I'm a career-transition professional pairing 20 years of Public Law practice with hands-on security engineering. Rather than just describe the journey, I'd rather show what I've built and the credentials that back it.
What I've shipped
Verified credentials
Postgraduate degree in Digital Security (10.0/10.0 — PUCRS); CompTIA Security+, Network+, and Cybersecurity Analyst+ (CySA+); and the Security Analytics Professional (CSAP) stackable certification. Currently completing a Cybersecurity Risk Management diploma with Co-op at CCTB (Vancouver). Every badge is third-party verifiable on Credly — see the Certifications section below.
What I bring
The same discipline that governs legal evidence — documentation rigor, chain-of-custody, regulatory literacy (LGPD/GDPR) — applied to GRC, DFIR, and Security Operations, backed by the proven ability to build and ship secure software. I'm targeting SOC Analyst, GRC Analyst, and AppSec / Security Engineer roles.
Based in Vancouver, BC, and available to relocate anywhere in Canada immediately. Reach out via Email or connect on LinkedIn.
Bilingual (EN/PT) Django security series mapped to CySA+ CS0-003 & OWASP Top 10
An ongoing weekly learning journal — published every Thursday in English and Portuguese simultaneously — documenting my transition from law into application security. Each post dissects a real web attack, then I open the Petição Brasil codebase and audit it for that exact vulnerability: running Bandit, Semgrep, or manual code review against my own production code, and publishing the results — clean scans, real findings, or design decisions — directly in the post. Every attack is cross-referenced to the CompTIA CySA+ CS0-003 exam objectives, the OWASP Top 10 (2021 & 2025), MITRE ATT&CK techniques, and the NIST Cybersecurity Framework.
What makes this series different: every post includes real scan results run against my own production codebase (13,700+ lines), real design decisions I made and why, and LGPD/regulatory analysis from my legal background. The roadmap spans the full OWASP Top 10 across ten chapters — from Injection and Broken Access Control to Authentication, Cryptographic Failures, Security Misconfiguration, Insecure Deserialization, Logging & Monitoring, and SSRF. It fills a confirmed market gap: no other EN/PT-BR resource maps Django security practices directly to the CySA+ exam syllabus with real project evidence.
Final Paper — PUC-RS (Score: 10/10)
Published a final paper with a perfect score of 10/10, exploring the intersection of Direct Democracy and Information Assurance. Developed a technical framework applying the CIANA Pentagon (Confidentiality, Integrity, Availability, Non-repudiation, Authentication) to validate digital petitions using ICP-Brasil PKI infrastructure and SHA-256 cryptographic signatures.
The research evolved into Petição Brasil — a live civic-tech platform described as the only Brazilian platform that unites participatory democracy and legal security. Citizens create public petitions, sign them with any ICP-Brasil certificate (Gov.br, e-CPF, A1/A3), and receive an automatically generated chain-of-custody PDF with cryptographic evidence and QR code — giving petitions the same legal standing as physical documents before public bodies, legislative chambers, and courts. The platform also enables Popular Legislative Initiative (Brazilian Constitutional Art. 61, §2º), making it the first fully digital, zero-cost path for any citizen to propose laws to Congress. LGPD-compliant, free forever, and privacy by design.
Full-Stack Django Application | Brazilian Legal Tech
Full-stack Django application to centralize the management of judicial precatórios (court-ordered government debt instruments) issued against Brazilian public entities, built for a law firm with thousands of clients.
Tracks each precatório (government debt writ) by CNJ (Conselho Nacional de Justiça — National Council of Justice) number with independent payment statuses for three financial components: crédito principal (principal debt), honorários contratuais (contractual attorney fees), and honorários sucumbenciais (loser-pays attorney fees). Includes client/CPF (Cadastro de Pessoas Físicas — Brazilian taxpayer ID) management, alvará (court payment order) and requerimento (formal petition) workflows with configurable phase pipelines, a diligências (legal task) tracker with urgency and deadline controls, secure 50 MB PDF uploads to AWS S3, financial dashboard aggregates, and a bulk Excel import pipeline. Deployed on Heroku with PostgreSQL and gunicorn.
VBA/Excel Legal-Tech (2014) → Web Application (2020–Present)
Engineered a proprietary payroll calculation engine in VBA and Excel to automate the computation of labor entitlements for approximately 30,000 public servants of the State of Maranhão — replacing entirely manual processes prone to error in high-stakes court submissions.
The system handled complex Brazilian labor legislation rules (cálculos trabalhistas), including overtime, vacation pay, severance, and retroactive adjustments, producing outputs with the mathematical precision required for judicial use. At peak, it processed the financial claims of the entire public education workforce of a Brazilian state.
In 2020, led the migration of the system to a web-based architecture, managing the full development lifecycle: requirements gathering, contractor hiring, and technical supervision of an external development team — delivering a production system currently at v1.4.16.
ETS (Educational Testing Service)
Issued Jun 2026 · Exp. Jun 2028
Feb 2014 — Present (12 years)
Build full-stack web applications and automation tools in Python/Django (and earlier VBA) for the legal sector, with a focus on data integrity and secure authentication. Flagship builds — the Petição Brasil ICP-Brasil digital-signature platform, a Judicial Debt (precatórios) Management System, and a public-payroll calculation engine — are detailed in the Projects section above.
Mar 2012 — Mar 2026 (14 years)
Led a legal and operations team of 30+ professionals across four locations, standardizing investigative, analytical, and compliance workflows for a 20,000+ client portfolio. Analyzed complex contracts and case evidence to identify risk, build strategy, and ensure regulatory compliance — the GRC/DFIR-adjacent discipline that underpins my move into security. Also authored a long-running Public Law blog at thiagohenrique.adv.br.
Sep 2010 — Feb 2012 (1 year)
Provided comprehensive legal counsel and representation for public educators across the State of Maranhão, managing a high volume of specialized public sector litigation.
Dec 2004 — Aug 2010 (5 years)
Developed a comprehensive understanding of firm operations, progressing through multiple support roles to ensure efficient daily administrative and legal workflows.
2025 — Present
Furthering technical specialization in Cybersecurity Risk Management. Program covers network security, systems hardening, risk assessment, and co-operative work placement in the Canadian tech sector. (Academic coursework completed; co-op in progress.)
2024 — 2026 · 10.0 / 10.0
Focused on the intersection of legal frameworks and technical security. Covered Digital Security strategies, Data Governance, and the management of complex data ecosystems to ensure organizational compliance and resilience. Competencies: Compliance, Cybersecurity Governance, Data Protection, Risk Management.
Credential evaluated by World Education Services (WES) — Verify
2022 — 2024 · 9.7 / 10.0
Advanced specialization in Public and Constitutional Law — administrative law, constitutional principles, and public-sector governance.
2005 — 2010
Credential evaluated by World Education Services (WES) — Verify
June 18, 2026
Path traversal in Django: how os.path.join lets attackers escape MEDIA_ROOT, why safe_join stops it, and when FileField eliminates the risk. OWASP A01:2021.
June 11, 2026
CSRF in Django: how hidden forms ride the victim's session cookie, why @csrf_exempt is dangerous, and how CsrfViewMiddleware stops it. OWASP A01:2021.
June 04, 2026
Privilege escalation in Django: how fields='__all__' exposes is_staff and is_superuser, and how explicit field lists stop it. OWASP A01:2021.
May 28, 2026
IDOR in Django: how swapping a URL ID leaks another user's data, why login_required is not authorization, and how to scope querysets. OWASP A01:2021.
Available for SOC, GRC or Digital Forensics Analyst roles in Canada — based in Vancouver and available to relocate to any city in Canada immediately.
Get in Touch