AC ES/EN

Madrid · Spain

Andrés Álvarez de Cienfuegos

Information & Data Security · BBVA

I define how data is protected across the global areas of an international bank and take it down to where it applies: to the technology that stores it and the business that uses it. Before that, cybersecurity continuity and resilience from the consulting side. Off the clock I design the architecture and security of my own services, in a homelab with a sandbox where getting it wrong costs nothing.

Let’s talk Download CV
01

Career

  1. Present since May 2024

    BBVA

    Information & Data Security Manager

    Data protection and security in a global banking group, focused on the confidentiality and privacy of personal data. I take the group’s directives down to over a hundred business-critical applications, where the challenge is the breadth of technologies: a decades-old legacy system has to be protected just as well as an application running in public cloud or with AI in the mix. The same goes for the data loss prevention controls on user endpoints, where the point is not to block but to offer the safe route to do what the business needs, and to explain the risk in their own terms.

    I also led the group’s governance model for information leaving the bank: every way of sharing data with third parties, boiled down to four channels and two tools. All of it runs on coordinating very different stakeholders, from twelve different business units to engineering, global security and the security teams across fifteen geographies, as well as managing a five-person external team.

    • Information classification
    • DLP
    • Privacy
    • RGPD
    • Information egress governance
    • Business stakeholders
    • Team coordination
  2. 2022 — 2024 1 yr 8 mos

    GMV

    Cyber Security Continuity & Resilience Consultant

    Cybersecurity, continuity and resilience for clients in banking, the public sector, telecoms and automotive, both as a consultant and as an auditor. On the continuity side, designing everything from impact analysis to recovery plans and the drills that put them to the test. In automotive, I built on the vehicle’s existing threat analysis, starting from its positioning system: there, data confidentiality stops being the only consideration and the physical safety of the people inside comes into play. In consulting the first thing is never to start writing: it is understanding the company you are working with, because whatever does not match how they actually work is good on paper and little else.

    • BCP / DRP
    • BIA
    • ISO 22301
    • ISO 27001
    • ISO 31000
    • Auditing
    • Automotive
    • UNECE R155
    • TARA
    • Safety
  3. 2021 — 2022 UPM internship

    ACCIONA

    Cyber Security Intern

    Supporting the different security teams, which turned out to be the best way to see the discipline from every angle at once. I automated internal processes and built a visual mapping tool on top of MITRE ATT&CK so that all those teams could look at the same map: which techniques were covered, where the gaps were and where to aim the pentest exercises.

    • MITRE ATT&CK
    • Python
    • Automation
  4. 2018 — 2022 degree

    Universidad Politécnica de Madrid

    Bachelor’s degree in Telecommunication Technologies and Services Engineering (Telematics) · Bilingual Academic Programme

    Networks and protocols, distributed services and programming, plus my first exposure to security. Though what lasts longest from an engineering degree is not any one course: it is the mindset of starting from the problem and not stopping until it is solved, learning along the way. My final project was the application I built at ACCIONA — database, API, interface and containers — validated against four use cases, from threat intelligence to adversary emulation. And four years in a theatre group, where you learn to lose your stage fright and to read the room.

Certifications & awards

  • ISO 22301 Lead Implementer BSI · 2023
  • UNECE/R155 Cybersecurity for Vehicles Advanced Fleet Management Consulting · 2022
  • C1 Advanced Cambridge English · 2017
  • RYLA — Leadership programme Rotary International · Iowa, USA · 2016
02

Projects

Personal projects where I learn by building what I need, and that end up running on my own infrastructure.

01

AgentOS

Agent orchestrator

My own dashboard for putting Claude agents to work. I open a PR and it comes back reviewed; I leave tasks scheduled overnight and by morning they are done. It ships with agents for the things I do often — reviewing code, hunting leaked secrets and vulnerabilities — plus a generic one for whatever else I type in. I watch it work live, line by line, instead of waiting until the end to find out whether it was going well. And it carries a monthly spend cap, because an agent stuck in a loop should not get expensive.

  • FastAPI
  • ARQ + Redis
  • SSE
  • APScheduler
  • Next.js
  • Docker
View repository
02

TripPlanner

Web + Android

The whole trip lives here: flights, stays, activities, expenses, packing and documents in one place, instead of scattered across screenshots, emails and phone notes. And filling it in takes no typing: paste the airline’s email or whatever a chatbot gives you back and it sorts itself. The Android app runs with no account and no connection, on a plane or somewhere with no signal, which is exactly where you need to check the plan. It also carries a dive log inside, because I wanted one.

  • Next.js
  • TypeScript
  • Zod
  • Prisma
  • PostgreSQL
  • Expo
  • SQLite
View repository
03

Home automation

Two homes, separate network

Two homes automated and run from the same place: lights, plugs, climate and the whole living room. It answers to voice, to the phone and to the wall panel, but what you notice most is what nobody has to touch — schedule-driven routines, things that fire when you get home, and sensors that start the heating or ping you without anyone asking. The devices live on their own VLAN, isolated from the rest of the network, and when an integration needs to cross it gets exactly the opening it needs rather than the whole segment. From outside you come in through a tunnel, with the router’s ports closed and two-factor auth.

  • Home Assistant
  • HAOS
  • Google Assistant
  • HomeKit local
  • VLAN IoT
  • 2FA
03

Homelab

This is where I tinker. I build things to understand them from the inside, break them and bring them back up, which is where the learning happens: what drags what down when something fails, and in what order. What works stays running; what does not, gets written down so I do not trip twice.

Principles

  • Environment separation What the house uses every day does not live where I experiment. Between the disposable and the things that cannot go down there is a border, and it is only crossed once something has proved it holds.
  • Resource efficiency The hardware is second-hand and runs 365 days a year, so every service is measured in RAM and in watts. Anything that wants 16 GB for what another does with half a gig doesn’t make the cut.
  • Deny by default The answer is no until someone says otherwise, and not only on the network: a new service talks to nothing and publishes nothing until it is given permission.
  • Least privilege When the answer is yes, it is exactly what is needed and no more: no token writes where it should not, not one API permission more than needed.
  • Defence in depth From the tunnel to SSO, and from filtering to detection: no single layer is the only thing between the outside and a service.
  • Observability A service does not count as deployed until something watches it and knows how to reach me.
  • Change management Everything that gets touched goes to the changelog with the alternatives I turned down, and nothing gets automated without written stop criteria and a way back.
  • AI across the board AI is part of the day to day: it designs the changes, diagnoses the faults and keeps the documentation current. Always with human oversight — what it proposes is tested in the lab, isolated from production, and goes through me before it touches anything that matters.

What runs on it

Services

  • Home Assistant
  • TripPlanner
  • AgentOS

Compute & deployment

  • Proxmox VE
  • LXC
  • Docker
  • Dockhand
  • GitHub Actions
  • Automated deployment

Network & access

  • OpenWrt
  • VLAN 802.1Q
  • AdGuard Home
  • Cloudflare Tunnel
  • Tailscale
  • No open ports

Identity & access

  • Authentik
  • SSO
  • forward-auth
  • SAML
  • OAuth / OIDC

TLS & certificates

  • Own CA
  • Per-agent certificates
  • HSTS
  • TLS 1.2+

Vulnerability management

  • CVE detection
  • CIS Benchmarks
  • Grype
  • Trivy

Detection & response

  • Wazuh
  • CrowdSec
  • FIM
  • MITRE ATT&CK

Observability

  • Netdata
  • Uptime Kuma
  • ntfy

AI

  • Claude Code
  • MCP
  • Custom agents
  • Feature development
  • PR review
  • Unattended work

On the way

What comes next. None of this is deployed yet.

  • Immutable backups Applying the 3-2-1-1-0 rule: copies that survive an attacker with full control of the machine, impossible to delete for months and verified by actually restoring them.
  • High availability A UPS so a power cut does not take a node down, and new nodes in a quorum cluster so losing one machine does not take DNS, authentication and the applications with it.
  • External surface monitoring Certificate Transparency to find out if a certificate or a subdomain in my name shows up that I did not issue.
  • Automated response Detecting an attack should trigger containment on its own — isolate, block, revoke — instead of ending in a notification someone has to read.
  • Advanced monitoring Going from knowing a service is down to knowing how it behaves: per-service metrics with history, and failures that arrive already investigated by an agent with a proposed fix.
  • Proactive agents The system should not wait for me to ask: it should spot what is needed, build it, deploy it to the lab and leave it tested, waiting for approval.
04

Contact

Want to work together — or just talk about tinkering?