Understand what matters
Identify critical services, sensitive information and continuity expectations before selecting controls.
BUSINESS-DRIVEN SECURITY ARCHITECTURE
Security that
starts with the
business.
Over 20 years in cybersecurity, connecting strategy, design and operations to solve business challenges in large-scale organizations.
Explore the knowledgeDiscover the approachARCHITECTURE MODEL01 / 03
01Business objectivesContext · Attributes · Priorities
02Architecture decisionsRisk · Trust · Capabilities
03Controls and evidenceImplementation · Measurement · Improvement
SABSA × ZERO TRUSTEnd-to-end traceability
STRATEGY BEFORE TOOLSIDENTITY / DATA / CLOUD / AI / RESILIENCE
01 — THE APPROACH
From intent
to architecture.
SABSA connects business requirements to architecture decisions. Zero Trust principles, with NIST and CSA references, guide trust and access conditions.
Design trust
Make access conditions, privilege boundaries and the evidence needed for decisions explicit.
Build with priorities
Translate gaps into capabilities, dependencies and a roadmap the business can understand and execute.
02 — SPECIALTIES
Architecture that reaches
operations.
A broad security perspective, from business requirements to implementation and service operation.
Identity and privileged access
Designing Just-in-Time access where platforms support it. A ‘PAM Everywhere’ strategy, migration to the PAM provider’s cloud and privilege management on development devices through EPM.
Zero Trust and SABSA
Connecting business needs to requirements and architecture decisions through SABSA. Applying Zero Trust with NIST and CSA references to minimize implicit trust and reduce exceptions.
AI governance and MCP integrations
Assessing how language-model platforms operate and defining conditions for internal use. Criteria for integrating internal and provider MCP servers, their data, tools and actions.
Security platform transformation
Designing, implementing and modernizing security solutions in complex environments. Experience in email, SIEM, EDR, PAM/EPM, SSE and network solutions using Palo Alto and Fortinet.
03 — SELECTED EXPERIENCE
Transformations
with outcomes.
Three initiatives combining architecture decisions, leadership and execution.
CORPORATE EMAIL
Zero Trust
Protection across hundreds of domains
Transforming corporate email security
Leadership, design, implementation and coordination of an enterprise email transformation, improving protection and deliverability.
Explore my contribution
My contribution
I led solution design and implementation, coordinating changes to policies and controls in an environment with hundreds of domains.
What changed
SPF, DKIM and DMARC handling was strengthened through strict validation criteria and adherence to senders’ declared policies. Corporate domains moved to DMARC rejection policies (p=reject).
Protecting processing capacity
Policy prohibited password-protected files. In addition to attachment size, containers such as ZIP, XLSX and DOCX were examined to prevent disproportionate expansion and resource exhaustion. Per-second and hourly sending limits were established to reduce abuse and service saturation.
Outcomes
Fewer false positives, phishing and spam, wider protection coverage and improved email deliverability.
SIEM / SOC
≈40%
Reduction in annual licensing and infrastructure costs
Modernizing the SIEM and consolidating the SOC
A SIEM migration to cloud, co-led with the CISO, followed by integration between tenants to consolidate the SOC service.
Explore my contribution
My contribution
I co-led the migration of the SIEM platform from on-premises infrastructure to a cloud environment with the CISO.
Financial outcome
The migration achieved an approximately 40% reduction in the platform’s combined annual licensing and infrastructure costs.
A second transformation
Years later, during a tenant-to-tenant migration to consolidate the SOC, I was responsible for ensuring that all data and sources were correctly integrated and functional in the destination environment.
IDENTITY / PAM
99.99%
Availability measured monthly
Extending privileged access management
Completed migration of PAM to the provider’s cloud and expansion of capabilities to cloud platforms and development devices.
Explore my contribution
My contribution
I led the migration of PAM from an on-premises environment to the provider’s cloud as part of a ‘PAM Everywhere’ strategy to extend privileged access management.
Scope
The current scope includes PAM, privileged access to three cloud platforms and Endpoint Privilege Management (EPM) on development devices. I have also defined Just-in-Time access where services and platforms support it.
Outcomes
Improved response times and service availability. Monthly measured availability reaches 99.99% for both on-premises components and the provider’s service.
04 — PROFESSIONAL BACKGROUND
Marcos
Caballero.
Security architect with over 20 years of cybersecurity experience and a career spanning nearly three decades in technology.
I connect business needs with architecture decisions and solutions that can be implemented and operated in large-scale environments. My experience covers security strategy, reference architectures, identity, information protection, networks and security operations.
I have contributed to company integrations, platform consolidation and the development of policies and solutions aligned with Zero Trust. I combine a broad security perspective with practical experience in assessment, design and implementation.
Earlier career
Banco Popular
Cybersecurity engineering.
HP → HPE → DXC
Head of security architecture consulting for Spain and Portugal, in a continuous career stage spanning the company’s transformation.
Technology entrepreneurship
Co-founder and CTO of a cybersecurity product distributor, responsible for technology direction and solution development.
Sector experience
Independent consulting in pharmaceuticals, telecommunications, energy and online gaming, working with international clients.
05 — TECHNOLOGIES AND CAPABILITIES
Experience across
the lifecycle.
Experience in solution design, implementation and operation. Operational knowledge to define processes, responsibilities and RACI matrices, alongside direct administration where it is part of my role.
| Technology or capability | Design and assessment | Implementation or migration | Operational knowledge and model |
|---|---|---|---|
| Email security | Experience | Experience | Experience |
| SIEM | Experience | Experience | Experience |
| Palo Alto | Experience | Experience | Experience |
| Fortinet | Experience | Experience | Experience |
| EDR | Experience | Experience | Experience |
| PAM / EPM | Experience | Experience | Experience |
| SSE | Experience | Experience | Experience |
06 — KNOWLEDGE BASE
Ideas for making
better decisions.
Architecture notes, design questions and starting points for useful conversations.
Zero Trust with SABSA: who needs access, to what and why?
From business purpose to necessary access: scope, exceptions, operations and actual adoption.
Read the articleZero Trust: start with decisions
From explicit trust principles to concrete access conditions.
Read the articleSABSA: trace the purpose of each control
Connect business needs, attributes and design decisions.
Read the articleNon-human identities: ownership first
Governing service accounts, workloads and agents.
Read the articleCloud: design privilege boundaries
Separate routine access, administration and emergency recovery.
Read the articleAI agents: govern what they can do
An agent’s scope includes its tools, data and permissions.
Read the articleResilience: verify recovery
Move from a documented plan to a demonstrable capability.
Read the articleProtecting data throughout its journey
Connect classification, permitted uses and controls to the value of information.
Read the articleExposure management: prioritize what matters
Turn technical findings into decisions that reduce risk.
Read the articleNo articles match these criteria. Try another search.
Original guidance notes. Specific decisions require checking requirements, official documentation and each organization's context.
07 — CONTACT
Let’s talk about
your project.
Tell me about the challenge, the context and what you need to solve.