José Antunes

I administer a Wazuh SIEM installation running in production at the faculty. Most of the work is the unglamorous half of security operations, keeping the platform healthy and the access rights correct so that the detections are worth reading. Incidents I have handled on the live system include the following.

• Disk saturation on the indexer.
• OpenSearch heap exhaustion.
• Shard recovery.
• User and access management.

• Wazuh
• OpenSearch
• Linux
• Incident response

C-Academy is the advanced cybersecurity training programme run by the Portuguese national cybersecurity centre and delivered by FCUL. I taught the Administração de Sistemas em Rede course, built the lab environments the students worked in on VirtualBox, Docker, Rocky Linux and Debian, wrote the practical guides that went with them, and set and graded the assessments. The practical assessment ran on 13 July 2026.

• Access control and user management, covering authentication methods and MFA, SSH, LDAP with FreeIPA, single sign-on with Keycloak over OpenID Connect, multi-factor authentication with PrivacyIDEA, and adaptive access control with Zero Trust and SAML.
• Systems governance, covering NIS2, Portuguese Decree-Law 125/2025, COBIT, the ISO/IEC standards and NIST CSF 2.0.

• FreeIPA
• Keycloak
• PrivacyIDEA
• Wazuh
• SAML
• Zero Trust
• NIS2
• NIST CSF 2.0

I taught two courses on the UPskill programme, ServiceNow, and Networks and Cybersecurity. I wrote the teaching material, built the hands-on labs in VirtualBox and set the assessments.

• Web fundamentals with HTML, CSS and JavaScript.
• Cloud computing and virtualisation.
• SSH and Linux system administration.
• Docker and containers, from image creation to networking and registries.
• SecOps, covering SOC, SIEM and SOAR with Wazuh, Shuffle and MITRE ATT&CK, including workshops where students wrote their own playbooks and runbooks.

• Wazuh
• Shuffle SOAR
• MITRE ATT&CK
• Docker
• Linux
• ServiceNow

Sole developer of the restaurant's Laravel application, the public site and the management panel behind it. I own the whole stack, from the database and features to deployment. Recent work has been security, with mandatory two-factor authentication across the panel, authorisation graded by whether an action can be undone, hashed API tokens, a Content Security Policy and an audit log of every change. More on this project.

• Laravel 10
• PHP 8.1
• MySQL
• Fortify
• PHPUnit
• Playwright

Built two APIs for Edoclink, an in-production document management platform. One classifies incoming documents automatically, the other detects and obfuscates personal data so documents can be shared under GDPR. More on this project.

Final grade 19/20

Four assignments, worked through with one colleague.

• Syslog, how it works on Windows and on Linux.
• Bootstrap, templates for the company web application.
• Worker Service, a C# service running on both platforms that emails advance notice before a contract or proposal expires.
• Crawler, a C# crawler that pulls data out of an external web application and filters it with regular expressions. More on these two.

Final grade 19/20

Thesis, Segurança em Infraestrutura de cloud para o DI. I am building a private cloud infrastructure on Apache CloudStack 4.22 over KVM, running on a Dell PowerEdge R710 with Ubuntu 24.04, and working out how to secure it. More on this project.

Final average 16/20

Member of the school's Clube de Informática, Programação e Inovação, where we built the InMoov robot.

Final average 16/20