Professional work
SIEM and SOC
SOC monitoring and event correlation
Continuous monitoring with IBM QRadar: offense triage, cross-source correlation and hand-off to response.
- IBM QRadar
- Trellix ePO
- FortiGate
Mid-level Cybersecurity AnalystOpen to new opportunities
Yasmin Freitas: Protecting systems.Reducing risk.
6+ years in defensive security, now in the SOC at Neotel Segurança Digital and consulting at KrownCode: detection, investigation and incident response across hybrid corporate environments, plus HSM, PAM, IAM and DLP projects.
- Monitoring and SIEM
- Incident response
- Network security
- Data protection and IAM
About me
I'm a mid-level cybersecurity analyst based in São Paulo, with 6+ years in defensive security. I started in 2020 as a cybersecurity intern at CET, joined the SOC at Neotel Segurança Digital as a junior analyst in 2021 and, since 2024, have worked there at mid level, owning the full incident lifecycle: SIEM detection, threat hunting, investigation, containment and reporting. Alongside that, I've been a cybersecurity consultant at KrownCode since 2023.
Beyond day-to-day operations, I lead HSM, PAM, IAM and DLP data protection projects on the technical side, build Python and PowerShell automations integrated with QRadar and Trellix, and mentor junior analysts. As a consultant, I run posture assessments, hardening and incident response process design. I like understanding why each alert fired and turning repetitive work into a reliable process.
I hold a degree in Systems Analysis and Development from UNISA, I am pursuing a postgraduate specialization in Cybersecurity at FIAP, and I hold 30+ vendor credentials from Thales, Imperva, Safetica and Trellix, among others. I stay close to the community, including technical and diversity events such as Ada Lovelace Day. My goal is to help build safer and more efficient digital environments.
Operations mindset
From the SIEM alert to the firewall change, with the environment in mind.
Data protection
Encryption, key management, identities and privileged access.
Automation
Tools that take manual work off the shift and give the team visibility.
yasmin@soc: ~
whoami
- name
- Yasmin Teixeira de Freitas
- role
- Mid-level Cybersecurity Analyst
- based in
- São Paulo, Brazil
- focus
- SOC, Blue Team, data protection
- experience
- 6+ years in defensive security
- work
- Neotel (SOC) and KrownCode (consulting)
- languages
- Portuguese, fluent English, basic Spanish
- education
- postgrad in Cybersecurity at FIAP (ongoing)
- status
- open to offers · hybrid or remote
Professional experience
Neotel Segurança Digital
to present5 yrs 10 mos
Cybersecurity Analyst (Mid-level) · SOC / Blue Team
to present2 yrs 10 mos
São Paulo, Brazil · hybrid
- Full incident lifecycle in the SOC (detection, triage, investigation, containment, eradication and post-incident) across hybrid corporate environments, following NIST SP 800-61.
- Detection engineering in IBM QRadar: building and tuning correlation rules, use cases and dashboards mapped to MITRE ATT&CK, continuously cutting false positives.
- Hypothesis- and intel-driven threat hunting, analyzing and blocking IOCs on the EDR, firewall and proxy.
- Administration of FortiGate 1800F, VMware NSX, Hillstone and Cisco Secure firewalls, F5 WAF, Cisco proxy and Trellix ePO EDR: policies, rule reviews, segmentation and threat response.
- Technical lead on HSM, PAM, IAM and DLP data protection projects, from architecture to rollout and support.
- Python and PowerShell automations integrated via API (QRadar, Trellix) for alert enrichment, evidence collection and monitoring.
- Incident playbooks plus technical and executive reports; mentoring junior analysts.
Technologies
- IBM QRadar
- Trellix ePO
- FortiGate 1800F
- VMware NSX
- Hillstone
- Cisco Secure
- F5 WAF
- Python
- PowerShell
- HSM
- PAM
- IAM
- DLP
Cybersecurity Analyst (Junior) · SOC
to 3 yrs
São Paulo, Brazil · hybrid
- Security event monitoring in IBM QRadar, L1/L2 alert triage, escalation and incident documentation.
- Firewall, proxy, EDR, Windows and Linux log analysis to investigate suspicious access, malware and phishing.
- Firewall, proxy and EDR operations: rule creation, IOC blocking and detection handling.
- Vulnerability management: scanning, CVSS-based prioritization and tracking fixes with the owning teams.
- Availability monitoring with Zabbix and support for Thales (HSM, CipherTrust, IAM) and Imperva (WAF, DDoS, DSF) deployments.
Technologies
- IBM QRadar
- Trellix ePO
- Zabbix
- CVSS
- Thales HSM
- CipherTrust
- Imperva WAF
- Imperva DSF
Cybersecurity Consultant
KrownCode
to present3 yrs 9 mos
São Paulo, Brazil
- Security posture assessments and risk analysis for clients, with remediation plans prioritized by impact and criticality.
- Hardening of Linux and Windows servers, Active Directory and cloud environments based on CIS Benchmarks and CIS Controls v8.
- Security architecture reviews: network segmentation, firewall rules, WAF, MFA and privileged access management.
- Building incident response processes, with playbooks and runbooks aligned to NIST and MITRE ATT&CK.
- Support for LGPD and ISO/IEC 27001 alignment (policies, controls and evidence) and secure development (OWASP Top 10, SAST/DAST).
Technologies
- CIS Controls v8
- CIS Benchmarks
- Active Directory
- MITRE ATT&CK
- ISO/IEC 27001
- LGPD
- OWASP Top 10
Cybersecurity Intern
CET, São Paulo Traffic Engineering Company
to 1 yr
São Paulo, Brazil
- Supported security event monitoring and log analysis for servers and workstations.
- Supported identity and access management in Active Directory and the rollout of security policies.
- Asset inventory, patch verification and support for vulnerability remediation.
- Technical support for users, including guidance on phishing and security best practices.
Technologies
- Active Directory
Technical skills
Each item shows where it comes from: professional use (Neotel, KrownCode and CET), a vendor certification, or lab work and study.
- Used at work
- Certified
- Lab and study
SIEM, monitoring and detection
Continuous monitoring, alert triage and detection engineering in the SOC.
- IBM QRadar (AQL)
- Detection engineering
- Event correlation
- Alert triage
- False-positive tuning
- MITRE ATT&CK
- Zabbix
- Splunk (SPL)
- Microsoft Sentinel (KQL)
- Elastic
- Wazuh
- Sigma
In practice
Threat hunting and threat intelligence
Hypothesis-driven hunting and threat intel to find what the rules didn't catch.
- Threat hunting
- Threat intelligence
- IOC blocking
- IOCs and IOAs
- Cyber Kill Chain
- Pyramid of Pain
- MISP
- VirusTotal
- AbuseIPDB
- Shodan
- YARA
Incident response, forensics and endpoint
From alert to containment: investigate, preserve evidence, document and follow through to closure.
- Incident response
- NIST SP 800-61
- Playbooks and runbooks
- Log analysis
- Phishing analysis
- Trellix ePO (EDR)
- Malware triage
- Sysmon
- Velociraptor
- KAPE
- Volatility
- Chain of custody
- Defender for Endpoint
- CrowdStrike Falcon
- SentinelOne
Networks and infrastructure
Multi-vendor perimeter administration and network protection.
- FortiGate 1800F
- VMware NSX
- Hillstone
- Cisco Secure Firewall
- Cisco proxy
- Network segmentation
- Imperva Network Protection
- DDoS for Networks
- IDS/IPS (Suricata, Snort)
- Zero Trust
- Wireshark
- tcpdump
In practice
Data protection, identity and encryption
Key management, encryption, identities and privileged access.
- HSM
- PAM
- IAM
- DLP
- MFA
- SafeNet Trusted Access
- Luna HSM
- Payment HSM
- CipherTrust CDSP
- Workforce and Customer IAM
- Safetica DLP
- Imperva Data Security Fabric
- Entra ID
- PKI
In practice
Application and API security
Application and API protection at the edge, secure development and testing in a controlled environment.
- F5 Advanced WAF
- OWASP Top 10
- SAST/DAST
- Imperva WAF Gateway
- Imperva API Security
- Burp Suite
- OWASP ZAP
In practice
Vulnerability management and authorized testing
Finding weaknesses before someone else does, always with scope and authorization.
- Vulnerability management
- CVSS-based prioritization
- Patch management
- Tenable Nessus
- Qualys
- Greenbone OpenVAS
- Nmap
- EPSS
- Kali Linux
In practice
Systems, cloud and hardening
Linux and Windows Server in hybrid and cloud environments, secure by default.
- GNU/Linux
- Windows Server 2016/2022
- Active Directory and GPO
- Hybrid environments
- CIS Benchmarks and Controls v8
- AWS CloudTrail
- AWS GuardDuty
- AWS Security Hub
- Microsoft Azure
- Microsoft 365
- Microsoft Purview
- Lynis
- nftables
In practice
Automation and SOAR
Tools that take repetitive work off the shift and connect products through APIs.
- Python
- PowerShell
- REST APIs (QRadar, Trellix)
- Alert enrichment
- Evidence collection
- Trellix API Essentials
- Bash
- SOAR
- Cortex XSOAR
- Shuffle
- Regular expressions
In practice
Governance, risk and compliance
Posture assessments, risk analysis and alignment with standards and LGPD.
- Security posture assessment
- Risk analysis
- ISO/IEC 27001
- LGPD
- ISO/IEC 27002
- NIST CSF 2.0
- PCI DSS
Projects and labs
Areas of my work at Neotel, described without exposing clients, plus study labs built in an isolated environment.
At Neotel
- Professional work
Data protection
HSM, PAM, IAM and DLP deployments
Data protection projects: cryptographic keys in HSM, privileged access, identities and leak prevention.
- Thales HSM
- CipherTrust (CDSP)
- PAM
- Professional work
Automation
Automation tooling for the SOC
Internal automation and monitoring tools that cut manual work and give the team visibility.
- Python
- PowerShell
- APIs REST
Labs
- LabHardening
Linux server hardening
Hardening a Debian server against the CIS Benchmark, with before-and-after audits using Lynis.
- Debian
- CIS Benchmarks
- Lynis
- LabWeb applications
Web vulnerability analysis
Lab with OWASP Juice Shop and DVWA to practice finding and fixing OWASP Top 10 issues.
- OWASP Juice Shop
- DVWA
- Burp Suite Community
- LabIncident response
Incident response lab
Simulated compromise of a Windows endpoint to practice the NIST cycle: detection, containment, eradication and lessons learned.
- Windows Server 2022
- Sysmon
- Wazuh
Certifications and education
Technical credentials issued by the vendors whose products I've worked with, plus my academic background and complementary courses.
16technical credentialsfrom 4 issuers
Thales
Encryption, key management and digital identity.
SafeNet Trusted Access Professional Engineer
MFA and SSO · valid until Jan 2027 · ID 130728457
CompletedCipherTrust Data Security Platform (CDSP) · TPA
Discovery, encryption and key management
CompletedGeneral Purpose HSM · TPA
Hardware-backed key protection
CompletedPayment HSM · TPA
HSM for the payments industry
CompletedHigh Speed Encryption · TPA
Network encryption for data in transit
CompletedWorkforce IAM · TPA
Workforce identity
CompletedCustomer IAM · TPA
Customer identity
CompletedAccelerate Pre-Sales Technical Professional (PTP)
Completed
Imperva
Network, application, API and data protection.
WAAP · WAF Gateway
CompletedWAAP · API Security
CompletedWAAP Foundation
Web Application and API Protection
CompletedData Security Fabric (DSF)
CompletedNetwork Protection
CompletedDDoS for Networks
Completed
Safetica
Data loss prevention (DLP).
Safetica Certified Associate
Completed
Trellix
Endpoint and integrations.
Trellix API Essentials
Completed
The full list, with 30+ credentials and verification links, is on LinkedIn.
Education
Postgraduate specialization
Cybersecurity
Faculdade de Informática e Administração Paulista (FIAP)
to presentIn progressAssociate's degree (Technologist)
Systems Analysis and Development
Universidade Santo Amaro (UNISA)
to Completed
Complementary courses
EXIN ISFS prep (ISO/IEC 27001)
Udemy
IT Governance
Udemy
GNU/Linux System Administration
Udemy
Windows Server 2016 and 2022
Udemy
Languages
- Portuguese
- Native
- English
- Fluent
- Spanish
- Basic
Open to new opportunities
Shall we strengthen the security of your systems?
Open to hybrid or remote roles. Pick whichever channel works best for you.
Contact details
- Location
- São Paulo, Brazil