KeepHowling · Penetration Tester · Offensive Security
Madrid, Spain · Spanish native · English C1
I'm a penetration tester with 3+ years of professional experience across application and infrastructure security. I currently work in offensive cybersecurity at Sanitas, following roles at Stratesys and S21sec.
My work spans web and mobile applications, enterprise systems and AI security. I investigate exploitable behavior and document the evidence so technical teams can understand the impact and address it.
Curiosity drives the investigation. Evidence shapes the conclusion.
| Area | Experience |
|---|---|
| Application security | Web, API and WebSocket assessments; iOS, Android and thick client audits. |
| Enterprise security | Internal and external penetration testing, network infrastructure assessments, Office 365 vulnerability analysis and HL7 environments. |
| AI security | AI agent security reviews, adversarial testing and prompt attack scenarios; professional AI bug bounty work. |
| Offensive collaboration | Purple teaming, mobile Red Team exercises, assessment planning and technical reporting. |
- Sanitas · Offensive Cybersecurity Analyst | October 2023 - Present
Application and enterprise security assessments, purple teaming and assessment planning. - Alias Robotics · AI Bug Bounty Hunter | March 2025
Professional bug bounty research focused on Cybersecurity Artificial Intelligence (CAI). - Stratesys · Offensive Cybersecurity Analyst | January 2023 - October 2023
Internal and external penetration tests, network infrastructure assessments and web audits. - S21sec · Penetration Tester | April 2022 - August 2022
Web, iOS, Android and NFC assessments; mobile Red Team exercises and reporting for national and international clients.
These repositories contain early automation experiments and learning notes from my security practice.
| Repository | What it covers |
|---|---|
| nuclei-automation | Bash scripts combining Subfinder, Assetfinder and Nuclei, with scan output grouped by template category. |
| CTF-Writeups | Challenge notes covering reverse engineering, .NET debugging and binary analysis. Examples include Bypass and HackyBird. |
| HTB-writeup | Admirer investigation notes covering service enumeration, web directory discovery, exposed credentials and an Adminer investigation. |
- Certified Red Team Professional (CRTP) | June 2024
- ISC2 Certified in Cybersecurity (CC) | December 2022
- 13 vulnerabilities recognized on Bugcrowd.
- 2nd place in National Cyberleague | 2022 and 2023
Cybersecurity Engineering studies at Universidad Rey Juan Carlos, started in 2019. Degree not completed.
HackOn organiser and CTF competitor with La Hackoneta. Competitive security remains a place to investigate unfamiliar systems, exchange ideas and learn with others.
Interested in penetration testing, offensive security and Red Team opportunities.
marina_villalta@keephowling.es · Professional background · LinkedIn