Natan Santos
Offensive Sec

PwC Brasil

• Executed 12+ enterprise penetration tests per year across web, API, mobile, and multi-cloud (AWS, Azure, GCP) with 0% missed-SLA rate.
• Designed and led a full-chain Azure red team simulation for a national bank — uncovered 3 critical detection gaps including Entra ID lateral movement and PRT abuse, triggering architectural remediation and new IR playbooks.
• Conducted Active Directory attack simulations: Kerberoasting, AS-REP Roasting, Pass-the-Hash, and ADCS ESC1/ESC4 chains — improving client detection coverage across AD-based attack paths.
• Reduced average report turnaround by 25% via reusable Burp Suite extension templates and Python automation for evidence collection.
• Authored executive-level and technical findings reports consumed by C-suite and engineering teams across banking, retail, and energy sectors.
• Mentored 2 junior analysts on red team methodology, tooling (BloodHound, Metasploit, Burp Suite Pro), and responsible disclosure.

act digital

• Led web and mobile penetration testing across 8+ product squads — integrated security gates into GitLab CI pipelines, reducing time-to-fix for critical findings by ~40%.
• Performed SAST (SonarQube) and manual code review in Java and JavaScript — identified and remediated 30+ high/critical vulnerabilities before production release.
• Designed an AppSec workflow adopted across 4 development teams, cutting recurring OWASP Top-10 findings by 60% within two release cycles.
• Built MobSF-based mobile security automation, reducing manual iOS/Android review effort by 50%.
• Executed DAST campaigns and API security assessments (REST/GraphQL) covering auth bypass, IDOR, and business logic flaws.

Claro Brasil

• Conducted end-to-end security assessments of consumer-facing web and mobile apps (millions of subscribers) using Fortify SCA, Checkmarx, and Burp Suite Pro.
• Integrated SAST/DAST checks into GitHub Actions CI/CD pipelines — enabling injection and auth flaw detection at pull-request stage.
• Delivered threat modeling sessions (STRIDE) with 3 product teams, producing risk registers that prioritized remediation of 15 high-severity issues within a single sprint.

Kyndryl

• Administered RBAC and Segregation-of-Duties controls across Azure/AWS environments — reduced excessive-privilege findings by 35% in quarterly access reviews.
• Produced cloud misconfiguration risk reports for the client's quarterly risk committee, improving executive visibility into IAM and network exposure.

Sinqia

• Configured NGFW, IPS, and IDS systems — developed detection rules reducing mean-time-to-detect anomalous traffic by 30%.
• Supported incident response investigations and maintained threat-hunting logging infrastructure across the financial platform.
• Created security baselines for Windows Server and Linux endpoints adopted as company-wide hardening standards.

FIAP, São Paulo

UNINOVE, São Paulo