lunalome

Cyber Operations Analyst at Hillwood

Alexander Ortiz

I work the security queue and report on vulnerabilities. At home I run a Proxmox lab and track every project below, including the ones that broke.

  • Dallas-Fort Worth, TX
  • English and Spanish
  • Heading toward identity and access management and cloud security

Project tracker

Work, lab and study projects with their real status. Open any row for what I built, what it runs on and the decisions behind it.

Case study

Five weeks of empty folders

My media server lost its storage for five weeks and nothing told me. The data was safe the whole time. The fix took an afternoon. The lesson changed the order I build things in.

A silent failure is the real bug. Monitoring and startup order come before features.

  1. Aug 28 and Sep 11, 2026 Two host reboots. The NAS was not up yet, so the network share failed to mount and never retried. The containers started a second later and attached to empty local folders instead.
  2. Sep 11 to Oct 16 Plex, Jellyfin and the download automation ran against empty libraries. No alert fired. About 3.3 TB of media sat untouched on the NAS.
  3. Oct 16 Found the cause and fixed it. Moved the share login out of a world-readable file into a root-only credentials file, changed the mount options so boot cannot hang, and made Docker wait up to five minutes for the share before starting containers. Restarted 11 containers and checked each one.
  4. Oct 17 to 18 Added 15 uptime monitors with phone alerts. Started moving the media onto local ZFS storage so the NAS stops being a boot dependency.

How I work

Habits I use in the lab and want to bring to the job.

  • Read-only firstNew access starts read-only and widens one step at a time, with a snapshot before any write.
  • Two locksA leaked hostname alone should get nobody anywhere. Edge authentication plus the service's own token.
  • Log what actsTool calls, backups and alerts leave a trail I can read later.
  • Pin and reviewNew stacks pin image versions and live in Git. Updates happen on purpose.
  • Write it downEvery working session leaves a log, and every build gets a runbook.

Experience

Hillwood, a Perot companyJul 2026 to present

Cyber Operations Analyst

  • Monitor, triage and investigate security alerts, escalating confirmed incidents for response.
  • Support identity governance and administration: access reviews, entitlement management, joiner, mover and leaver processes, and least privilege.
  • Support vulnerability management, from scanning and remediation tracking to risk reporting.
  • Assist with email, endpoint and network security monitoring, and contribute to documentation, runbooks and security awareness.
Hillwood, via GuideITJan 2022 to Jul 2026

Deskside Support, intern to Senior Analyst

End User Support Intern (Jan 2022), Deskside Support Associate (Aug 2022), Senior Deskside Support Analyst (Jun 2025).

  • Supported a 400+ user environment across 20+ locations, working incidents, requests and changes.
  • Worked with Active Directory and mobile device management as part of day-to-day end-user computing support.

Credentials

Education

  • B.S. Information Technology, WGUIn progress. Enrolled July 2026, with 9 courses transferred in through certifications.
  • IT certificate, with honorsDallas College and Year Up United

Certifications

    EarnedScheduled

    Off the clock

    • Electronic music and festivals
    • Mechanical keyboards
    • PC gaming
    • Working toward a private pilot license
    • Video content

    Everything in my lab ends in -lome, from Cloudalome to Medialome. It is a naming convention I keep across every VM, disk and stack.