About

Hi, I’m Joe Lopes

I’m a Brazilian security engineer with two decades in Linux, infrastructure, and information security. Since 2013, my focus has been security operations, deception technologies, data pipelines, and security architecture — deploying SIEM and SOAR platforms, writing automation, and wiring the full loop from threat intelligence and IOC pipelines to detection and incident response across critical infrastructure, large-scale fintech, and the cloud.

This site, lopes.log, is where I write about that work: detection-as-code, deception engineering, log-pipeline economics, and the craft of running a SOC without burning out the team. Long-form, written slowly, and published with intent. No ads. All opinions are my own.

Work

A few threads run through most of what I write and build:

• Detection-as-Code — treating detections as software contracts with schema validation, state reconciliation, and multi-engine support, including Graft, my open-source DaC platform (Part 1, Part 2).
• Detection engineering as a discipline — rule lifecycle, testing, MITRE ATT&CK coverage, and false-positive economics. See Detection-as-Code, Then What?, Engineering Detection Rules, and MITRE Coverage Beyond the Green Matrix.
• Deception engineering — honeypots, honeytokens, and adversary engagement as a first-class detection strategy, including Lantana, my open-source honeypot-as-code platform (Ansible, Terraform, Suricata, Cowrie, Dionaea).
• SIEM and log architecture — Chronicle, MISP integration, and ingestion economics. See Integrating MISP with Chronicle SIEM, Log Health Monitoring, and the Project Nebula series.
• AI-native security practice — using LLMs in detection and security engineering without losing rigor. See Prepare Your SOC for AI and AI-First Software Development.
• Rust for security tooling — including Cordyceps, a Rust ransomware proof-of-concept built to study the language and the threat.

Talks

• Chronicles of a Google SecOps Migration (2026) — Google HQ, São Paulo pt_BR (private)
• Visibilidade de Rede (2021) — Mind The Sec, remote pt_BR
• Práticas de NOC/SOC (2019) — Itaipu, Paraná pt_BR
• Método para Uso do SIEM como Ferramenta de Inteligência e Automação (2019) — CERT.br, São Paulo pt_BR
• A Abordagem da Cemig na Segurança Cibernética (2018) — CERT.br, São Paulo pt_BR
• Blockchains: Muito Além do Bitcoin (2017) — Cemig, Belo Horizonte pt_BR
• Estruturação de um CSIRT no Contexto de Smart Grid (2014) — CERT.br, São Paulo pt_BR

Writing History

I have been writing publicly about systems, Linux, and security for over two decades:

• 2005–2009 (The Early Years): Started writing Linux and open-source articles at Viva o Linux (2005–2006), followed by Fluxo Livre (2007), Versão Própria (2008), and Pipeless (2009), where I wrote on Python, LaTeX, and UNIX systems.
• 2010–2019 (Transition to Security): Ran self-hosted blogs at JoseLopes.org (2010), JoseLop.es (2011), and Indiecode (2012–2013), micro-blogged at Jiloh (2012–2014) as I moved formally from IT Infrastructure into Information Security in 2013, and shifted to English long-form security writing at Hakspek (2015–2016) and Medium (2018–2019).
• 2020–Present (lopes.id): Launched lopes.log during the 2020 pandemic as an independent home for long-form essays on security engineering.

Analytics

I use Cloudflare Web Analytics to see which posts people actually read. No cookies, no cross-site tracking, no personal data, nothing sold or shared. Just page counts and referrers, so I know what’s worth writing more of.

AI Usage

Every post on this blog is my own work, and I always write the first draft myself. One of my original goals in starting this site was to improve my written English, so having an LLM write posts for me would defeat the point. Instead, I use AI to polish my drafts (and teach me where my English slipped) and to help maintain the repository and code behind the blog. The writing and opinions are mine — AI is here as my peer reviewer, English teacher, and SRE.