Aaron Palacios
I harden, build, and automate the web infrastructure small teams depend on — security from the first assessment to the last deploy.
Cybersecurity is my main field. I assess and harden systems first, then build and automate the web infrastructure small teams rely on — security from the start, not bolted on.
My background spans IT operations, system administration, and security — which means I understand how things break before I build them. I work in Spanish and English across Latin America.
How I work
Frameworks
Engagement details are anonymized to protect client confidentiality.
Challenge
Alert noise buries real threats and drains analyst focus.
Approach
Triaged SOC/NOC alerts by severity and business context, escalated confirmed threats, and turned findings into runbooks.
Outcome
Faster triage, less analyst fatigue.
Challenge
Enterprise EDR deployed but underused.
Approach
Tuned EDR policies, reviewed alerts, and coordinated response across client environments — matched to each org's risk.
Outcome
Better endpoint visibility, faster containment.
Challenge
High social-engineering exposure, no benchmark.
Approach
Ran graduated phishing simulations with immediate, blame-free feedback. Results steered training priorities.
Outcome
Click rates fell across three consecutive cycles.
Challenge
No shared baseline, weak reporting culture.
Approach
Role-based training in plain language, reinforced quarterly. Bilingual delivery (ES/EN).
Outcome
More suspicious-email reports. Security became habit, not a checkbox.
Challenge
Organizations blind to their external exposure.
Approach
Mapped external footprints — leaked credentials, brand abuse, threat indicators — under strict operational security.
Outcome
Visibility into unknown risk, fed into remediation priorities.
Challenge
Digital tools built without security from the start.
Approach
Deployed hardened web infra — strict headers, zero-trust access, CSP. Built AI workflows with controls baked in.
Outcome
A+ on public security benchmarks, no added attack surface.
Brief takes on stories worth your time, each linked to the original source.
Urgency is still the main vector, not the technology.
Moving closer to LGPD; worth reviewing consent.
Continuous training beats the one-off campaign.
Start with habits, not with tools.
Available for freelance — security, web builds, and automation. Reach out and let's talk.