Daniel Ferreira · The Hague, Netherlands
AI harness engineer.
18+ years of engineering, architecture and getting things shipped. Today: leading IT and OT security operations, building agentic AI systems, and making the repetitive work less repetitive.
Explore the work01 / The person behind the work
I’m Daniel, a cybersecurity leader with a software engineer’s instinct to build. My career runs from C# applications and databases in Latin America to global security architecture and AI-enabled operations in the Netherlands.
At SKF, I head Cyber Security Operations for IT and OT across roughly 20 factories. I lead teams spanning detection engineering, incident response, threat intelligence, threat hunting, vulnerability management, offensive security and platform engineering.
I stay close to the code, coach the people doing the work, and translate technical risk into decisions people can act on. Curious by default. Hands-on by choice. Meetings with a purpose, ideally.
Spain / EU citizenship · English & Spanish
A little more about me
02 / Selected work
Security platforms, useful tooling and one CV that prefers a terminal. A few things I’ve built and shared.
Designed and shipped at SKF with specialised agents and subagents, an internal Cyber MCP with SSO, and markdown-first operating procedures. Fully audited, with approval flows and human oversight. Security engineering and operational delivery increased by ~5x.
Explore the architecture External linkBuilt in-house at Shell as part of the global vulnerability-management mission. Brought discovery and risk assessment together, shared the approach at Splunk .confGO Netherlands, and influenced a Splunk product feature through direct engineering engagement.
Read the presentation External linkProfessional experience, delivered through a terminal interface for agent-friendly access. The same person behind this page, with fewer pixels.
View the repository External linkA collection of practical tooling covering Infoblox Grid, Exchange permissions, FireEye HX, Yahoo Finance and more. Built from a hands-on engineering background and a healthy reluctance to repeat manual work.
Browse the repositories External linkSelect a project to explore the work.
03 / The working toolkit
A working toolkit, built through delivery. From threat hunting to cloud architecture, with engineering underneath it all.
Threat hunting, STRIDE modeling and ATT&CK-informed detections. Turning threat intelligence into SPL/KQL logic and response playbooks.
Risk-based discovery, prioritisation and remediation across roughly 350,000 IT and OT devices. Delivered a 99% reduction in critical attack surface.
SOC operations, incident playbooks and major cases including WannaCry, log4j and ZeroLogon. Experience with ServiceNow SecOps and endpoint security platforms.
Hands-on Windows and Linux security: EDR, forensics, IoC hunting and automated telemetry collection from tens of thousands of servers.
Red teaming and penetration testing across Active Directory, web applications and perimeter security, supported by reverse engineering and custom tooling.
Enterprise agent and subagent architectures using OpenCode, Claude Code and Codex. Harness engineering with OpenAI and Anthropic models, review gates and human oversight.
Built an internal Cyber MCP with SSO authentication as part of an identity-first, password-less agentic SOC architecture.
Senior development background in C#, with JavaScript, APIs and enterprise integrations. Secure coding and practical attention to performance and availability.
Automation for security operations, exploit validation and telemetry pipelines. Published PowerShell packages for Infoblox, Exchange, FireEye HX and more.
Manual and automated DAST, SAST evidence in deployment checks, and OpenAPI-driven scanning. Worked with engineering teams to scale these practices using Invicti.
Expert-certified in solution and cybersecurity architecture. Hands-on Azure PaaS hardening, logging, monitoring, alerting and response automation.
Led Wiz selection and rollout for CSPM visibility across AWS, Alibaba Cloud, Azure China and Azure. Architecture experience protecting 10+ cloud tenants.
SQL Server, PostgreSQL and large-scale security data pipelines. A database and BI background that keeps cost, performance and availability in view.
SPL and KQL for detections, investigations and security analytics. Experience with Splunk, Microsoft Sentinel and enterprise SIEM architecture.
Service Bus, Kafka, Azure Functions, Logic Apps, API Management and storage. Connecting enterprise systems and automating security workflows.
Leading direct reports, contractors and managed service partners. Hands-on coaching, shared goals and yearly anonymous peer feedback.
Security roadmaps, pragmatic risk decisions, vendor assessments and stakeholder communication up to CIO and CISO level.
Public speaker at Splunk .conf21 and Splunk .confGO Netherlands. Pitched an AI chatbot for SOC operations at Integrate 2019 in London.
Select a skill to read more.
04 / Evidence, not adjectives
A few outcomes worth putting a number on. The context matters as much as the headline.
~5x
At SKF, the Agentic SOC platform combined identity-first architecture, specialised agents, an internal Cyber MCP and documented procedures. Security engineering and operational delivery increased by ~5x.
See the platform External link99%
Automated end-to-end vulnerability management at Shell. Combined exploitability, business impact and operational trade-offs to prioritise remediation and reduce the critical attack surface by 99%.
Read the .conf21 presentation External link~$500k
Shipped production workflows and applications using Azure Logic Apps as a lower-cost replacement for Splunk SOAR Phantom. The architecture change saved roughly 500,000 USD per year.
2x
Recognised twice for detecting material cyber risk and preventing ransomware-like opportunities. Hands-on threat hunting and investigation that surfaced weaknesses in security controls.
~350k
Led vulnerability management for roughly 350,000 IT and OT devices. Built an internal discovery and risk-assessment platform and presented the work publicly at Splunk .confGO Netherlands.
Read the discovery presentation External link2019
Pitched the first version of an AI chatbot for SOC operations at Integrate 2019 in London. Built around C#, Bot Framework, Microsoft LUIS and Azure integration services. The curiosity started well before the current wave.
05 / Experience
SKF AB group
Head of SOC for IT and OT across roughly 20 factories. Leading detection, response, intelligence, hunting, vulnerability management, offensive security and platform engineering. Shipped the Agentic SOC platform and internal Cyber MCP; security engineering and operational delivery increased by ~5x.
Shell plc
Led SOC cyber architecture for group IRM and ERP, protecting 10+ cloud tenants. Defined threat models, default security controls and architecture roadmaps across SIEM, SOAR, EDR, vulnerability management, IAM and cloud posture. Delivered multiple six-figure savings through architecture changes.
Shell plc
Led global SOC vulnerability management from discovery to remediation and reporting. Automated the end-to-end process and reduced critical attack surface by 99%. Built an internal Shodan-like search engine for IT and OT devices at scale.
Shell plc
Delivered the global SOC team’s ML, AI and NLP strategy. Pitched an AI chatbot for SOC operations at Integrate 2019 in London, using C#, Bot Framework, Microsoft LUIS and Azure services. Before ChatGPT became a meeting agenda item.
Shell plc
Investigated unknown threats and gaps in security controls using SIEM detections, threat intelligence and incident evidence. Found two threats that prevented ransomware opportunities; recognised by the Shell Group CIO.
SIA, Indra group
Red-team and offensive security work across Active Directory, web applications and perimeter security. Obtained Domain Admin privileges during a red-team assignment for a large Spanish bank.
Shell plc
Architected, developed and distributed Microsoft SQL Server and C# applications. Built a C# integration application and BI solution rolled out across northern Latin America.
06 / Education & credentials
Oct 2013 – Jul 2014
Universidad Europea
Madrid, Spain
Published dissertation · 85.60/100
View dissertation External linkJan 2007 – Dec 2011
Universidad Tecnologica del Centro UNITEC
Valencia, Venezuela
Cum Laude · #1 Honour Roll · 87.17/100 · EU officially accredited
Azure architecture credential, backed by hands-on cloud integration and security engineering.
Verify credential External linkCybersecurity architecture credential, supporting a career designing and operating enterprise security systems.
Verify credential External linkA good conversation is a useful start
Security operations, agentic AI, architecture or a genuinely interesting problem. Tell me what you’re working on.