Octavio Santacruz
ESEN

Octavio SantacruzCybersecurity Engineer

Security you can operate.

Identity, access and automation. From operations to code.

See my projectsLet's talk

In progress

Projects I’m working on

Running on my own infrastructure

Switchboard

Your apps. Your access rules.

A front door for self-hosted applications. Identify the person, check the policy and explain every access decision, from the public edge to a service at home.

Explore Switchboard
  • Go
  • Passkeys
  • Policies
  • Tunnels

Access that understands context

Anaallow · group:admins
Asunción 09:028,600 km · 12 minMadrid 09:14
impossible travelstep-up: fresh passkey + confirm on phone
$ sb ssh db-prodleo has no standing access · request sentapproved for 1 h by octavio · session recorded59:59expires on its own
Why was Ana asked to sign in again?

She appeared in Madrid 12 minutes after Asunción. Policy admins-strict requires a fresh passkey on impossible travel; she confirmed on her phone.

#48213 in the transparency log · inclusion verified ✓

ana identify ✓ → authorize allow → tunnel → homeana signal impossible_travel → step-up → confirmedleo jit db-prod 1h → approved → expires 10:14audit verify → nothing rewritten

Today: the app sits behind Switchboard. Ana authenticates with her passkey, the policy lets her in and the app opens through the tunnel home.

Illustrative sequence · fictional data
Today
Passkeys, route policies, static sites and an outbound homelab tunnel run on my own edge.
What’s next
Let applications verify the identity from Switchboard, starting with Custodia.

Public demo with a fictional company

Custodia

A bridge between your security tools.

DLP with EDR, PAM with a scanner, DSPM with DLP, IAM with everything. Each bridge answers a question no single tool can, toward a 360° view of people, devices, servers and data.

Explore the siteOpen the live demo
  • React
  • TypeScript
  • Correlation
  • Go planned

Every tool, correlated through Custodia

01 / 06 · Devices
  • DLalice · 2.1 GB upload
  • EDALICE-LT01 · no agent

Alice moves data from a laptop no agent protects.

  • Coverage
  • UEBA
  • Behaviour
02 / 06 · Servers
  • PAdb-07 · 3 local admins
  • VUdb-07 · weak password

db-07 has privileged accounts outside the vault, one with a guessable password.

  • Reach
  • Accounts
  • Weak passwords
03 / 06 · Vulns
  • CLweb-02 · internet-facing
  • VUweb-02 · CVE-2021-41773

web-02 is exposed and vulnerable: fix it first.

  • Cloud context
  • Host evidence
  • Priority
04 / 06 · Data
  • DSfinance/ · card numbers
  • DLpayroll.xlsx · leaving

Sensitive data found at rest is the same data leaving in motion.

  • At rest
  • In motion
  • Leak
05 / 06 · Web
  • CLapi.acme · public
  • WAapi.acme · 1.2k probes/day

A public API probed every day, with its owner and exposure in one view.

  • Exposure
  • Browsing
  • Patterns
06 / 06 · Identity
  • IDcarol · offboarded
  • ∗carol · active in PAM, SSE

Carol left in May; two tools still let her in.

  • Who
  • To what
  • 360 view

DLP and EDR together give coverage, user behaviour and a digital x-ray of each person.

Illustrative sequence · fictional data
Today
An interactive Acme Corp demo with synthetic CyberArk and Netskope records. No live tool is connected.
What’s next
More bridges, each with an explicit integration contract, verified access through Switchboard and a Go backend.

Rebuilding for a self-hosted pilot

SIGEA

An open scanner, built to rival OpenVAS.

Scan the ports, map each service to its CPE through the NVD API and let probes confirm every candidate before it becomes a finding. Fewer false positives, and evidence behind every vulnerability.

Follow the SIGEA devlog
  • Go
  • NVD · CPE
  • Probes
  • Evidence

Only what a probe confirms is reported

192.0.2.14:443opensigea.apache-httpd.detect → Apache HTTP Server 2.4.49
NVD APIcpe:2.3:a:apache:http_server:2.4.49
  • CVE-2021-41773candidate
  • CVE-2021-42013candidate
  • CVE-2021-41524candidate
  • CVE-2021-41773Confirmedprobe sigea.apache-httpd.cve-2021-41773 · evidence saved
  • CVE-2021-42013Inconclusiveneeds a known configuration
  • CVE-2021-41524Not affectedHTTP/2 not enabled
Reported: 1 vulnerability. 2 stay out of the report.
Next
  1. Internet
  2. web-02CVE-2021-41773 · confirmed
  3. db-07reachable from web-02
  4. payrollsensitive data
Built only from confirmed findings and verified reachability.

The agent finds an open port and a detector reads the banner: Apache HTTP Server 2.4.49.

Illustrative sequence · fictional data
Today
Agent, scans, inventory and change history work end to end in alpha. CPE matching and probes are in progress.
What’s next
Confirm CVE candidates with open probes that the community can write and maintain.

Experience

Enterprise security, hands on

  • 40+companies covered by enterprise security implementations
  • 20+companies onboarded to CyberArk PSM governance
  • 5+security operations workflows automated

Sep 2025 - Present

Security Operations Engineer

ITTI - Grupo Vazquez · Asuncion, Paraguay

  • Led the end-to-end reimplementation of CyberArk PAM across 40+ companies, migrating nominal accounts from Privilege Cloud to Secure Infrastructure Access and improving license utilization.
  • Deployed CyberArk PSM across 20+ companies, enabling centralized session recording and privileged session governance at enterprise scale.
  • Implemented BigID for sensitive-data discovery and classification across multiple environments, supporting GDPR-aligned governance.
  • Tuned Netskope DLP policies per business unit to improve detection accuracy and reduce false positives.
  • Built Netskope and BigID behavioral-analytics workflows that surfaced anomalous data-access patterns for internal fraud investigations.
  • CyberArk
  • BigID
  • Netskope
  • PAM
  • DLP

May 2024 - Sep 2025

Information Security Engineer

Personal Paraguay · Asuncion, Paraguay

  • Led internal penetration testing and coordinated vulnerability remediation across 40+ production servers.
  • Designed a structured vulnerability-management process integrated with asset inventory and IAM controls.
  • Automated 5+ recurring security operations tasks using Ansible and custom scripts, reducing manual effort across the team.
  • Pentesting
  • Vulnerability Management
  • Ansible
  • IAM

Jul 2023 - May 2024

Cybersecurity Analyst

NEST Security · Asuncion, Paraguay

  • Promoted from intern to full-time analyst after delivering vulnerability assessments supporting red-team exercises and defensive control improvements.
  • Vulnerability Assessment
  • Red Team Support

Profile

How I work

I work across security operations, privileged access, data protection, and vulnerability management, connecting offensive testing with defensive engineering.

My recent work includes enterprise-scale implementations across 40+ companies: CyberArk PAM and PSM, BigID data discovery, Netskope DLP governance, vulnerability remediation, and security automation.

  • Security Operations
  • Privileged Access Management
  • Identity & Access Management
  • Data Protection
  • Vulnerability Management
  • Security Automation
  • Internal Penetration Testing
  • MITRE ATT&CK

Credentials

Certifications

Education

Education

B.Eng. Computer Science

Taiwan-Paraguay Polytechnic University (UPTP), Asuncion. Completed 15 months of full-time coursework in Taiwan through a merit-based academic exchange.

Contact

Opportunities and collaboration

Let's talk about professional opportunities, projects and security challenges in identity, privileged access, data protection and automation.