Open to opportunities

Javier Mauricio Carrasco Guzmán

@javiermauriciocarras

Cybersecurity Engineer specializing in OT/ICS and IT pentesting, vulnerability assessment, and AI-assisted exploitation for IT.

Mexico

Message

What I'm looking for

I’m looking to apply my penetration testing and vulnerability assessment skills to improve industrial security. I want hands-on work aligned to ISA/IEC 62443 and ISO 27001 and NIST, with clear mitigation ownership and continuous learning.

I’m a Cybersecurity Engineer focused on OT/ICS security, delivering hands-on penetration testing and vulnerability assessment for industrial control systems, IoT, and enterprise IT infrastructure. I’m eJPT certified and actively applying ISO 27001 and ISA/IEC 62443 to identify critical weaknesses, document findings with CVSS scoring, and propose practical mitigation plans.

I specialize in OT/ICS assessments using Nmap, Metasploit, Burp Suite, and MITRE ATT&CK methodology, including SCADA security work and protocol-focused reviews (e.g., Modbus/DNP3). I also bring Active Directory offensive security experience—building and running penetration testing labs, including privilege escalation and post-exploitation workflows—while using OSINT and AI-assisted pentesting to accelerate reconnaissance and attack-surface analysis.

Experience

Work history, roles, and key accomplishments

Software Developer

Tyssa S.A. de C.V.

Jan 2023 - Jan 2024 (1 year)

Implemented a phased defense-in-depth mitigation strategy and developed automation modules to reduce manual operation time in internal processes. Improved legacy systems and contributed custom exploitation scripts for operational continuity and compatibility.

Defense In Depth Git Java Data Processing Python Legacy Systems Attack Flow Documentation

Penetration Testing

Instituto Politécnico Nacional (ESCOM)

Jan 2020 - Jan 2024 (4 years)

Performed penetration tests on web application APIs, identifying SQL/command injection issues, exposed endpoints with sensitive data, and DoS vectors. Applied OWASP methodology to guide testing and reporting.

Penetration Testing SQL Injection Command Injection OWASP DOS Vulnerability Assessment

ICS/SCADA Pentest Workshop

Bsides CDMX

Designed and delivered a technical workshop on penetration testing of Siemens PLCs and industrial networks. Developed custom exploitation scripts in Python as part of the training content.

Penetration Testing Siemens PLC’S ICS SCADA Python

Active Directory Pentesting Lab

Marvel/Shield.local

Built and documented an Active Directory lab for internal attack scenarios, including initial access using LLMNR/NBT-NS and NTLMv2 hash capture/cracking. Performed post-compromise enumeration and escalation path analysis using BloodHound and ldapdomaindump.

Active Directory BloodHound LLMNR NBT NS Poisoning Windows NTLM Hashcat LDAPDomaindump Red Team Post Exploitation