OPOmar Passos
Menu
ProfileConsultingIntelligenceAnalyticszynTRIQExperienceCertificationsContact

Information Security Leadership

Omar Passos

CISO • Threat Intelligence • Corporate Investigations • Founder of zynTRIQ

I lead security that speaks the language of the SOC, the auditor and the board. I build ISMS/ISO 27001, RBVM, SOC and incident response programs that prioritize what actually threatens the business, and I turn exposure and vulnerabilities into risk measured in money. I also work in threat intelligence and corporate investigations.

Hire me as a consultantWhatsAppLinkedInDownload CV (PDF)
  • 15+years in technology, 12+ dedicated to security
  • −60%average vulnerability triage time (zynTRIQ)
  • −45%critical backlog with RBVM and SLA governance
  • CISOfrom analyst to CISO at TOTVS, Copel, DNIT and scale-ups

You are a

Experience at
  • zynTRIQ
  • Task TI
  • Copel
  • TOTVS
  • meutudo.
  • Exago Innovation
  • Rentcars.com
  • DNIT
  • Levier Tecnologia

Profile

Most companies only find out what they have exposed on the internet when someone outside finds it first.

And no answer to the question the board actually asks:

How much risk are we running, in money?

In more than 15 years in technology and security, I have watched this movie play out again and again:

  • Thousands of vulnerabilities in the scanner and a critical backlog that never closes.
  • Too many alerts, a team drowning in triage and missed remediation deadlines.
  • Every audit turns into a race against the clock.
  • When an incident hits, there isn't enough evidence to reconstruct what happened and decide fast.

My job is to turn that around.

From DNIT, TOTVS and Copel to scale-ups, from analyst to CISO, I have built ISMS/ISO 27001, RBVM programs, SOCs and incident response that prioritize what actually threatens the business.

  • −60%average vulnerability triage time
  • −45%critical backlog with RBVM and SLA governance

Corporate Intelligence and Digital Investigations

OSINT, evidence analysis, third-party risk and incident reconstruction to support business decisions.

That experience gave birth to zynTRIQ

An Attack Surface Management, Vulnerability Intelligence and GRC platform that connects exposure, vulnerabilities and financial risk (FAIR), aligned with ISO 27001, LGPD, PCI-DSS, CIS Controls and PPSI 2.0.

Credentials
  • CISM
  • SANS FOR508 (DFIR)
  • ISO 27001
  • LGPD/DPO
  • 320h in Neural Networks and Deep Learning applied to detection

If you are looking for security leadership that speaks the language of the SOC, the auditor and the board, let's talk.

WhatsAppLinkedInSend an email

Freelance • Consulting

Available for freelance and consulting projects

With 15+ years in Information Security (CISM, ISO 27001, LGPD/DPO, SANS FOR508), I support companies, law firms and partners on one-off or ongoing engagements.

  • vCISO

    vCISO / CISO as a Service

    Security leadership for companies that don't have a CISO yet.

    • Security roadmap and budget
    • Metrics and board reporting
    • Policies and ongoing governance
  • GRC

    ISO 27001 and LGPD

    Compliance programs, gap analysis and DPO as a Service.

    • ISO/IEC 27001 gap analysis
    • LGPD program and DPIA
    • Outsourced Data Protection Officer
  • ASM

    Attack Surface

    Mapping internet-facing assets and exposed risks.

    • External asset inventory
    • Risk-ranked exposures
    • Remediation plan with SLAs
  • DFIR

    Incident Response and Digital Forensics

    Investigation and evidence analysis.

    • Containment and eradication
    • Incident timeline
    • Technical report with chain of custody
  • OSINT

    OSINT and Due Diligence

    Digital investigations and third-party risk.

    • Company and shareholder background checks
    • Vendor risk assessment
    • Intelligence report
  • EDU

    Training and Mentoring

    Team enablement and talks.

    • Awareness and gamification
    • Security team mentoring
    • Talks and workshops

Engagement models

  • Fixed-scope projectDefined scope, timeline and deliverables. Suited to gap analyses, attack surface mapping or investigations.
  • Monthly retainerRecurring hours for vCISO, DPO as a Service or continuous exposure monitoring.
  • On demandAd-hoc support for incidents, audits, technical opinions and talks.

If your company (or a client of yours) needs security support, send me a direct message.

Message on WhatsAppMessage on LinkedInSend an email

+55 41 99968-1251 • omar.ctba@gmail.com • linkedin.com/in/omarpassos

Partnerships with consulting firms and law firms are welcome.

Threat Intelligence • Corporate Investigations

Intelligence that drives decisions

I use threat intelligence and digital investigation to answer concrete questions: who could attack us, how, what has already leaked, and who we are doing business with.

CTI

Threat Intelligence

Strategic, tactical and operational threat intelligence, tied to the attack surface and to SOC operations.

Exposure monitoring
Leaked credentials and data, forgotten assets and internet-facing services.
Vulnerability Intelligence
Prioritization by real exploitability, active exploitation and asset context.
TTPs and IOCs
Adversary mapping with MITRE ATT&CK and alert enrichment in the SIEM.
Executive reporting
Sector threat scenarios translated into risk and recommendations for the board.
INV

Corporate Investigations

Corporate intelligence and due diligence supporting legal, compliance and leadership in sensitive decisions.

Due diligence and third-party risk
Background on companies, shareholders and vendors ahead of contracts and M&A.
Internal investigations
Fraud, information leaks and misuse of access.
Evidence analysis
Collection and preservation with chain of custody, backed by SANS FOR508 training.
Incident reconstruction
Timelines, technical attribution and reports fit for legal and regulatory use.

Intelligence cycle

  1. 01PlanningIntelligence question, scope and legal basis agreed with the client.
  2. 02CollectionOSINT, technical sources and internal evidence, by lawful means only.
  3. 03ProcessingNormalization, correlation and evidence preservation.
  4. 04AnalysisHypotheses tested, confidence levels and gaps stated.
  5. 05DisseminationExecutive and technical report with actionable recommendations.

Every investigation complies with Brazil's LGPD, uses only lawful sources and methods, and is handled under confidentiality.

Skills analytics

Qualifications in numbers

Comparisons and correlations across the Information Security areas I work in. Levels are a self-assessment based on my career, projects and certifications.

Profile vs. role requirements

Pick a role to compare my level with what it usually requires. The margin is the average number of points above (or below) the requirement.

50100LEADGRCVULNOFFSOCDFIRCTIINVCLOUD
  • Omar Passos
  • Role requirement
View data as a table
AreaMy levelvCISO / CISOThreat Intel and InvestigationsSOC / DFIR leadSecurity Architect
Leadership and management9695607565
GRC and privacy9595556075
Vulnerabilities / RBVM9480707580
Offensive security8550606570
SOC and detection9270759575
Incident response and forensics8870859555
Threat Intelligence9065958060
Investigations and OSINT8845957035
Cloud and architecture8675557595

Knowledge correlation

How much practice in one area reinforces another in my work. Hover to see each pair.

GRCVULNOFFSOCDFIRCTIINVCLOUDLEADGRCVULNOFFSOCDFIRCTIINV
Strength
  • Weak
  • Moderate
  • Strong

Strongest connections

  • SOC ↔ DFIR ↔ CTI

    Detection, response and intelligence form one chain: every incident feeds new detections and threat hypotheses.

  • VULN ↔ CTI

    Vulnerability Intelligence: I prioritize fixes by observed active exploitation, not CVSS alone.

  • DFIR ↔ INV

    Forensic discipline (SANS FOR508) brings chain of custody and rigor to corporate investigations.

  • GRC ↔ VULN

    RBVM tied to business risk, SLAs and audit. It is the foundation of zynTRIQ.

Certifications and courses by track

30 credentials in total, including CISM, SANS FOR508, EXIN PDPE and ISO/IEC 27001.

  • Governance, risk and privacy11
  • Networks, infrastructure and cloud6
  • Offensive security4
  • Data, AI and programming4
  • Forensics and investigations3
  • General cybersecurity2

How each area evolved over my career

Periods of hands-on work in each area, based on my career history.

2008201020122014201620182020202220242026LEAD9 yearsGRC7 yearsVULN8 yearsOFF8 yearsSOC10 yearsDFIR6 yearsCTI3 yearsINV6 yearsCLOUD6 years
  • LEAD Leadership and management
  • GRC GRC and privacy
  • VULN Vulnerabilities / RBVM
  • OFF Offensive security
  • SOC SOC and detection
  • DFIR Incident response and forensics
  • CTI Threat Intelligence
  • INV Investigations and OSINT
  • CLOUD Cloud and architecture

Skills

Leadership and technical skills

People and operations

  • Leading specialists
  • Resource allocation
  • Performance management
  • SLAs and metrics

Governance, risk and compliance

  • ISMS (ISO/IEC 27001)
  • LGPD/DPO
  • PCI-DSS
  • CIS Controls
  • PPSI 2.0
  • Third-party risk
  • Audits

Vulnerability management

  • RBVM
  • Attack Surface Management
  • Pentest and Purple Team
  • FAIR

Detection and response

  • SOC strategy
  • SIEM (ELK)
  • EDR/XDR
  • SOAR
  • DFIR
  • Playbooks

Intelligence and investigations

  • Threat Intelligence
  • Corporate Intelligence
  • Due Diligence
  • OSINT
  • Evidence analysis

Technical foundation

  • AWS, Azure and GCP
  • Architecture and hardening
  • DLP and classification
  • Python, Go and Ruby
  • Reverse engineering (ethical)

My product

zynTRIQ

An Attack Surface Management, Vulnerability Intelligence and GRC platform that I designed and lead. It connects external exposure, vulnerabilities and financial risk (FAIR) to answer what to fix first.

Visit zynTRIQ ↗Executive product overview (interactive) ↗Platform mind map (interactive) ↗
  • Attack surfaceContinuous discovery of internet-facing assets and services.
  • Vulnerability IntelligencePrioritization by exploitability, exposure and asset context.
  • GRCControls mapped to ISO 27001, LGPD, PCI-DSS, CIS Controls and PPSI 2.0.
  • Risk in moneyFAIR quantification to talk to the board in business terms.
apivpnmails3rdpcdndev
Continuous attack surface scanning (illustration)

How zynTRIQ turns exposure into decisions

  1. 01
    DiscoveryInternet-facing assets and services
  2. 02
    Vulnerability IntelligenceActive exploitation and asset context
  3. 03
    FAIR riskEstimated impact in money
  4. 04
    DecisionWhat to fix first, with SLAs

What sets it apart

  • ASM, Vulnerability Intelligence and GRC in one platform
  • Risk translated into money (FAIR) for the board
  • Built by someone who has run SOC, RBVM and GRC hands-on
  • Controls mapped to LGPD, PCI-DSS, CIS Controls and PPSI 2.0

zynTRIQ

Investors and partners

zynTRIQ is in active development, led by a technical founder with 15+ years in security. I'm open to conversations with investors, accelerators and strategic partners.

Talk about zynTRIQzyntriq.com.br ↗

Career

Career history

  1. Jul 2023 – present

    Founder & Head of Cyber Security · zynTRIQ

    São Paulo, Brazil

    • Designed and lead zynTRIQ, an ASM, Vulnerability Intelligence and GRC platform with risk quantification (FAIR).
    • Cut average finding triage time by ~60% through automation (Python, Go, Ruby) and standardized processes.
    • Designed data protection controls (discovery, classification, tokenization, masking and DLP) integrated with SIEM (ELK), detecting exfiltration in the cloud.
    • Set the security roadmap and policies aligned with ISO/IEC 27001, LGPD, PCI-DSS, CIS Controls and PPSI 2.0.
  2. Dec 2024 – Jul 2025

    Cyber Defense Center Coordinator · Task TI

    Curitiba, Brazil

    • Defined SOC strategy and operating model, selecting and deploying IVM, IDR, ASM, DFIR, MDR and OSINT solutions.
    • Led and developed a team of specialists, including resource allocation, performance tracking and delivery management.
    • Coordinated incident investigation and response from containment to recovery, including business communication.
  3. Jul 2024 – Oct 2024

    Information Security Architect · Copel

    Curitiba, Brazil

    • Designed and implemented security architecture with continuous risk assessment in a large-scale enterprise environment.
    • Implemented, monitored and validated security controls and ran awareness initiatives.
  4. Dec 2022 – May 2024

    Information Security Specialist · meutudo.

    Fortaleza, Brazil (remote)

    • Built the fintech's security program: security policy, ISMS, RBVM and third-party risk, cutting the critical backlog by 45%.
    • Deployed monitoring with SIEM (ELK) dashboards and network controls (pfSense, Snort and Suricata IDS/IPS).
    • Ran Pentest and Purple Team work and led a gamified awareness program.
  5. Jan 2022 – Nov 2022

    CISO · Exago Innovation

    Portugal (remote)

    • Owned company information security, rolling out a security and compliance program with RBVM, ISMS and third-party risk.
    • Led application security, human-factor risk and cybersecurity culture initiatives.
  6. Dec 2020 – Jan 2022

    Senior Information Security Analyst · TOTVS

    Curitiba, Brazil

    • Contributed to the security policy and RBVM/ISMS program at one of Brazil's largest software companies.
    • Ran penetration tests and Purple Team exercises validating perimeter and detection controls.

Earlier experience

  • Aug 2018 – presentSecurity Consultant, Pentester and Bug Bounty · IndependentPenetration testing, reverse engineering and DDoS response.
  • Dec 2019 – Aug 2020Security Analyst / Pentester · Rentcars.comPentesting, vulnerability management, incident investigation and LGPD.
  • Jun 2014 – Jun 2018Network Security Analyst · DNITDigital forensics, SIEM, DDoS analysis, Fortigate firewalls and VPNs.
  • Jul 2008 – Nov 2012IT and Projects Coordinator · Levier TecnologiaInfrastructure, data and neural-network-based systems.

Credentials

Certifications and education

  • CISMCertified Information Security ManagerISACA
  • SANS FOR508Advanced Computer Forensics & Incident ResponseSANS Institute, 2012
  • EXIN PDPEPrivacy & Data Protection Essentials (LGPD)EXIN, 2020
  • ISO/IEC 27001Foundation EssentialsPMG Academy, 2020

Education

Business Administration, Foreign Trade emphasis — PUC-PR, Brazil (1998 – 2004)

Additional courses

Governance, risk and privacy
CIS Controls (ENAP, 2024) • LGPD (ENAP, 2019) • CRISC (Cybrary, 2019) • Contemporary Digital Law (Unieducar, 2019) • CISSP, CISA, CISM and PMP prep (CIP Cyber, 2019)
Offensive security
OSCP – Kali Linux • Practical Ethical Hacking (Udemy) • CEH v10 (CIP Cyber, 2019) • Physical Penetration Testing (Cybrary, 2019)
Forensics and investigations
Introduction to Criminalistics (Unova, 2019) • Hidden Website Using TOR (CIP Cyber, 2019)
Networks, infrastructure and cloud
CompTIA Network+ (Cybrary) • Network Security (WR Educacional, 2019) • Cisco Labs/GNS3 and EIGRP (CIP Cyber, 2019) • Cloud Computing Fundamentals (SOFTEX, 2019)
Data, AI and programming
Neural Networks and Deep Learning, 320h (TensorFlow/PyTorch) • CS50 (Harvard / Fundação Estudar, 2023) • Data Science (DSA, 2019) • Python (Udemy)

Contact

Let's talk

For consulting, freelance projects, talks or security leadership roles.

Email
omar.ctba@gmail.com
WhatsApp
+55 41 99968-1251
LinkedIn
linkedin.com/in/omarpassos
zynTRIQ
zyntriq.com.br
Location
Curitiba, Brazil (remote/hybrid)
Chat with me on WhatsApp