Experience
10 companiesGuideM
6 years 9 monthsCo-Founder | Blue Team Lead Instructor - Cyber Defense | Threat Hunting | DFIR
Oct 2019 - PresentLead author and instructor for the following courses: Cyber Defense & Threat Hunting (CDTH) Digital Forensics & Memory Analysis (DFMA)
XINTRA
2 years 1 monthReview Board Member & APT Labs Contributor
Jun 2024 - PresentCo-Author of the following Xintra APT Labs Scattered Spider (AB Projekt Blue) APT34/OilRig (Abu Jibal) North Korea Lazarus Group (AirBuzzed)
Palo Alto Networks Unit 42
4 years 5 monthsTechnical Director, Incident Response
May 2024 - PresentLead large scale & high profile incident response cases across the globe Lead the EMEA Threat Actor Negotiation Service
Principal Consultant, Digital Forensics & Incident Response
Feb 2022 - May 2024The DFIR Report
3 years 3 monthsDFIR Analyst - Contributor
Apr 2023 - PresentCo-Author of the following intrusion reports: Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs https://thedfirreport...
Callsign
9 monthsSenior DFIR Analyst
May 2021 - Feb 2022malomatia
2 years 3 monthsSenior IR Consultant | National Cybersecurity Agency - NCSA Qatar
Feb 2019 - May 2021GBM
1 yearSenior Security Engineer | Threat Hunter - QatarGas
Jan 2018 - Jan 2019Baker McKenzie
1 year 4 monthsIncident Response Analyst
Nov 2017 - Jan 2018Security Operations Analyst
Sep 2016 - Nov 2017New Era University Official
1 year 1 monthInformation Security - College Instructor
Nov 2016 - Dec 2017Ingram Micro
1 year 4 monthsSenior IS Security Operations - Global Security
Apr 2015 - Aug 2016Education
4 degreesFOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques, Cyber/Computer Forensics and Counterterrorism
General Studies
SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses, Cyber/Computer Forensics and Counterterrorism
General Studies
FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response, Cyber/Computer Forensics and Counterterrorism
General Studies
SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling, Cyber/Computer Forensics and Counterterrorism
General Studies
Certifications
15 certsFOR578: GIAC Cyber Threat Intelligence - GCTI
Oct 2023FOR610: GIAC Reverse Engineering Malware - GREM
Sep 2022SEC599: GIAC Defending Advanced Threats - GDAT
Sep 2021FOR572: GIAC Network Forensic Analyst - GNFA
May 2021eLearnSecurity Certified Incident Responder - eCIR
Mar 2021FOR508: GIAC Certified Forensic Analyst - GCFA
Nov 2020FOR500: GIAC Certified Forensic Examiner - GCFE
Jul 2020eLearnSecurity Threat Hunting Professional - eCTHPv2
Jun 2020eLearnSecurity Digital Forensics Professional - eCDFP
Nov 2018eLearnSecurity Junior Penetration Tester - eJPT
Jul 2018Cybersec First Responder (CFR)
Mar 2018SEC504: GIAC Certified Incident Handler - GCIH
Apr 2017Microsoft Certified Specialist: Implementing Azure Infrastructure Solutions
Dec 2014Microsoft Certified Professional: Server Virtualization with Windows Server Hyper-V and System Center
Jun 2014ITIL v3 Foundation
Sep 2013Skills
13 skillsHighlights
14 itemsAchievements
14SANS London: DFIR Netwars
Apr 2024Won 1st place during the SANS London - DFIR Netwars in-person event
SANS Paris: DFIR Netwars
Jun 2023Won 1st place during the SANS Paris - DFIR Netwars in-person event
FOR608: Enterprise-Class Incident Response & Threat Hunting
Oct 2022Won 1st place during the SANS FOR608 CTF Final Challenge
DEFCON 30 - BlueTeamVillage
Aug 2022Won 1st place from the recent DEFCON 30 - Blue Team Village CTF for Ransomware Attack and Defense Workshop
FOR610: Reverse Engineering Malware - CTF
Dec 2021Won 1st place and received a SANS coin in our FOR610 Malware CTF
SANS DFIR NETWARS
Dec 2021Won 5th place in SANS DFIR Netwars (individual category) at SANS CDI Summit event
SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses - APT Defender Capstone
Mar 20211st place in Day 6 APT Defender Capstone in SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain De...
FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and IR Capstone Challenge
Dec 20201st place in Day 6 Capstone Challenge in FOR572 Advanced Network Forensics. Got listed in SANS Lethal Forensicator http...
Capture The Adversary: Elastic Security CTF - APJ (2nd Place)
Nov 2020Managed to answer all of the CTF questions on Elastic Security CTF and placed 2nd place among hundreds of CTF players.
BSides Doha - DFIR @ No Cost
Jan 2020URL: https://www.bsidesdoha.com/ Authors: Renzon C
Cyber Defense & Threat Hunting
Jan 2019URL: http://tiny.cc/GuideMcdth Authors: Renzon C
BSides London 2019 - Forensicating Windows Artifacts: Investigation w/o Event Logs
Jan 2019URL: https://bsideslondon2019.sched.com/speaker/renzon_cruz.1zj7x41w Authors: Renzon C
BSides Vancouver - Forensicating Windows Artifacts: Investigation w/o Event Logs!
Jan 2019URL: https://www.bsidesvancouver.com/renzon-cruz Authors: Renzon C
SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling - CTF Champion
Jun 2016Awarded a coin for winning capture the flag (CTF) event after the 5-day live class training bootcamp with Kevin Fiscus, ...