Gabriel Lessa

Gabriel Santa Rosa
Lessa

Cybersecurity Risk Management · Vancouver, BC

Building practical skills in SOC operations, threat intelligence, cloud security, and homelab infrastructure.

LinkedIn GitHub Resume

About

Dual-background cybersecurity student with hands-on project experience.

I am a Cybersecurity Risk Management student at the Canadian College of Technology and Business (CCTB) in Vancouver, BC, with a prior Associate Degree in Cyber Defense from Estácio de Sá University in Brazil.

My current focus areas include SIEM operations, incident response (NIST SP 800-61), Cyber Threat Intelligence (MITRE ATT&CK mapping), cloud security on AWS, network reconnaissance with Nmap/Wireshark/Scapy, and defense-in-depth security architecture.

Beyond coursework, I maintain a personal Proxmox VE HomeLab running 12+ production services in isolated LXC containers, practicing real-world Zero Trust networking, SSO integration, SIEM monitoring, and infrastructure automation.

0+ HomeLab Services
0h TryHackMe Labs
0+ Academic Projects
0 Degrees

Technical Skills

Core competencies and tools

Cybersecurity & SOC

Threat intelligence (MITRE ATT&CK), incident response (NIST SP 800-61 / CSF 2.0), SIEM, IDS/IPS, EDR, log analysis, defense-in-depth architecture.

Networking

TCP/IP, DNS, DHCP, Nmap, Scapy, Wireshark, tcpdump, pfSense, Cisco Packet Tracer, WireGuard VPN, network segmentation.

Cloud & Infrastructure

AWS EC2/VPC/ALB, Proxmox VE, Docker, LXC containers, VMware, VirtualBox, Linux server admin (Ubuntu, Kali, Debian).

Development & Automation

Python, Django, REST APIs, MongoDB, Bash scripting, Git/GitHub multi-branch workflows, CI/CD, infrastructure-as-code.

Analytical & SOC Skills

Root-cause analysis, alert triage, escalation workflows, CTI reporting, risk assessment, RACI matrices, stakeholder documentation.

IT Support & Operations

Help desk, troubleshooting, AV equipment, reverse proxy (Nginx), DNS filtering (AdGuard), monitoring (Uptime Kuma), SSO (Authentik).

HomeLab & CyberLab

Personal Cybersecurity Infrastructure

A self-built Proxmox VE environment running on dedicated hardware, designed as a Zero Trust cybersecurity lab. All services run in isolated unprivileged LXC containers with encrypted VPN mesh access, centralized SSO authentication, and automated monitoring.

SYS_TOPOLOGY

Architecture Overview

Hypervisor Proxmox VE 9.x
Hardware Custom Low-Power Microserver · 32 GB DDR4 · SSD Storage
Network Isolated Bridges (vmbr0/1/2) · WireGuard Mesh VPN
Access Zero Port Forwarding · SSH Ed25519 · SSO + WebAuthn Passkeys
DNS & SSL Wildcard SSL (Let's Encrypt + DNS Challenge) · AdGuard Home

Core Production Services 24/7 Zero-Trust Mesh

OPNsense Firewall

Virtualized firewall/router with VLAN segmentation, reply-to rules for reverse proxy, and air-gapped network isolation for malware analysis.

Authentik SSO

Central Identity Provider with OIDC/OAuth2, WebAuthn/Passkeys biometric MFA, and step-up authentication for all services.

Nginx Proxy Manager

Reverse proxy with wildcard SSL certificates via DuckDNS DNS-Challenge, WebSocket support, and HTTP/2 secure routing.

Vaultwarden

Self-hosted Bitwarden-compatible password manager with SSO integration, disabled public signups, and encrypted vault.

Matrix Synapse + Element

Federated encrypted messaging with OIDC SSO integration, LiveKit WebRTC voice/video, and role-based access control.

Uptime Kuma

Infrastructure monitoring with 18+ service monitors, status page, alerting, and real-time health telemetry.

AdGuard Home

Network-wide DNS filtering and ad blocking for all HomeLab containers, with query logging and analytics.

SimpleLogin

Self-hosted email alias service (Proton-compatible) for privacy-focused email management and anti-spam protection.

AI Agent Workspace

Dedicated container for autonomous AI coding agents with Docker, Ollama local LLM inference, and multi-agent orchestration.

OmniRoute AI Gateway

Intelligent AI API router with rate-limit management (RPM/RPD), multi-provider load balancing across free-tier LLM APIs.

Dozzle & Homepage

Real-time Docker log viewer and unified dashboard with Proxmox API telemetry for infrastructure overview.

Elastic Auto-Scaler & Vault

Native Python cgroups v2 governor (+1GB RAM under load, -256MB decay) and Zero-Knowledge memory-only secret vault.

ZERO_TRUST

Security Architecture Highlights

Zero Trust Access

No ports exposed to the public internet. All access routed through encrypted NetBird WireGuard mesh VPN overlay.

SSH Hardened

Password authentication disabled. Ed25519 key-only access with root login restricted to cryptographic keys.

Multi-Bridge Network Isolation

Triple bridge segmentation (vmbr0 production, vmbr1 air-gapped lab, vmbr2 Tor gateway) with firewall isolation.

Centralized SSO + Passkeys

WebAuthn biometric authentication via Authentik for all critical services with step-up verification.

Elastic Resource Governor

Native Python cgroups v2 auto-scaler dynamically managing memory pressure (+1GB/-256MB) and preserving host stability.

Zero-Knowledge Secret Vault

Shannon entropy evaluation and indirect memory-only injection ensuring credentials never touch disk unencrypted.

CYBERLAB_ON_DEMAND

Isolated CyberLab Capabilities

Specialized testing environments activated on-demand across isolated internal bridges (vmbr1 / vmbr2) to preserve hypervisor resources and prevent lateral movement into production.

Air-Gapped Malware Analysis Sandbox — Completely air-gapped subnet (vmbr1: 172.16.0.0/24) with INetSim simulating web/DNS/mail services for safe malware detonation and DFIR artifact extraction.
Active Wazuh SIEM / XDR — Endpoint telemetry ingestion, custom detection rules, and automated event correlation for continuous security monitoring.
Threat Intel OpenCTI Platform (CT 120) — Structured Cyber Threat Intelligence management, STIX 2.1 data feed ingestion, and MITRE ATT&CK enterprise adversary mapping.
Assessment DefectDojo & SpiderFoot (CT 121) — Vulnerability tracking, automated reporting pipeline, and OSINT attack surface reconnaissance.
Dark Web Robin AI & Whonix Gateway (CT 119) — Dedicated Tor onion-routing gateway on isolated bridge (vmbr2) for OSINT and dark web investigations with zero host IP leakage.
Red Team Active Directory Attack Lab — Windows Server domain controller and workstation pair for practicing Kerberoasting, AS-REP roasting, and pass-the-hash privilege escalations.

Projects & Labs

Academic and hands-on cybersecurity projects

Production Architecture · 2026

Proxmox Zero-Trust Infrastructure & Autonomous AI Agent Platform

Proxmox VE · cgroups v2 Auto-Scaler · Zero-Knowledge Vault · Multi-Bridge Isolation · OmniRoute AI Gateway

Architected, deployed, and automated a hardened Proxmox VE hypervisor running 12+ core production services and on-demand air-gapped cyberlabs. Engineered a native Python tri-resource elastic auto-scaler (+1GB RAM under load with 256MB graceful decay via cgroups v2), an in-memory Zero-Knowledge secret vault with Shannon entropy quarantine, multi-bridge network segmentation (vmbr0 production, vmbr1 air-gapped, vmbr2 Tor gateway), and an autonomous AI multi-agent orchestration engine with 100% offline local LLM fallback.

Elastic Auto-Scaler Zero-Knowledge Vault cgroups v2 Air-Gapped Sandbox WireGuard Mesh OmniRoute AI MITRE ATT&CK
Academic Project · 2026

Cyber Threat Intelligence (CTI) & Adversary Intrusion Assessment

MITRE ATT&CK · NIST SP 800-61 · PowerShell · Registry Analysis

Analyzed a multi-stage enterprise intrusion involving spearphishing (.docm), PowerShell execution, and SAM registry credential dumping. Mapped threat actor tactics to MITRE ATT&CK and authored a comprehensive CTI report with containment strategies aligned with NIST CSF 2.0.

Pass-the-Hash SAM Registry Incident Response CTI Report
Academic Project · 2026

Enterprise Security Architecture & SOC Operating Model

Defense-in-Depth · SOC Tiers · RACI Matrix · NIST CSF 2.0

Designed a multi-site enterprise network protecting a HQ Data Center, DMZ with 200 VMs, and 7 remote branches. Defined SOC operational framework with RACI matrix across Tier 1–3, Threat Hunting, DFIR, and Detection Engineering. Integrated Palo Alto WildFire, Thinkst Canary, and Proofpoint.

Palo Alto NGFW Honeypots Detection Engineering Segmentation
Academic Project · 2025–2026

AWS Cloud Infrastructure & Database Security Automation

AWS EC2 · VPC · Python/Django · MongoDB · REST APIs

Built multi-tier applications on AWS EC2 with secure Python/Django backends connected to remote MongoDB. Provisioned VPC subnets, Security Groups, and Load Balancers. Integrated Cisco DNA Center and OpenRouteService REST APIs with Git multi-branch workflows.

AWS VPC Load Balancing REST APIs Git Workflows

TryHackMe Cybersecurity Labs

Networking · Linux · Security Fundamentals · 32h+ Completed

Completed the CAPTSTONE_JAN 2026 Learning Path (32h 30min) with hands-on labs in networking, Linux, and cybersecurity concepts.

Hack The Box Academy Learning

Networking Fundamentals · Cybersecurity Practice

Guided modules reinforcing networking fundamentals, structured learning, and practical cybersecurity problem solving.

Certifications & Learning

Verified achievements

TryHackMe – CAPTSTONE_JAN 2026

Learning Path · 32h 30min

Completed July 27, 2026

✓ Verified

Hack The Box Academy

Networking · Cybersecurity Modules

Ongoing

In Progress

CCTB Cybersecurity Coursework

SOC · Risk Management · Cloud Security · CTI

Diploma Program · 2025 – Present

In Progress

Experience

Professional and volunteer experience

Student Check-in Assistant

Aug 2025 – Present

StayWise Accommodations · Vancouver, BC

  • Support student check-ins/check-outs with clear guidance during arrivals and departures.
  • Coordinate move-ins, key handoffs, late check-ins, and accommodation instructions.
  • Apply attention to detail, communication, and customer service skills daily.

Volunteer Technical Support / Camera Operations

Jun 2025 – Aug 2025

Faith Fellowship Baptist Church · Vancouver, BC

  • Supported live camera operations for weekly services and special events.
  • Assisted with technical troubleshooting for audio-visual equipment.
  • Ensured smooth video production and reliable technical setup.

Operations Assistant

Jan 2018 – Dec 2020

Granulado Brigaderia · Niterói, RJ, Brazil

  • Supported daily operations including customer service, cash handling, and POS systems.
  • Managed inventory organization and general operational tasks.
  • Developed skills in responsibility, communication, and time management.

Education

Academic background

Diploma in Cybersecurity Risk Management

May 2025 – Expected May 2028

Canadian College of Technology and Business (CCTB) · Vancouver, BC

Coursework: SIEM, incident response, network security, threat intelligence, cloud security, Linux/Windows security, risk management, and business continuity, followed by cybersecurity co-op placement.

Associate Degree in Cyber Defense

2020 – 2022

Estácio de Sá University · Brazil

Foundational studies in cybersecurity, information security, networking, systems, and cyber defence concepts.

Contact

Open to co-op, internship, and entry-level cybersecurity opportunities.

Based in Vancouver, BC. Available for SOC analyst, IT support, technical support, network support, and cybersecurity roles.

Connect on LinkedIn Download Resume GitHub Profile