Ibai Gaztelu
Career ES Contact

  1. Cloud Security Engineer · Azure & AWS · DevSecOps

    Ibai Gaztelu Gandarillas

    I design, deploy and secure hybrid infrastructure, with Azure at the core and AWS for redundancy. Security goes in with the code and stays all the way to production.

    • Head of Cloud & Cybersecurity
    • SWAP Energía
    • San Sebastián

  2. WAF · DDoS · Segmentation

    Bad traffic stays at the gate.

    WAF and DDoS protection on both clouds: Application Gateway and Front Door on Azure, Shield in front of ALB and CloudFront on AWS. Behind them, networks segmented with NSGs and security groups.

    • Azure WAF
    • AWS Shield
    • NSG

  3. Threats · Vulnerabilities · Posture

    Every finding, followed until it is closed.

    Defender for Cloud and Sentinel on Azure, GuardDuty, Inspector and Security Hub on AWS, and Tenable for vulnerabilities. I prioritise by risk, and a finding is not closed until it is remediated.

    • Sentinel
    • GuardDuty
    • Tenable

  4. Identity · Zero Trust

    Nobody gets in by default.

    Entra ID with MFA, Conditional Access and PAM, and AWS IAM with least-privilege policies. Every access is verified, wherever it comes from.

    • Entra ID
    • AWS IAM
    • Conditional Access

  5. DevSecOps · Infrastructure as code

    Security starts at the commit.

    Infrastructure with Terraform, Ansible and PowerShell. Every pipeline scans code, dependencies and images, secrets never live in the repo, and containers ship hardened.

    • Terraform
    • CI/CD
    • Kubernetes

  6. Governance · Compliance · Continuity

    Security that survives an audit.

    ISO 27001, ENS, NIS2, GDPR and NIST controls as day-to-day work, with business continuity and disaster recovery plans. Before that, I wrote security master plans and ISO 27001 and ENS readiness projects for clients.

    • ISO 27001
    • ENS
    • NIS2

  7. San Sebastián · On-site, hybrid or remote

    Let’s talk.

    If you need someone to design and secure cloud infrastructure on Azure, AWS or both, drop me a line.

    Email meLinkedIn

Résumé

The career, without the animation.

Experience

  1. Head of Cloud Infrastructure & Cybersecurity

    SWAP Energía · DevSecOps Lead

    • Hybrid infrastructure with Azure and Microsoft 365 at the core and AWS for redundancy (networking, identity, compute and backup), with security controls mirrored across both clouds.
    • On Azure: WAF on Application Gateway and Front Door, DDoS Protection, Defender for Cloud and Sentinel, Azure Policy, Azure Monitor with Log Analytics, Update Manager and NSG segmentation.
    • On AWS: WAF and Shield in front of ALB and CloudFront; GuardDuty, Inspector and Security Hub with triage and follow-up of every finding until remediation; AWS Config, CloudWatch and Systems Manager for auditing, alerting and patching.
    • Identity with Entra ID (MFA, Conditional Access and PAM) and AWS IAM under least privilege and Zero Trust.
    • Terraform, Ansible and PowerShell; code, dependency and image scanning in CI/CD; secrets management and hardening of containers and Kubernetes. ISO 27001, NIST, GDPR and NIS2 controls, and BCP/DRP plans.

  2. Cybersecurity Engineering Consultant

    Wise Security (Var Group)

    • Vulnerability and exposure management with Tenable (VM, Cloud, OT and Nessus) across on-premise and cloud environments.
    • Risk-based remediation and technical pre-sales: proofs of concept, demos and deployments.

  3. Senior GRC Consultant

    GOVERTIS (Telefónica Tech)

    • Cybersecurity training and awareness programmes for clients.

  4. Junior Cybersecurity Analyst / Consultant

    Wise Security (Var Group)

    • Perimeter security with Sophos Firewall and Fortinet, and EDR/XDR with Sophos Central and Cynet.
    • IAM, PAM, IGA and DLP projects, security master plans and ISO 27001 and ENS readiness.
    • Certified technical partner for Tenable, Cynet and Sophos.

  5. Infrastructure, Cybersecurity & Systems Manager

    Kuik!

    • Servers, users and workstations, network and Sophos firewall, endpoint with Sophos Central, and backups.

  6. Cyber & Network Specialist

    Viralgen Vector Core · Traineeship

    • Network security with Fortinet, OT network protection and ISMS support in the pharmaceutical sector.

Stack

Cloud & DevSecOps

  • Azure
  • AWS
  • GCP
  • Microsoft 365
  • Entra ID
  • Terraform
  • Ansible
  • Docker
  • Kubernetes
  • CI/CD
  • PowerShell
  • Python

Azure security

  • Defender for Cloud
  • Sentinel
  • Azure WAF
  • DDoS Protection
  • Azure Policy
  • Azure Monitor
  • Update Manager
  • NSG

AWS security

  • AWS WAF
  • Shield
  • GuardDuty
  • Inspector
  • Security Hub
  • AWS Config
  • CloudWatch
  • Systems Manager
  • Security Groups
  • IAM

Security

  • Tenable / Nessus
  • EDR / XDR
  • Sophos
  • Cynet
  • Fortinet
  • PAM
  • IGA
  • DLP
  • MFA
  • Conditional Access
  • Zero Trust

GRC & systems

  • ISO 27001
  • ENS
  • NIS2
  • GDPR
  • NIST
  • BCP / DRP
  • Windows Server
  • Linux
  • VLAN / VPN
  • Backup

Certifications

Tenable

  • MSSP Practitioner2025
  • Nessus Expert – Sales Engineer2025
  • Cloud Security Specialist2024
  • Vulnerability Management Specialist2024
  • Vulnerability Management – Sales Engineer2024

Sophos

  • ET80 Firewall v19.5 Engineer
  • ET15 Central Endpoint & Server

Anthropic

  • Claude with Vertex AI · Amazon Bedrock2026
  • Claude Code 101 · Claude 1012026

Education

  • BSc in Computer EngineeringUniversitat Oberta de Catalunya · Information Systems · in progress
    2026–2030
  • Specialisation in OT CybersecurityCIFP Easo Politeknikoa LHII
    2022–2023
  • Higher VET Diploma in Industrial Automation & RoboticsCIFP Easo Politeknikoa LHII
    2020–2022
  • VET Diploma in Electrical & Automated InstallationsCIFP Easo Politeknikoa LHII
    2018–2020

Also: Full Stack Developer (Udemy, 2022), Advanced Python (Tokio School, 2022) and AI & prompt engineering (Founderz, 2025).

Languages

  • SpanishNative
  • BasqueNative
  • EnglishFull professional proficiency