Daniel Monzón

Daniel Monzón - Security Researcher

I am a security researcher with over 6 years of experience in web pentesting, code review, infrastructure (internal and external pentests), mobile audits (Android and iOS), thick-client security assessments as well as red team exercises and SAP security audits. Worked in companies such as Halborn, Siemens and Innotec/Accenture, helping secure their systems and their client’s.

Occasional speaker at security conferences such as: hack0n, RootedCON Málaga, DragonJARCON, etc. I hold multiple industry-recognized certifications, such as: OSCP, CRTP, eMAPT, CARTP, etc. I’ve also found multiple security vulnerabilities in open-source and commercial products, such as CVE-2020-27461 or CVE-2020-7361 and I’m always eager to learn more and find more and more vulnerabilities across complex infrastructures and codebases.

Technical Skills

Offensive Security

  • Red Team Operations: Multi-phase adversary simulation, Purple Team exercises/Atomic Red Teams
  • Active Directory: Privilege escalation, lateral movement and persistence
  • Web Application Security: web hacking and API pentesting
  • Mobile Security: Android & iOS application pentesting
  • Infrastructure Testing: Internal/external network assessments, endpoint security
  • Thick Client Testing: Desktop application security, protocol analysis

Cloud & Container Security

  • Cloud Platforms: Azure, AWS, GCP security assessments and exploitation
  • Kubernetes: Cluster pentesting, container escape, misconfigurations
  • Azure/Entra: Identity attacks, privilege escalation, conditional access bypass

Specialized Domains

  • AI Red Teaming: LLM security, Model Context Protocol (MCP)
  • Blockchain/Web3: Smart contract auditing, cryptographic protocol analysis
  • OT/ICS: SCADA systems, industrial control systems security
  • IoT Security: Device firmware analysis, hardware hacking
  • SAP Security: ERP security assessments, configuration reviews
  • Wireless: Wi-Fi pentesting (WEP/WPA2/WPA3), 802.11 exploitation

Binary Analysis & Exploitation

  • Operating Systems: Windows internals (primary), macOS, Linux kernel knowledge
  • Reverse Engineering: IDA Pro, Ghidra, binary analysis
  • Exploitation: Stack/heap exploitation, ROP chains, kernel exploits
  • Fuzzing: Coverage-guided fuzzing, vulnerability discovery

Development & Tooling

  • Languages: Python (primary), C/C++, JavaScript, Go, Rust
  • Code Review: Security analysis in JavaScript, PHP, C#, C++, Java, Golang, Rust, Solidity, etc

Social Engineering

  • Phishing: Campaign design and execution, payload delivery
  • Security Awareness: Training delivery, user testing

Professional Experience

Offensive Security Engineer | Halborn

December 2025 - Present

Currently working on advanced security assessments for blockchain and Web3-related entities, including:

  • Security code review for projects in different languages (Javascript, Golang, etc)
  • Red team exercises targeting Web3 organizations
  • Web application penetration testing for crypto platforms
  • Mobile application security assessments (iOS/Android)
  • Cryptographic protocol analysis and vulnerability research

Red Team Operator | Siemens

January 2024 - December 2025

  • Executed red team engagements simulating advanced persistent threats
  • Conducted thick-client application security assessments
  • Performed security research on AI/ML systems and emerging AI red teaming techniques
  • Developed custom tooling for internal security assessments
  • Delivered cloud security reviews for Azure/Entra environments

Security Consultant | Innotec Security (now Accenture)

July 2021 - December 2023

Delivered comprehensive security assessments across diverse technologies and environments:

  • Infrastructure Security: Internal/external penetration testing, network security assessments
  • Application Security: Web application testing, mobile app audits (iOS/Android), API security
  • Cloud Security: AWS security assessments and noise testing, Kubernetes cluster penetration testing
  • Enterprise Applications: SAP security audits and configuration reviews
  • Wireless Security: Wi-Fi network assessments (WEP, WPA2/WPA3 attacks)
  • Social Engineering: Designed and executed phishing campaigns and security awareness training
  • Red Team Operations: Multi-phase adversary simulation exercises
  • Code Review: Security analysis of custom applications and third-party integrations
  • Financial systems security: executed security assessments of SWIFT and mainframe systems

Penetration Tester | Atalanta Evolution

March 2020 - May 2021

Conducted security assessments and contributed to the security community:

  • Education: Instructor for Master’s in Ethical Hacking program at San Pablo CEU University
  • Red Team: Planned and executed red team exercises for enterprise clients
  • Code Analysis: Security review of applications in multiple languages (NodeJS, C#, PHP, Ruby, Python, Java, Apex/Salesforce)
  • Technical Writing: Authored security research articles for company blog
  • Diverse Assessments: Web applications, mobile apps, infrastructure, APIs, ICS/SCADA systems, IoT devices
  • Specialized Testing: Industrial control systems and critical infrastructure security

Professional Certifications

Current Certifications

Specialized Training

  • 🔒 Offensive Driver Development - Zeropoint Security
  • 🦠 Malware Development Advanced - Sektor7
  • 🪟 Accelerated Windows API for Software Diagnostics

Currently Pursuing

  • 🎯 CRTO2 - Advanced Red Team Operations (AV/EDR evasion focus)
  • ☁️ CARTE - Certified Azure Red Team Expert
  • 🔬 Independent Research - Operating System internals, Web3 security and cloud

Contact

Feel free to reach out for security research collaboration, consulting inquiries, or speaking opportunities.