Marcio Romao

Experienced cybersecurity specialist, focused on delivering security consulting in both Web3 and traditional Web2 environments. Skilled in helping clients strengthen their security posture through thorough assessments and penetration testing, providing actionable reports, remediation strategies, and tailored best practices. Proven ability to identify critical vulnerabilities, optimise systems, and ensure resilience against real-world attack vectors. Web3 – Smart Contract Auditing - Comprehensive analysis of smart contracts to uncover vulnerabilities, ensure adherence to security best practices, and optimise gas efficiency; - Experience includes auditing production-ready contracts and research-driven blockchain projects. Web2 – Penetration Testing - Execution of in-depth penetration tests targeting web applications, APIs, and internal infrastructures, simulating real-world attack scenarios; - Engagements with enterprise-level clients across highly regulated and high-availability environments. Open to new opportunities and collaborations in Web3 security and offensive security testing.

Conducted risk assessments and identifying vulnerabilities across applications and systems. - Code reviews, security testing, and vulnerability assessments; - Threat modeling and prioritization of security risks; - Development of security policies and guidelines; - OT security initiatives for critical infrastructure; - Penetration testing of ECS/BCS apps (internal and third-party); - Validation of previous tests and remediation (internal and third-party); - Low-level reporting and corrective action plans.

Conducted a comprehensive security review of the Energy Bidding Market platform, identifying critical vulnerabilities and delivering a detailed report with actionable mitigation strategies to the client.

Conducted external and internal penetration tests using various methodologies (PTES, OWASP, etc.) on a range of technologies and clients, including: - Web Applications (Applications, Websites, and Platforms); - Internal Infrastructure (WiFi, IoT, Servers, Datacenters, etc.); - Mobile Apps; - Cloud Pentest; - Vulnerability analysis; - Client security report elaboration and presentation; Managed a team of penetration testers, including: - Planning and task distribution; - Mentoring and training new team members; - Project coordination and ensuring adherence to deadlines and quality standards; - Interfacing with clients to align expectations and communicate results.

External and Internal Pentests under several methodologies (PTES, OWASP, etc) on a range of technologies and clients, including: - Web Applications; (Applications, Websites and Platforms); - Internal Infrastructure (WiFi, IoT, Servers, Datacenters, etc...); - Mobile Apps; - Cloud Pentest; - Vulnerabilities analysis; - Client Security Report elaboration and presentation.

External and Internal Pentests under several methodologies (PTES, OWASP, etc) on a range of technologies and clients, including: - Web Applications; (Applications, Websites and Platforms); - Internal Infrastructure (WiFi, IoT, Servers, Datacenters, etc...); - Mobile Apps; - Vulnerabilities analysis; - Client Security Report elaboration and presentation.

External and Internal Pentests under several methodologies (PTES, OWASP, etc) on a range of technologies and clients, including: - Web Applications; (Applications, Websites and Platforms); - Internal Infrastructure (WiFi, IoT, Servers, Datacenters, etc...); - Mobile Apps; - Vulnerabilities analysis; - Client Security Report elaboration and presentation.

- Bug Bounty Hunter @HackerOne - Assessing product security through white, gray or black-box penetration testing. - Actively participating in the bug fixing process by engaging with the developers and understanding the procedure behind - Writing detailed, professional reports of my findings with proven impact

Analyze certificates and CVEs to plan and implement updates and upgrades across Volkswagen's Autoeuropa infrastructure. Worked closely with the Volkswagen Security team in Germany to investigate phishing, malware, and ransomware attacks on both server and client sides that could affect Volkswagen Autoeuropa and discuss best practices, determine optimal security programs, and develop strategies to secure the network and systems.

Providing level 1/2/3 technical support off all infrastructure in Volkswagen (Autoeuropa); Creating backups (TSM and Avamar) on all servers (Windows, Linux and AIX) physical and VM; Update, modify and upgrade all the infrastructure and Servers (Windows, Linux, AIX); Add and/or remove users using the AD and Exchange to create emails accounts; Troubleshoot and resolve infrastructure errors and Exchange problems; Advice client (Volkswagen) about new technologies and improve efficiency on DataServers; Troubleshoot SQL and Oracle DBs; Create servers as demand by the client (Volkswagen).

Responsible for installation, configuration, administration and maintenance of all Server Infrastructure, Storage and Datacenter activities via virtualization (VMWare); Monitor infrastructure usage KPI’s, plan and execute maintenance measures, ensuring optimal availability, resilience and security; Responsible for implementing patch management and expansion activities (Capacity Management), ensuring correct Service Transition, in line with the Business Units goals; Troubleshooting and resolving all Linux related problems as well as network related problem using load balancer (Brocade) and domain problems (Godaddy).