Aaron Palacios
I assess and harden the systems your business runs on, train your people to recognize social engineering, and build secure websites and automations when you need them.
Cybersecurity is my main field. Most engagements start with a review of what you already have: your systems, your accounts, and the people who use them. From there I harden what is exposed, set up monitoring, and close the gaps that matter most to your business.
I come from IT operations and system administration, so I have seen how systems fail in day-to-day use. When a team needs a website, an internal tool, or an automated workflow, I build it with the same controls I would recommend to anyone else. I work in Spanish and English with clients across Latin America.
What I do
Frameworks I work with
Engagement details are anonymized to protect client confidentiality.
Challenge
A high volume of alerts made it hard for analysts to see the threats that mattered.
Approach
I triaged alerts by severity and business context, escalated confirmed threats, and documented recurring findings as runbooks.
Outcome
Triage became faster and more consistent, and analysts spent less time on noise.
Challenge
An enterprise EDR platform was deployed but running mostly on default settings.
Approach
I tuned detection policies, reviewed alerts, and coordinated response across client environments according to each organization's risk.
Outcome
Clients gained clearer endpoint visibility and contained incidents sooner.
Challenge
The organization was highly exposed to social engineering and had no baseline to measure it.
Approach
I ran phishing simulations of increasing difficulty with immediate, blame-free feedback, and used the results to set training priorities.
Outcome
Click rates fell over three consecutive cycles.
Challenge
Staff had no shared baseline, and suspicious emails were rarely reported.
Approach
I delivered role-based training in plain language, in Spanish and English, with quarterly refreshers.
Outcome
Reports of suspicious emails increased, and checking before clicking became routine.
Challenge
Organizations had little visibility into what was exposed about them outside their own network.
Approach
I mapped external footprints, including leaked credentials, brand impersonation, and threat indicators, under strict operational security.
Outcome
Previously unknown exposures were identified and added to remediation priorities.
Challenge
Digital tools were being built quickly, with security left for later.
Approach
I deployed hardened web infrastructure with strict security headers, a content security policy, and zero-trust access, and built AI workflows with access controls and review steps.
Outcome
The public site holds an A+ rating on securityheaders.com and Mozilla Observatory.
Short takes on recent stories, each linked to the original source.
Urgency is still the main vector, not the technology.
Moving closer to LGPD; worth reviewing consent.
Continuous training beats the one-off campaign.
Start with habits, not with tools.
I take on freelance work in security assessments, awareness programs, secure web builds, and automation. A short message about your team and your setup is enough to get started.