Marcus Quintella Ribeiro

Funpresp-Jud is a young pension fund, established in 2013, responsible for managing the benefits of employees in the Brazilian federal judiciary. The organization has a small team of approximately 50 employees, with 5 of them allocated to the IT department. The IT department of the foundation consists of 5 employees, including one manager and four professionals. The manager, a position I have held since the company's inception, is responsible for all aspects of IT infrastructure and security. I have designed all current policies, subsequently approved by working groups, such as the Information Security Policy, IT Service Catalog, and Business Continuity Plan. I am also responsible for incident management and the development of the foundation's security strategy. I participated in the working group responsible for the company's compliance with the General Data Protection Law (LGPD), the Brazilian counterpart of the European GDPR. Currently, we are working on structuring the company's Information Security Management System (ISMS) and the Risk-Based Management project. Within the foundation, I am a full member of the Information Security Committee, a full member of the Ethics Committee, a member of the Access Profiles Working Group, and a member of the LGPD Working Group. I am also a member of the Regional IT Committee of Abrapp, the association of pension funds in Brazil. Among the regular tasks performed are system and resource access management, IT procurement management, management of IT security assets, development and review of policies, standards, guidelines, and procedures, backup management, management of virtualized environments, network management (LAN, MAN, and Internet), antivirus management, server management, among others.

In March 1998, I was permanently transferred from the Judiciary Section of Roraima to the staff of the 1st Regional Federal Court, where I had been working in the field of networks and information security since November 1997.

As the Chief Technology Officer, I managed the team that supported the entire infrastructure of the 1st Region, which encompassed 99 different cities with over 14,000 connected devices. Here, we took care of everything from workstations to corporate telephony, already using VoIP, in a project conceived and executed entirely by our team, using open-source software.

As the Director of Technological Infrastructure and User Support, which had three subordinate directorates, in addition to the Project Office, I coordinated actions aimed at strengthening the IT infrastructure and information security of the court, always in partnership with the directors of those areas. I also supported the management of the IT Secretary, automatically substituting for the IT Secretary when necessary.

In 2006, a specific area focused on Information Security was created in the court, which I took over, shifting my focus to the field of information security. During this period, we replaced the previous firewalls with pfSense, in which our team, now composed of three professionals, contributed to the source code. For nearly a decade, pfSense was responsible for protecting the perimeter of TRF1, a court that had the second-largest volume of internet access in the Brazilian government category.

At TRF1, I began my journey in infrastructure, assisting in the installation of the data network and aiding in the creation of the domain using Windows NT. I worked on implementing the email service, creating proxy servers, and being the first line of defense for the company through router-based access control rules. I also participated in the implementation of the court's first firewall, based on FreeBSD, and utilizing Snort (2001).

Currently, I teach classes in the subject of Investigations in Security Systems in the postgraduate program in Digital Forensics and Cybersecurity at UniCEUB.

I worked as the head of the Security and Compliance area, being responsible for the entire IT security strategy of CJF during that period. I also collaborated with other CISOs who were responsible for the IT security of the courts affiliated with the council (Federal Regional Courts - TRFs). I drafted the IT Security Policy that governs the entire Brazilian Federal Judiciary and later coordinated the committee that finalized its version, which was approved by the Council. I developed norms and procedures related to IT security that were used by the organization, and I also coordinated IT procurement processes focused on information security. Additionally, I provided support to the management of AC-JUS, the certification authority of the judiciary, regarding information security matters.

I worked as a coordinator of distance learning, supporting departments and professors in adapting courses for online education. I also set up and managed the college's Moodle platform. Additionally, I taught classes in the field of Information Technology for postgraduate students.

I began my career in the Federal Judiciary at the Judiciary Section of Roraima, where I entered through a public examination in 1993, being part of the first IT team of the organization. During this time, we managed the operation of Digirrede equipment running MUMPS, still based on dumb terminals. We installed the first computers in the organization and implemented the first computer network. Additionally, we provided training, modernized processes, and supported the management in the technology field.

At TCERR (Court of Audits from Roraima State), our team implemented the first computer network in the institution, which previously relied on isolated machines. We also structured the first internal systems, such as the payroll system. Additionally, we modernized processes and provided training to the staff, during a time when IT was still a relatively closed-off field and people had limited familiarity with technology.