João Ramos

Principal Cyber Security Analyst @Quartz Enterprises

London, GB

I am part of a global team of Information Security specialists in different continents, having responsibilities including but not limited to:• Operate and monitor Security Incident and Event Management (SIEM), anti-malware and other cyber-security tools, logs and technologies• Recognise and respond to cyber-attacks and threats based on in-depth, proactive analysis of monitoring, network, application and system event data to identify potentially abnormal or anomalous system behaviour • Perform network- and host-based forensic analysis during incident response activities To improve the detection and mitigation of security incident, I have developed some internal tools, in Python and Powershell. From those I highlight one that is called Email Attack Identified which allows us to:• Search emails by links, hash, attach name• Check if a PDF, Microsoft Office or HTML attachment is malicious or triggers a Yara rule• Alert if a domain of a sender or link was recently created• Alert if a punycode is identified• Alert if an attachment is encrypted and the password found in the email• Alert if one of the IP in the MTAs is reported as malicious• (and more…)

Faculdade de Ciências da Universidade de Lisboa

MSc, Segurança Informática

Universidade Lusófona - Centro Universitário Lisboa

Licenciatura, Informática, Ramo de Sistemas

Carnegie Mellon University

MSc, MSc. in Information Technology - Information Security (MSIT-IS)