Information Security Engineer designing and operating the security architecture for critical road infrastructure. Came up through networks before moving into security. Most of the work is private — what's here demonstrates the practices behind it.

• Full detection-to-response cycle, backed by Certified CyberDefender L2 and a capstone CTF win at SANS SEC504 (Incident Handling)
• IP network delivered across 4 countries: Qatar, Brazil, Denmark, Norway
• Security infrastructure featured in a Fortinet Customer Story, plus Fortinet CTF wins in 2024, 2025 and 2026
• DevSecOps practice on public projects — zero-trust CI/CD and supply-chain security — running on an edge-computing (Cloudflare Workers) backend — danielmala.co

• Design, deploy and operate security architecture across on-prem and cloud infrastructure: NGFW, AV/EDR, VA, SIEM, IAM, WAF, SEG.
• Run the full detection cycle end to end — control design, detection engineering, incident investigation and response, closing out through ITSM.
• Apply security frameworks (MITRE ATT&CK, CIS Controls, ISO 27001, OWASP Top 10) to structure decisions and prioritize controls, not just to reference them.
• Support internal audits against ISO 27001 and CIS/CISA benchmarks, and, more recently, NIS2.
• Bring an offensive perspective into defensive work — thinking like an attacker shapes how I design and tune detections.
• Build for redundancy, document for whoever comes next, test in staging before touching production — habits from infrastructure where a network failure is not an inconvenience, it's a stopped system.

Security

Network

Detection & analytics

Identity & access

Platforms

Virtualization & storage

Operating systems

Cloud

Containers & DevOps

Frameworks

danielmala.co is the project I keep public, and it's built the way I think infrastructure should be: least privilege by default, with every exception argued for instead of left implicit.

That shows up everywhere in it — a strict Content-Security-Policy with no 'unsafe-inline' clause, zero client-side JavaScript unless a feature genuinely needs it, and tools that call home (a compromised-password check via k-anonymity, a header self-scan) labeled as such instead of pretending to run entirely in the browser. The one piece that does need a server — a honeypot logging automated scanning against decoy endpoints — lives in an isolated Cloudflare Worker, and is designed not to store IP addresses: only country, ASN, and path, keyed by a rotating salted hash. None of this is asserted on faith — the site's Evidence page deep-links the commits, workflows, and a live header scan behind each claim.

Public activity here is a fraction of the work — most of it is internal infrastructure, not public code. The full certification record lives on Credly.