Manuel Villotti

Cybersecurity Consultant in the Application Security team at Deloitte Switzerland, supporting clients in the financial sector on securing their applications and digital infrastructure. Experience spans three core areas of application security. Advising development teams on secure design principles, threat modeling, and the implementation of security controls across the software development lifecycle. Conducting web application and API penetration testing engagements following industry standards such as OWASP, identifying vulnerabilities, and translating findings into clear remediation guidance for both technical and business stakeholders. Supporting clients in assessing and improving how they manage application security across their organization, with experience across frameworks such as FINMA guidelines, ISO 27001, NIST CSF, and NIST SSDF, including specific work on e-banking controls and security governance programs for financial institutions. Responsibilities also extend to the development of internal tooling leveraging the latest AI models and technologies to raise the quality and coverage of security assessments, an area that has become a significant and growing focus.

Cybersecurity instructor, particularly in web and network security, for participants of the CyberChallenge.IT 2024, 2025 and 2026 course. Qualified tutor of the team that participates in the national competition.

Threat Intelligence Specialist at Würth Phoenix, responsible for analyzing potential threats to clients, including malicious domains, stealers, dark web markets, and vulnerabilities.

As a Full Stack Developer and Co-Founder at CapThreat, a cybersecurity startup incubated at the NOI Techpark in Bolzano, I was responsible for developing a platform to simulate phishing attacks. Managed the entire process, from design to front-end and back-end development, while considering both the infrastructure and the security of the platform.

Obtained recognized technical certifications for a range of security solutions, including Sophos, Deep Instinct, Armis, and others, conducting demonstrations for clients and training sessions to ensure the effective use of the product.