Gabe
Barrera
Cybersecurity · Systems · Automation
The Automator, Dashboard Dude, Hardware Hacker, Powershell Professional, Feral Foodie, Music Maker, Stanza Synthesizer
Build better nets. Don't hire more fishermen.
I'm Gabe, a Filipino security analyst in Microsoft cloud and identity environments, and I'd rather build the net than add another pair of hands. Before we had a SIEM, I built one: a homebrew event collection and alerting system in Azure that cut our time to detect by about 70%. Now I write KQL detections from fresh threat research, wire Sentinel, Logic Apps and Teams into one pipeline from alert to close, and automate the rest with PowerShell and the Graph API, so the hunt keeps running even when no one is watching.
Off the clock I build Raspberry Pi rigs, run language models with the cable unplugged, and make games where the defenders are as fun to play as the attackers.
- Watching
- Packet captures from a two-adapter Pi lab
- Building
- An offline assistant on a Raspberry Pi 5
- Playing
- An attacker-versus-defender heist game
About
I'm an Information Security Analyst II at the Port of San Diego. I hunt threats, harden identity, and automate the busywork out of incident response.
I studied computer science at San Diego State University and joined the Port as a software developer intern in 2018. That's where I helped the incident response team bring systems back after a company-wide ransomware attack, and it's why I moved to security in 2019.
Most days I'm in Microsoft Defender XDR and Sentinel, Palo Alto traffic and InfoBlox logs, hunting for anything that looks like compromise, then containing and cleaning it up within SLA. I write KQL detections from research on new threats and critical vulnerabilities. Before we had a SIEM, I built a central event collection and alerting system in Azure that cut our time to detect by about 70% and our time to respond by about 30%.
On the identity side, I rolled out Okta MFA and certificate-based authentication, audit Active Directory access, and harden machines to CIS benchmarks. I automate what I can with PowerShell, Logic Apps and the Graph API. I also review third-party SOC 2 and ISO 27001 reports, assess risk on new apps and vulnerabilities, and take apart suspicious executables in Ghidra.
Off the clock it's the same habit in a different shape: a Raspberry Pi packet lab, an offline AI assistant, and games where defenders get the good tools.
Experience
- 2019 – now
- Information Security Analyst → Information Security Analyst IIPort of San Diego
- 2018 – 2019
- Software Developer InternPort of San Diego · scripted deployments in PowerShell and Python, helped restore operations after a ransomware attack
- 2015 – 2019
- B.S. Computer ScienceSan Diego State University · Cyber Security, Machine Learning, Systems Programming, Data Structures
Notable work
- The Hunt
- Built detection alerts, learned to read and write Russian, and traced a chain of command to decide whether a highly suspicious user was legitimate.
- Sentinel Unified System
- Tied SolarWinds Service Desk, custom KQL analytics rules, Teams and Logic Apps into one pipeline for detecting and tracking security events from alert to close.
Tools
- Defend
- Microsoft Defender XDR, Azure Sentinel, Palo Alto, InfoBlox, Rapid7, Okta
- Hunt
- KQL, Ghidra, Any.Run, VirusTotal, ClamAV
- Build
- PowerShell, Python, JavaScript, PHP, SQL, Bash, Git, Postman
- Cloud
- Microsoft Azure, Intune, Microsoft 365, Logic Apps, Power Automate, Power BI, SolarWinds, Twilio
Bantay is Tagalog for guard, or the one who keeps watch. It is written here in Baybayin, the script of the Philippines before Spanish rule. It's the closest word I have for the job.
Projects
Things I've built to learn how systems behave. Each one taught me something I couldn't have read.
-
The Syslog
My blog, written in the same ink as this site. Tech write-ups on detections and home-lab builds, poetry, movies, and whatever else is worth logging, newest first.
-
Sentinel Unified System
One pipeline for security events at work: custom KQL analytics rules in Sentinel feed Logic Apps that open and update SolarWinds Service Desk tickets and post to Teams, so every detection is tracked from alert to close.
-
The Hunt
An investigation into a highly suspicious user. I built detection alerts around the account, learned to read and write Russian to follow the trail, and traced the chain of command to settle whether the account was legitimate.
-
Pi Packet Lab
A Raspberry Pi with two Wi-Fi adapters: one keeps the management link up while an ALFA adapter sits in monitor mode capturing frames. Captures go into Wireshark to baseline my own network and spot devices that talk more than they should.
-
Offline Assistant
A local language model on a Raspberry Pi 5 that runs its own Wi-Fi access point and serves a plain HTML chat page. Nothing leaves the device, so it works in a cabin, on a plane, or on a network you don't trust.
-
The Heist
A capture-the-flag game set inside a company building. Attackers work to lift the flag while defenders patrol, patch, and watch logs, all within a 30-minute in-game workday. It's built to make blue-team play feel as tense as red.
-
Slow Screen
A Raspberry Pi 3B+ driving a Waveshare e-Paper display over GPIO. It draws almost no power and only changes when something worth seeing changes, which suits a status board you glance at, not stare at.
Events
Where I'll be speaking, competing, reading, playing, or just listening. The bracketed entries are placeholder formats: replace them with real events from admin.html (Events → New event).
-
Format · Talk
[Talk title: e.g. Hunting with KQL before you have a SIEM]
[Venue or meetup] · [City] · [6:30 pm]
[One or two sentences: who it's for and what they'll leave with.]
-
Format · Workshop
[Workshop title: e.g. Build a packet-capture Pi in an afternoon]
[Makerspace or school] · [City] · [10 am to 1 pm] · [Seats / cost]
[What people bring, what they build, and what they take home.]
-
Format · Reading
[Featured reading, slam or poetry night]
[Venue] · [City] · [7 pm]
[Who's reading and what kind of night it is.]
-
Format · Performance
[Gig, set or release show]
[Venue] · [City] · [Doors 8 pm]
[What you're playing, who else is on the bill, and whether there's a cover.]
-
Format · Recurring
[Recurring jam session or music night]
[Venue] · [City] · [8 pm]
[Good for jams, residencies and regular nights. The date tile reads Every · 1st · Friday.]
-
Format · Competition
[CTF or competition name]
[Online or venue] · [Team name]
[Result, e.g. placed 4th of 60 teams, plus the challenge you're proudest of. Link it to a write-up on The Syslog.]
Contact
Send a letter. I read everything and reply to most.
Good reasons to write: collaborating on a build, a question about home-lab security, feedback on a game, or just to say kumusta.