
KCD Security Observability Demo
A live Kubernetes security observability talk built around a reproducible demo that shows how Cilium Tetragon and eBPF can detect, correlate, observe, and block an attack in real time.


Security and observability consultant at Dynatrace, focused on SIEM migrations, detection engineering, and workflow automation that reduces manual triage. I focus on making security monitoring dependable when ownership, routing, and enrichment have to work at scale.
My background includes application security, cloud-native environments, and automation work across GCP, Kubernetes, and Terraform. I like projects where security outcomes improve because the workflow gets cleaner, not because the tooling gets louder.
This portfolio collects selected projects, write-ups, and lab work in one place with room for longer technical breakdowns where they matter. It also includes talks built around practical demos and hands-on security workflows.
A Kubernetes security observability demo built for my KCD Guadalajara talk, showing how Cilium Tetragon and eBPF can detect, correlate, and block an attack in real time.
An enrichment-driven workflow that replaced manual incident creation by adding routing metadata, onboarding teams through lookup tables, and making ownership decisions automatable.
An ELK-based lab for simulating credential dumping, execution, and lateral movement so detections can be tuned against realistic behavior instead of theory.

A live Kubernetes security observability talk built around a reproducible demo that shows how Cilium Tetragon and eBPF can detect, correlate, observe, and block an attack in real time.
If you want to talk about a project, a write-up, or security engineering work, send a message.
Send a message ↗