hours.
Which languages does he work in?
Spanish and Catalan as native languages, and English at B2 level, enough for technical documentation, reports and meetings with international teams. This site is available in all three languages.
How can I get in touch?
Through the contact form on this site, by email at eduardo@eduolihez.com, or via his LinkedIn profile. You can also download his contact card (vCard) from the contact section.
07 / Get in touch
Contact
I'm open to Cloud Security, IAM, email security and AI security roles, in Barcelona or remote. Let's talk.