Raúl Pastor

01 About

I lead IT and information security as a single function. That means making technology get out of people's way, by standardizing platforms and automating manual work, and making sure everything we run is secure by design.

My path runs from systems and network administration to ISO 27001 programs, cloud and Kubernetes platforms, and DevSecOps. I am equally comfortable designing a CI security pipeline, leading an incident response and walking an auditor through a control. On my own time I build small, self-hosted tools, mostly in Go and Python.

Off the clock: family, dogs, the gym, movies, and sci-fi and fantasy books. I own more board games than I have time to play, squeeze in RPGs, action, indie and retro games when I can, and run a Raspberry Pi homelab that hosts more services than it probably should.

02 Achievements

• Built a SIEM three times

  ELK, then Wazuh, now Microsoft Sentinel. Deployed as code, connected external sources, wrote and tuned detection rules, and wired alerting to PagerDuty, Opsgenie and JSM Operations with Teams and Slack integrations. In practice, a small SOC.

• IT and security merged into one function

  Led IT at three companies, with security and compliance in the same team, so controls are designed into operations instead of audited onto them.

• From bare metal to a modern platform

  Took a company running on aging physical servers to virtualized services and later containerized apps, with dedicated iSCSI storage, layered security, policies, MDM for endpoints, monitoring and, above all, backups that actually restore.

• If it repeats, it gets automated

  Onboarding and offboarding, access reviews, SIEM triage and reporting run as code, not as checklists. People spend their time on the cases that actually need judgment.

• ISO 27001:2022 audits, defended in person

  Maintained and extended an inherited ISMS and faced the auditors myself. Two internal and two external audits passed across two companies.

03 Experience

1. 2026 – now

   Head of IT & Security · Mimacom

   Lead the internal IT team, including the IT service desk, and own security for a technology consultancy: platform standardization, automation, identity and access management, incident response and hardening.

2. 2022 – 2026

   Head of IT & Compliance · Adhara

   IT, security and compliance for a fintech building payment and liquidity platforms for banks. Maintained and extended the ISO 27001:2022 ISMS, risk management, infrastructure, identity and vendors.

3. 2015 – 2022

   IT Manager · DISELCOM

   Led IT end to end. Moved the company from physical servers to virtualization and containers, added iSCSI storage, layered security, MDM, monitoring and a real backup strategy.

4. 2014 – 2015

   System Administrator · efeuno sistemas

   Windows and Linux administration, networking, backups and disaster recovery.

04 Skills & credentials

05 Projects

All projects →

06 Writing

• Oct 29, 2026 Hardening a personal domain in an afternoon, for freednsemail-securityhardening
• Oct 26, 2026 Node.js October 2026 security release: Brotli RCE and certificate checks fooled by odd IPsvulnerabilitiesnodejshunting
• Oct 24, 2026 PHP2Shell: two pre-auth RCEs in PHP itself, explainedvulnerabilitiesphphunting

All posts → · RSS

07 Principles

• A backup you haven't restored is a hope, not a backup.
• Controls belong in operations, not in a binder for the auditor.
• Leave every system better documented than you found it.
• Be the manager you would have wanted: listen, keep people learning, and never micromanage.