Hands-on Offensive Security Experience

CTF Player — TryHackMe

São Paulo, Brazil (remote & part-time) · Sep 2024 — Present

Ranked among the Top 1% of TryHackMe users worldwide (Th3r4v3n), earning 52 badges and completing 321+ hands-on security labs focused on Offensive Security, Penetration Testing, Vulnerability Assessment, Active Directory, Web Application Security, and real-world attack scenarios.
Built practical offensive security skills through hands-on web application, network, and Active Directory security labs using Kali Linux, Burp Suite, Nmap, dirsearch, Wireshark, Metasploit, ffuf, Python, Gobuster, and Bash. Applied the OWASP Top 10, OWASP Testing Guide, and leveraged the MITRE ATT&CK framework to better understand adversary techniques and attack scenarios while developing skills in Privilege Escalation, Malware Analysis, Digital Forensics, OSINT, Incident Response, and SIEM fundamentals.

São Paulo, Brazil (remote & part-time) · Sep 2024 — Present

Competed in 11 international Capture the Flag (CTF) competitions covering challenges in Web Exploitation, Penetration Testing, Privilege Escalation, Malware Analysis, Active Directory, OSINT, Cryptography, Reverse Engineering, and Binary Exploitation techniques, capturing 77 flags across competitive cybersecurity challenges.
Earned 36,050 points on the Hack The Box platform while achieving a highest ranking of 65th among more than 1,200 participants.

São Paulo, Brazil (remote & part-time) · Feb 2026 — Present

Performed authorized web application and API security testing through public bug bounty programs using structured web application testing methodologies.
Conducted reconnaissance, attack surface mapping, content discovery, and manual security testing using Kali Linux, Burp Suite, Nmap, ffuf, Gobuster, dirsearch, cURL, WhatWeb, Nikto, and OWASP Testing Guide methodologies.
Practiced HTTP request manipulation, endpoint enumeration, directory and subdomain discovery, and web application analysis while strengthening skills in authentication, authorization, session management, input validation, and security misconfigurations.

São Paulo, Brazil (remote & part-time) · Feb 2026 — Present

Performed hands-on application security testing against authorized targets in public bug bounty programs, focusing on ethical testing and responsible security research.
Performed reconnaissance, attack surface analysis, service enumeration, and manual application testing using Kali Linux, Burp Suite, Nmap, ffuf, Gobuster, Subfinder, dirsearch, WhatWeb, cURL, Python, Bash, and OWASP Testing Guide methodologies.
Analyzed web applications and APIs by inspecting HTTP requests and responses, identifying potential attack vectors, and validating security controls through manual testing.