Information Security Analyst specializing in black box security testing of web and mobile applications following OWASP guidelines.In 2021 I carried out Information Security consultancy (Red Team/Pentest) under the APIs of public companies, among them, the Tocantins Finance Secretariat (SEFAZ-TO), Public Security Secretariat (SSP-TO), Court of Auditors of the State of Tocantins (TCE-TO), Military Police of Tocantins (PM-TO) and I have already reported failures to private companies, such as: Banco do Brasil, KingHost, Vester and through the “HackerOne” failure reward platform, among The reported flaws are vulnerabilities that I found on the PayPal payments website. All reports are available for consultation upon signing a confidentiality agreement and have sensitive data hidden.Fluent in English, trained at the CNA teaching school, and have a certificate of proficiency from the University of Cambridge. Furthermore, I participated in the largest Information Security conference on the South American continent, “RoadSec”, with lectures and hacking competitions in São Paulo, in 2018 and I participated in one of the largest cybersecurity conferences in Latin America, “Mind The Sec”, in the years 2020 and 2021.I write ethical hacking content and classes on security testing on my blog (https://filosofiahacker.wordpress.com), as well as developing the "Red Team Framework" tool (https://github.com/david-botelho-mariano ), authorial system that, through a graphical interface, automates the use of security testing tools. The tool has the ability to enumerate subdomains, check open ports, capture screenshots of websites and store the results of each test performed.Professional experience in:- Teach security to the developer team (Security Champions).- Handling security incidents according to the NIST methodology.- DAST: Burp Suite and OWASP ZAP.- Manual security test (Pentest).- SCA: OWASP Dependency Track and Synk.- Threat modeling using the STRIDE methodology.- SAST: SonarQube and Synk.- Code review and analysis of security requirements.- Kubernetes/container/IaC security with tools such as Trivy and Checkov.- Monitoring through AWS DataDog and WAF logs.