Open to opportunities

Johny Galvez

@johnygalvez

Message

Threat intelligence analyst specializing in proactive threat hunting and detection engineering.

Guatemala

Message

What I'm looking for

I seek a role focused on proactive threat hunting and detection engineering where I can turn intelligence into impactful detections, collaborate with IR teams, and drive measurable security improvements.

I am a proactive security professional with 7+ years of experience in threat intelligence analysis, adversary profiling, proactive threat hunting, and SOC operations (L1–L2). I transform intelligence into actionable detections, produce executive and tactical reports, and collaborate with IR teams to contain threats while reducing MTTD and improving detection efficiency.

I have operated in fast-paced MSSP and financial environments across Latin America and the US, conducting TTP-driven hunts, managing TIPs and telemetry platforms (Mandiant, MISP, T-Pot), and developing Sigma, YARA and KQL rules. My work has driven patch prioritization, SOC rule deployment, and measurable improvements in alert triage and malware/phishing detection.

Experience

Work history, roles, and key accomplishments

Threat Intelligence Analyst

GBM

Jul 2024 - Jul 2025 (1 year)

Conducted threat intelligence research on global and regional campaigns and executed 8+ TTP-driven hunts per month, delivering 12+ executive and tactical intel reports monthly that influenced patch prioritization and SOC rule deployment.

Threat Hunting Threat Intelligence Mandiant MISP T Pot Detection Engineering

Cyber Operations Engineer

Conduent

Apr 2022 - Jul 2023 (1 year 3 months)

Managed 30–50 alerts per shift with 15-minute average acknowledgement and 90% SLA adherence; conducted pattern-based threat hunting across EDR and SIEM and developed 15+ detection rules per quarter, improving detection efficiency by 25%.

SIEM Carbon Black Threat Hunting Sigma YARA Detection Engineering Incident Response

SOC Engineer L2

Tigo

May 2020 - Apr 2022 (1 year 11 months)

Administered security platforms (SIEM, IDS/IPS, WAF, AV, DLP, FW) and improved alert triage accuracy by 20%; created detection rules across multiple controls and supported PCI DSS compliance and SOC playbook improvements.

SIEM IDS WAF PCI DSS Playbook Development

SOC L1/L2 Incident Response

Devel Security

Apr 2018 - May 2020 (2 years 1 month)

Progressed from SOC L1 to L2 performing root-cause analysis, coordinating containment and mitigation, leading initial malware investigations, and providing client-facing incident briefings and infrastructure health reporting.

SOC Incident Response Malware Analysis IOC Based Controls Triage Root Cause Analysis