Hands-on Offensive Security Experience

CTF Player — TryHackMe

São Paulo, Brazil (remote & part-time) · Sep 2024 — Present

Ranked among the Top 1% of TryHackMe users worldwide (Th3r4v3n), earning 52 badges and completing 321+ hands-on security labs focused on Offensive Security, Penetration Testing, Vulnerability Assessment, Active Directory, Web Application Security, and real-world attack scenarios.
Built practical offensive security skills through hands-on web application, network, and Active Directory security labs using Kali Linux, Burp Suite, Nmap, dirsearch, Wireshark, Metasploit, ffuf, Python, Gobuster, and Bash. Applied the OWASP Top 10, OWASP Testing Guide, and leveraged the MITRE ATT&CK framework to better understand adversary techniques and attack scenarios while developing skills in Privilege Escalation, Malware Analysis, Digital Forensics, OSINT, Incident Response, and SIEM fundamentals.

São Paulo, Brazil (remote & part-time) · Sep 2024 — Present

Participated in 13 Capture the Flag (CTF) events, capturing 115 flags and earning 44,440 points on Hack The Box (r4v3nan0n). Practiced Web Exploitation, Penetration Testing, Privilege Escalation, Malware Analysis, Active Directory, OSINT, Cryptography, Reverse Engineering, and Binary Exploitation techniques.
Most solved category: Sherlocks — 51 flags and 5,375 points. Other most played categories: Coding — 31 flags; Reversing — 10 flags.
Team roles: Captain of the_r4v3n and Member of FIAP.
University CTF 2024: Binary Badlands — Rank 428; Binary Badlands After Party — Rank 65.
Cyber Apocalypse CTF 2025: Tales from Eldoria — Rank 1565; Tales from Eldoria After Party — Rank 253.
Hack The System - Bug Bounty CTF Playground — Rank 518; Bug Bounty CTF — Rank 770; Bug Bounty CTF After Party — Rank 63.
Holmes CTF 2025 — Rank 1799.
Hack The Boo 2025 - Practice — Rank 340; Competition — Rank 473.
University CTF 2025: Tinsel Trouble — Rank 454.
Cyber Apocalypse CTF 2026: The Salt Crown — Rank 1574.
Holmes CTF 2026: The Reichenbach Directive — Rank 563.

São Paulo, Brazil (remote & part-time) · Feb 2026 — Present

Performed authorized web application and API security testing through public bug bounty programs using structured web application testing methodologies.
Conducted reconnaissance, attack surface mapping, content discovery, and manual security testing using Kali Linux, Burp Suite, Nmap, ffuf, Gobuster, dirsearch, cURL, WhatWeb, Nikto, and OWASP Testing Guide methodologies.
Practiced HTTP request manipulation, endpoint enumeration, directory and subdomain discovery, and web application analysis while strengthening skills in authentication, authorization, session management, input validation, and security misconfigurations.

São Paulo, Brazil (remote & part-time) · Feb 2026 — Present

Performed hands-on application security testing against authorized targets in public bug bounty programs, focusing on ethical testing and responsible security research.
Performed reconnaissance, attack surface analysis, service enumeration, and application testing using Kali Linux, Burp Suite, Nmap, ffuf, Gobuster, Subfinder, dirsearch, WhatWeb, cURL, Python, Bash, and OWASP Testing Guide methodologies.
Analyzed web applications and APIs by inspecting HTTP requests and responses, identifying potential attack vectors, and validating security controls through manual testing.