Sergio E. Mancinas

Security Engineer

Cyber defence consultancy: detection, response, and the advisory work of raising how ready an organisation is to do both.

• The work is client-side rather than a single estate: helping organisations detect attacks, respond when they happen, and close the gap that let them in.
• Alongside the technical work, that means assessing cyber-defence maturity and the measures that actually raise it.

IT Security Engineer

Protecting a unified commerce platform used by global retail brands, across offices in Europe and North America.

• Incident response meant actually investigating, not just coordinating a ticket: logs, root cause, containment, credential rotation, and a blameless five-whys postmortem, tracked through DFIR-IRIS, the case-management platform I introduced for the team.
• I coordinated the annual SOC 2 penetration test and the remediation that followed, plus vendor security reviews across mobile, web and infrastructure.
• I owned identity and access management: Okta and SCIM provisioning, recurring access reviews, plus the secret and credential rotation that goes with it.
• On the supply-chain side, I built out dependency, secret, container and IaC scanning across the estate and mapped repository ownership so a finding lands with the team that can actually fix it, not a shared queue.
• The bigger build was extending OWASP ThreatAtlas, an open-source threat-modelling platform, with an MCP layer and STRIDE-based models on top: it maps engineering ownership, repositories and risk into one place, reachable through about seventy MCP tools with per-user Okta authentication. I built the OAuth 2.1 layer behind it myself, including a small relay to work around an identity provider's dynamic client registration that assumes an admin token no MCP client actually has.
• The rest was the security review queue for new tools, and day-to-day operations on a Jamf-managed fleet, including CIS Level 1 hardening: baseline first, then remediate in stages.

Multiplatform Engineer, Playback

Playback quality and telemetry for a European streaming platform, at a scale of millions of viewing sessions.

• Collaborated on the Kafka pipelines carrying playback telemetry from those sessions into something queryable.
• Modelled the analytics in ClickHouse, so a quality regression showed up broken down by device and region rather than as a single aggregate number.
• Wrote the monitoring services in Kotlin.

IT & Infrastructure Intern

Mandatory internship for my B.Sc., in the Onsite IT & Infrastructure team, where I also wrote my thesis on ML-based anomaly detection.

• Designed and ran a Wazuh SIEM with Isolation Forest anomaly detection across 400+ endpoints on two continents, with alert rules I wrote myself rather than the defaults.
• Automated the roughly twenty-step onboarding and offboarding process in Python and n8n, which meant nobody had to touch it by hand again.
• Wrote the patch policy against ISO 27001 and NIST, and did the actual endpoint hardening through Mosyle and NinjaOne.
• Set up network monitoring with SNMP, using Telegraf, InfluxDB and Grafana, and handled VPN access across the org.

Working Student, Digital Workplace

Access control and IT infrastructure at a B2B payments company under BaFin supervision.

• Evaluated four just-in-time access platforms, picked Entitle, and wired it into Okta so approvals became self-service instead of a ticket to IT.
• That cut standing privileges by 60%, and made the access reviews BaFin requires something a small team could actually get through.
• Endpoint hardening, security policy, asset management.

IT Operations and Automation

Part-time IT and automation work at a firm managing large infrastructure projects, done alongside my undergraduate studies.

• Built automation that replaced manual reporting across energy, water treatment and industrial projects.
• Documentation, technical support, the usual part-time-job mix of everything else.

Finance Analyst

My first role, in finance rather than technology, before I relocated to Germany and moved into engineering.

• Contract monitoring and cost control across projects in two countries.
• Where I learned to read a control until it either holds or it doesn't.

M.Sc. Communication Systems and Networks

TH KölnCologne

Network security, applied cryptography and cloud computing.

B.Sc. Software Engineering

University of Europe for Applied SciencesPotsdam

Academic scholarship. Thesis: Cybersecurity Monitoring — A Machine Learning and Wazuh Integrated Approach.

B.A. Economics and Finance

Instituto Tecnológico Autónomo de MéxicoMexico City

Debate team. Moved into software engineering after relocating to Germany.

Operational realities of sender-constrained OAuth: replay-state scaling thresholds and silent binding failures in distributed resource-server deployments

Research paper · TH Köln

Sender-constraining defends against the token replay behind recent large-scale breaches. I measured where DPoP's replay-state requirement stops scaling across distributed resource servers (the crossover lands around 17 requests per second on a single node), and found binding failures that fail quietly.

• OAuth 2.0
• DPoP
• mTLS
• FAPI 2.0
• Keycloak

Attack, detect, defend on SIP: a reproducible self-labeling testbed comparing signature, correlation and machine-learning detection

Lab project · TH Köln

A testbed that attacks its own SIP infrastructure to label its own data, then runs three detection strategies against the same ground truth: Suricata signatures, Wazuh correlation, and an XGBoost classifier. Response runs through a Shuffle SOAR workflow, with Vector shipping logs to ClickHouse for observability.

• SIP
• Suricata
• Wazuh
• XGBoost
• HEP
• Shuffle SOAR
• Vector
• ClickHouse

WebRTC conferencing with end-to-end encryption

Lab report · TH Köln

A self-hosted conferencing system that stays end-to-end encrypted even though a server routes the media. Frames are encrypted client-side with AES-256-GCM, keyed via HKDF-SHA256, before they reach the LiveKit SFU. Coturn handles NAT traversal, backed by Postgres auth and a Prometheus, Grafana and Loki stack for observability.

• WebRTC
• E2EE
• LiveKit
• Coturn
• SFrame
• PostgreSQL
• Prometheus

Cybersecurity monitoring with machine learning and Wazuh

B.Sc. thesis

A full-stack SIEM pairing Wazuh with Isolation Forest anomaly detection for real-time alerting, deployed on AWS with Docker Compose and PostgreSQL.

• Wazuh
• Python
• AWS
• Docker
• PostgreSQL