Current specialization
Linux Infrastructure · Web Servers · Tier 2/3 Troubleshooting
Percio Castelo
Solid Linux infrastructure, real-world crisis resolution, and DevSecOps engineering.
Over a decade keeping production environments resilient, mitigating critical outages (SLA < 2h), and hardening servers (cPanel, DirectAdmin, Bare-metal, and Cloud). Delivering pragmatic automation with Ansible, Docker, and secure CI/CD pipelines.
10+ years
in prod Linux & infra
46+
projects & automations
< 2h
critical incident SLA
Available for hire · Remote / Hybrid · Full-time / Contractor
INTERACTIVE SOC DEMO · REAL-TIME TELEMETRY & INCIDENT MITIGATION
CPU
24%
RAM
48%
IP BLOCKS
1482
[SYS] Initializing SecOps background monitoring...
[SYS] Wazuh agent active on node-host-01
[SEC] Firewall status: ENFORCED (NFTables active)
> practical DevSecOps, hardening & automation
WHO I AM
Infrastructure that stays up, security that enables, and a team that ships together
I spend most of my days in the terminal solving complex server, network, and hosting infrastructure challenges. With over a decade keeping production environments running, I learned that the best infrastructure is the kind nobody worries about: quiet, fast, and without late-night panics.
I lived the high-pressure routine of Tier 2/3 advanced support in large web hosting environments and technical consulting, containing attacks, recovering downed web servers, and resolving critical incidents under pressure. My core, proven expertise is in Linux infrastructure, web hosting platforms (cPanel, DirectAdmin, CloudLinux, Webservers), and deep production troubleshooting. I work with practical automation using Bash, Docker, and GitHub Actions in personal projects like the NEXUS ecosystem. Open to Linux SysAdmin and Infrastructure Engineer opportunities.
Professional profile
SysAdmin & DevSecOps · Linux Infrastructure & Servers
Academic education
Cyber Defense (Wyden) · in progress
Principle
Real security doesn't block teams with red tape: it runs automated inside CI/CD pipelines so developers can deploy code with total confidence.
AREAS OF EXPERTISE
Where I am building impact
Linux Infrastructure & Web Hosting
Large-scale Linux administration, cPanel/WHM, DirectAdmin, HestiaCP, CloudLinux, and tuning of Apache, LiteSpeed, Nginx, and MySQL.
Learn moreTier 2/3 Troubleshooting & Crisis Recovery
Deep root-cause diagnosis under pressure, restoring offline services, high-availability BIND9 DNS, and email deliverability (Exim/Dovecot).
Learn moreServer Hardening & Security
Intrusion containment, CSF/LFD firewalls, Imunify360, fail2ban, log forensics, and proactive vulnerability mitigation.
Learn moreAutomation, CI/CD & Practical DevSecOps
Hands-on implementation of secure GitHub Actions CI/CD pipelines with SAST/SCA scanners (Trivy, Gitleaks, Semgrep), Docker containerization, and Ansible playbooks for compliance.
Learn moreTECHNICAL STACK
Production Technologies & Tools
Infrastructure
Linux (Debian/RHEL/Alma) · Nginx · Apache · BIND9/DNS · CloudLinux · cPanel/WHM · Plesk · DirectAdmin
Automation
Python · Bash / Shell Script · Ansible · REST APIs · Bun / Node.js · n8n
DevOps & Cloud
Docker · GitHub Actions · CI/CD Security Gates · Kubernetes · MCP Servers
Security & Threat Intel
ModSecurity (WAF) · nftables · CrowdSec · Fail2ban · Trivy · Gitleaks · Semgrep · Threat Intel
CULTURE & TEAMWORK
How I work: pragmatism, collaboration, and zero ego
Technology only creates real value when it simplifies business operations and makes work easier for the people around you.
Zero Ego & Direct Solutions
The best architecture isn't about trendy buzzwords. It's the one that solves the business bottleneck, keeps costs under control, and allows any teammate to maintain it without headaches.
Team Multiplier
No one succeeds alone. I create clear documentation, runbooks, and automations that eliminate repetitive tasks, giving developers autonomy and speeding up onboarding for new teammates.
Operational Peace of Mind
My role alongside leadership and product teams is to ensure peaceful nights: hardening servers, stabilizing deployments, and catching failures before users ever notice.
Eagerness to Learn
Technology evolves rapidly. Exploring new tools, orchestrations, and modern pipelines is part of my daily routine — always with the humility of knowing every day is a chance to learn something new with the team.
RESULTS
Production Impact
Containment < 2h
Critical Incident & Threat Response
RCE exploit in legacy dependency attempting persistence via dropper in /tmp and profile. Rapid action: emergency network isolation with restrictive iptables (full DROP except admin), process containment, CI/CD deploy freeze, and forensic recovery via rescue mode. Full host rebuild and hardening with zero lateral movement.
Linux · Incident Response · iptables + Forensics · Rescue Mode
Read detailed post100% SSH Keys
Edge Hardening & SSH Authentication
Hardening audit to eliminate password logins across cPanel/CloudLinux servers. Uncovered false senses of security caused by conflicting drop-in files in sshd_config.d and API overrides. Deep audit of active directives, global disabling of PAM passwords, and verification with sshd -T.
cPanel/CloudLinux · OpenSSH · Linux PAM · Server Hardening
Read SSH security articleZero Failures / Zero Leak
Secure CI/CD Pipeline
Manual deployments without code audit. Migrated to GitHub Actions with automated gates: Trivy for image vulnerabilities, Gitleaks for credential scanning, Semgrep for SAST. Ansible for idempotent provisioning. Zero exposed credentials across 117+ repositories.
GitHub Actions · Trivy + Gitleaks + Semgrep · Ansible
View NEXUS platformMTTR -60%
N2 Support & Infrastructure Automation
Development of dedicated tools and scripts (cPanel Reseller Usage, BindFilter, TMP Manager, Network Stat Monitor) to eliminate repetitive manual routines across multi-tenant infrastructure. Standardized operational runbooks, drastically reducing ticket resolution time.
Bash + Python · cPanel / BIND9 / Linux · Runbooks & Tools
View Infrastructure projects10+ years prod
Continuous Evolution: From Tier 1 to Linux SysAdmin & DevSecOps
Started as Tier 1/2 support at HostGator (2009). Progressed to full Linux SysAdmin with HA and monitoring (2014), technical supervisor with process governance (2014-2015), and infrastructure consulting. Today uniting this battle-tested production foundation with active hands-on study in Docker, CI/CD, and DevSecOps in the NEXUS project.
HostGator + JoinVix + M3Solutions + Freelancer
View full resumeCERTIFICATES
43+
PROJECTS
117
CASES & DELIVERABLES
Work
Evolya
In ProgressLearning SaaS platform with modern stack, adaptive study modules, applied security, strong authentication and subscription monetization flow.
Category: SaaS
View project
WaveScan
In ProgressComprehensive technical scanner for reconnaissance, surface auditing and active risk validation in web apps.
Category: Cybersecurity
View project
NEXUS abuse.ch TI
In ProgressComplete cyber threat intelligence hub integrating the 4 open APIs of the abuse.ch initiative with the NEXUS AI Engine. Performs real-time lookups across ThreatFox (C2 IOCs, IPs, domains, hashes), MalwareBazaar (malware samples and binaries), YARAify (YARA/ClamAV rule scanning and signatures), and URLhaus (active malware distribution URLs). Features an AI forensic triage engine that generates rich Markdown executive briefings, MITRE ATT&CK tactics/techniques mapping, production-ready SIEM hunting queries for Splunk, Elastic, and Microsoft Defender KQL, as well as an automated YARA v4 rule generator. Supports unified Auth-Key with automatic inheritance, 7-day parameterized local cache (abusech_cache), audit history (abusech_history), and automated Intelligence Hub enrichment.
Category: NEXUS
View projectCatalog
View all projects
Open the full catalog with filters by status, category and tags.
View all projects
Technical case study of a critical WordPress incident response involving a Bitcoin extortion attempt, eradication of 632 malicious posts, root cause mitigation, and host hardening.
Category: Security
View service
Technical case study on WordPress incident containment, forensics, and remediation following 13k+ XML-RPC brute-force requests, webshell deployment, and hidden persistence.
Category: Security
View service
Forensic infrastructure investigation following a batch cPanel/WHM migration outage: debunking human error allegations, laboratory reproduction (PoC), and proving a native vendor bug.
Category: Infrastructure
View serviceCatalog
View all services
Browse every service with filters by status, category and tags.
View all servicesPROFESSIONAL EXPERIENCE
EXPERIENCE
Click each row to view details.
- Linux administration of multi-tenant infrastructure focused on high availability and service continuity.
- Automation with Ansible and Bash: config standardization, server updates and fewer manual tasks.
- N2/N3 troubleshooting of web, email, network and OS with root cause analysis via logs and metrics.
- Linux hardening, permission management and attack-surface reduction for web services.
- Incident response: detection, isolation and containment of malware, webshells and unauthorized access in production.
- Internal scripts and tools for continuous integrity auditing of the environment.
- Architecture and deployment of a high-availability DNS cluster with BIND9 (resilience and low latency).
- Provisioning and management of servers/web services in public and hybrid cloud.
- Security audit scripts, knowledge base and standardized operational documentation.
- Post-breach response: containment, malware and webshell removal, and mitigation rule implementation.
- Consulting on Linux architecture, automation and risk mitigation for corporate clients.
- Freelance development work for multiple clients, including Mam Engenharia.
- On-demand website and technical routine deliveries focused on stability and maintenance.
- Family restaurant management with daily operations, support and ordering-platform administration.
- Creation of visual assets (logos, banners, images and layout) plus social-media management.
- Continuous growth in automation, Linux infrastructure and applied security in real environments.
- Technical leadership and process governance for large-scale web infrastructure (VPS and shared).
- JumpStart project: standardized onboarding and operational flows for the WordPress product.
- Security policies and mass Linux hardening baselines.
- Bash automation for critical admin tasks and fewer manual failures.
- Institutional wiki, engineering docs and technical support to legal on security incidents.
- Large-scale Linux infrastructure maintenance focused on high availability, security and stability.
- N3 troubleshooting across OS, network and web services with root-cause fixes.
- Proactive monitoring with Zabbix and Nagios, granular alerts and anticipatory incident mitigation.
- MTTR and downtime reduction in dedicated and multi-tenant environments.
- Apache, Nginx, mail, DNS and database maintenance with performance tuning and stability baselines.
- Maintenance of dedicated and multi-tenant servers of high complexity.
- Fast recovery of web, database and email services in production.
- Root-cause analysis via logs (syslog, auth, dmesg, Apache/Nginx) to prevent recurrence.
- Initial hardening, permission audits and optimization under load.
- Vulnerability mitigation with firewall rules (CSF/iptables) and access control.
- Log auditing and proactive blocking of malicious traffic and resource abuse.
- Troubleshooting Apache, Nginx, mail and DNS in high-density environments.
- Triage and resolution of incidents in large-scale web hosting.
- Troubleshooting cPanel/WHM, DNS zones and email (SMTP/IMAP/POP3).
- Technical articles for internal knowledge base and new analyst onboarding.
- Connectivity diagnosis, routing and FTP/email clients.
- IT governance, asset inventory and compliance with public-sector processes.
- Administrative workflow automation with Python and PHP.
- Relational database management, backups and local system availability.
LATEST NEWS
Posts
6/7/2026 · 10 min
Gestão de crise e hardening: anatomia de uma resposta a incidente em ambiente Linux
Relato técnico e operacional de resposta a incidente Linux com contenção activa, recuperação forense em rescue mode, rebuild completo do host e hardening.
Read post
6/7/2026 · 4 min
A ilusão do `sshd_config`: como realmente garantir a segurança da autenticação SSH no cPanel/CloudLinux
Recentemente, encerrei uma investigação (Evento de origem: #3104798) e a aplicação de ações corretivas relacionadas ao controle de autenticação SSH nos servidores cPanel que adm…
Read post![Roundcube no cPanel quebrando com DB error [14] unable to open database file](/assets/img/blog/roundcube-cpanel-db-error-14-unable-open-database-file-fix.webp "Roundcube no cPanel quebrando com DB error [14] unable to open database file")
6/7/2026 · 6 min
Roundcube no cPanel quebrando com DB error [14] unable to open database file
Diagnóstico técnico avançado por camadas para corrigir o erro `DB Error: [14] unable to open database file` no Roundcube do cPanel. Aprenda a restaurar permissões, verificar a i…
Read postCERTIFICATES
Certificates
Google Cybersecurity Certificate V2
Cybersecurity Essentials (LFC108)
The Linux Foundation
cPanel & WHM System Administrator II Certification Exam (CWSA-2)
cPanel
Hardening do S.O Linux para Web Application
IBSEC - Instituto Brasileiro de Cibersegurança
BEYOND THE TERMINAL · PURPOSE & CAUSE
Animal Rescue: Care, Discipline and Resilience
Behind every line of code and critical architecture, there is a human being. Outside the terminal, I dedicate part of my life to independent rescue and rehabilitation of abandoned animals. Taking care of them taught me empathy, calm under pressure, daily consistency without shortcuts, and the quiet responsibility of welcoming vulnerable lives. Today, I share my routine with my rescued companions — and the little stars shining above forever illuminate my path.
Shall we talk about the next opportunity?
Available for Linux Infrastructure, SysAdmin, and critical environment operations roles.
