David Lopez Moya

Created a vulnerability prioritization platform that ingests NVD, CVE sources, CISA KEV, and FIRST EPSS to generate an explainable patch-order score. Added read-only integrations to cross-reference CVEs against each organization’s assets (including multiple security platforms and hosting panels) plus scanning/report ingestion workflows. Monitored external attack-surface signals (DNS, subdomains, and Shodan) and matched exposed services/versions to prioritize remediation more accurately.

Built a multi-tenant compliance platform where AI assistants analyze customer documents against regulatory/control frameworks and report compliance status. Implemented a RAG approach using embeddings stored in PostgreSQL with pgvector and a router for multi-provider LLMs. Added security-by-design tenant isolation using row-level access controls, OIDC authentication, role-based permissions, auditing of changes, and automated isolation testing. Developed the solution with TypeScript and backend/frontend components deployed via Cloudflare Pages.

Led the full vulnerability management lifecycle for the Credicorp Capital client on Windows and Linux using Vicarius vRx. Built and used remediation automation via PowerShell, Bash, and Python, coordinating remediations under SLAs and escalating critical cases to engineering. Developed and deployed an internal contracts/billing platform with Docker and implemented a secure MCP endpoint for assistant-driven read-only access using OAuth 2.1. Used generative AI tools (Claude Code and LLMs) to accelerate operational security automations and reporting.

Performed vulnerability remediation across multiple production Windows servers for critical banking systems under tight maintenance windows. Planned mitigations considering business impact and coordinated execution with client engineering teams. Managed the end-to-end workflow including analysis, remediation execution, supporting configuration, and evidence collection for closure.

Led pentesting and remediation of critical vulnerabilities across applications and exposed Amazon S3 buckets with high data-leak risk. Managed security incidents and developed incident response playbooks required by regulations. Operated security tooling (including Darktrace) and executed impersonation takedowns to reduce phishing and fraud attempts.

Administered large-scale Linux infrastructure powering IBM QRadar deployments for MSSP customers. Focused on SIEM stability and operational reliability, improving system performance and reducing failures in a multi-client environment.

Led a migration from McAfee to Sophos across more than 7,000 endpoints and servers within a three-month period without major incidents. Deployed Sophos Mobile to 1,000+ devices and enabled SafeGuard encryption for endpoint protection. Detected and contained command-and-control activity using endpoint security monitoring, supporting ISO 27001 compliance for endpoint controls.

Provided 24/7 NOC support for Fortinet and Check Point firewall operations. Improved monitoring configuration using PRTG and automated configuration backup routines to reduce operational risk and restore time.