I secure the accounts attackers want most.
Paulo Valadares, IAM Engineering Manager at Sobeys in Toronto. I build the teams and platforms that take privileged access from audit finding to audit-ready: PAM, identity governance, AD and Entra security, and the automation that holds it all together.
scope: about.read
whoami
The operator behind the access logs. Same person, fewer acronyms.
I am an IAM engineering leader who is happiest where the problem is messy. Hand me a tangled, high stakes challenge that nobody wants to own, and I will map it, break it into pieces, and turn it into a clean solution the whole team can run. I think a few moves ahead: I care less about closing today's ticket and more about where identity is going next, and how to build for it now.
My default answer to repetitive work is to automate it out of existence. I would rather build the machine than run the errand, and I hold myself to the small details, because in security the one setting everyone overlooked is usually the one that matters. I also believe good work does not need a grim face, so I keep the room light and the team engaged.
Off the clock, I am dad to an almost three year old who has already mastered the most advanced social engineering technique known to man: getting his father to do exactly what he wants, every time. Toughest negotiator I have ever faced, and I close eight figure contracts for a living.
visionary
I build for where identity is heading, not just the ticket in front of me.
problem solver
Complex, tangled problems are the fun part. I decompose them until the fix is obvious.
automation first
If it repeats, it becomes code. Build the machine, skip the errand.
team builder
I build teams people want to stay on. 100% retention is not luck.
eye for detail
In security, the overlooked setting is the one that bites. I find it first.
good humor
Serious work, unserious face. A team that laughs together ships together.
scope: impact.read
Program outcomes, not promises
These are the results of the identity program I lead today. Every metric reflects a before-and-after transformation I can personally walk you through.
27% → 96% in under two years
Full CyberArk SaaS redeployment, legacy PSM migrated to SIA, adoption more than tripled.
scope: experience.read
The career, as an audit log
Every role, recorded. Expand an entry to see what actually shipped.
2024-04 → present IAM Engineering Manager Sobeys Inc. · Toronto (hybrid) ▼
Own the enterprise IAM engineering function: roadmap, vendor strategy, multimillion-dollar contracts and a 16-person organization across PAM, AD/Entra, IGA and Automation.
leadership & commercial
- Built the team from scratch: 12 engineers, 3 PMs, 1 BA, with 100% retention and recognized as a top-performing leader in 2024 and 2025
- Negotiated $6M+ in CyberArk license discounts on a 3-year agreement, funding machine identity, secrets and endpoint expansion
- Uncovered architecture gaps in prior vendor engagements that would have sunk the implementation, saving millions in change orders
- Review multimillion-dollar SOWs with Deloitte and Accenture; key decision-maker on initiatives like the CIAM migration
privileged access (cyberark)
- Redeployed the full CyberArk SaaS platform; migrated legacy PSM to SIA; tripled secure-user adoption
- Compliance 27% → 96%; privileged-account risk critical → medium; 7,000+ accounts remediated
- Just-in-Time and Zero Standing Privilege on every Tier 0 and Tier 1 account, on-prem AD and Entra ID
- Automated discovery and onboarding; Break Glass policy; Venafi certificate renewal workflows; zero incidents last fiscal year
ad & entra hardening
- Delivered the multi-year AD Hardening program: SMBv1 gone, hardening GPOs, IR playbooks, SIEM alerting, EOL decommissions
- DSRM and KRBTGT rotation with a repeatable process; on-prem and cloud test domains
- Migrated RSA MFA to Microsoft MFA with phishing-resistant passkeys; SSPR enabled; Conditional Access hardened
governance & automation
- Led the SailPoint IGA program from pre-implementation through implementation, including EOL system integrations and custom workflows
- Re-engineered identity lifecycle events for all target applications; access reviews defined with IAM Compliance
- Built the Azure Automation environment of 10+ automations (HR-driven terminations, onboarding, movers) that returned 700+ hours to the business
2021-04 → 2024-04 IAM Technical Lead Engineer Aviva Canada · remote ▼
Technical lead for IAM Operations and Engineering through the insurer's identity transformation.
highlights
- Technical expert leading the IAM transformation program to a new IGA platform (SailPoint)
- SME for AD migration, Azure AD MFA/SSPR, PIM rollout and company-wide M365 deployments
- Worked directly with CyberArk and BeyondTrust on implementation, configuration and upgrades; applied Microsoft AD tiering to privileged accounts
- Automation projects integrating ticketing, Workday and email; native PowerShell tool for cross-functional processes
- Security strategy with leaders in Canada and the UK; CrowdStrike server deployment plan
- Trained Operations and Engineering teams (PowerShell, Exchange Online, Azure AD)
2019-09 → 2021-04 Security Architect Stikeman Elliott LLP · Toronto (hybrid) ▼
Architected and ran the security stack for one of Canada's top law firms.
highlights
- Implemented Privileged Identity Management, significantly improving the firm's security score
- Led critical platforms: FortiNAC, password management (PMP), CrowdStrike, Defender ATP
- SecOps incident-response playbook and customized SIEM alerting
- Mail Flow and Datacenter migrations; Azure SSO, auto-provisioning and Conditional Access audits
- Phishing exercises with CISO reporting; compliance evidence for Deloitte auditors and major banks; pen-test coordination
2018-03 → 2019-09 Access Management Analyst Aviva Canada · Markham & Toronto ▼
Where the automation habit started.
highlights
- Managed a 5,000+ user Active Directory; daily access reporting with IT Information Security
- Automation scripts cut AD account work by an average of 95%; tools adopted across departments
- Knowledge-base articles used team-wide; trained newcomers with daily exercises
scope: skills.read
Depth, by domain
Self-rated against years in production environments, not checkbox familiarity.
scope: builds.read
Built end-to-end, off the clock
Production-grade side projects: solo product, architecture, security and code. Real codebases, not tutorial forks.
Identity at the Core
LIVEIAM publication & community · identityatcore.org
A long-form publication and community for the IAM industry, with articles, guest authors, a partner program and a member portal, built on an end-to-end role model.
security highlights
- Passwordless auth: WebAuthn passkeys + magic links, OAuth fallback
- Argon2id hashing, distributed rate limiting, Sentry observability
- Strict nonce-based CSP with strict-dynamic, HSTS preload, COOP/CORP
- RFC 9116 security.txt and a published disclosure policy
DNATechnology Marketplace
IN DEVConsulting site + digital marketplace · dnatechnology.ca
Tiered subscriptions and downloadable templates around a hardened Supabase + Stripe core, with a complete affiliate and commission program.
security highlights
- Webhook signatures verified on the raw body; idempotent retries via UNIQUE constraints
- Row-Level Security on every table; SECURITY DEFINER helpers
- HMAC-signed referral cookies; commission rates snapshotted at sale time
- Signed download URLs (60-second TTL) gated by an entitlements view
IAM X-ray & Automation
PRE-ALPHAIAM vulnerability discovery & audit platform
A commercial-grade IAM auditing platform: discovers, investigates and reports identity vulnerabilities across Active Directory, with Entra ID, Okta and Ping on the roadmap. Read-only by default.
architecture highlights
- Connector abstraction lets the same scanners run live (LDAPS) or offline (snapshot)
- YAML config validated against JSON Schema; credentials only in OS keystore/DPAPI/Vault
- Standard Finding evidence model feeds HTML, xlsx, CSV and PDF renderers
- Vertical slice complete: Inactive Accounts scanner end to end
Ultimate Karaoke
PREVIEWAI karaoke webapp: vocals stripped, lyrics synced
Search any song, a GPU worker strips the vocals, and synced lyrics scroll while you sing. Cloud-native across independent services and tiered free-tier hosts.
architecture highlights
- Demucs (Meta) on Modal GPUs for vocal removal; Whisper as timing fallback
- Spotify API metadata; LRCLIB synced lyrics; yt-dlp audio fallback
- Job queue on Upstash Redis between Next.js, FastAPI and the GPU worker
- Cloudflare R2 cache with 48-hour TTL for cheap egress
Customer Manager Portal
IN DEVSellable multi-tenant business template
A re-skinnable site + admin panel for service businesses. Each buyer rebrands a config-driven site in minutes, with no code edits.
highlights
- 5 industry presets + 4 seasonal palettes for instant rebrand
- 3-step booking flow with race-safe Firestore transactions
- Role-based access: client / staff / admin / owner
- Real-time 1:1 messaging and a self-tracked analytics dashboard
Smart Agenda
IN DEVBooking & member portal template · demo-template.com
Booking and member portal template for service practices: public site for prospects, self-service member booking, and an admin panel for the operator.
security highlights
- Strict CSP with explicit allow-lists; hardened response headers
- noindex/nofollow on the admin surface
- Member dashboard, pricing pages, multilingual UI
Ultimate Blog Template
IN DEVBlog + community portal template
Publishing platform with an admin editor, member community, real-time chat and reactions, built on Express with a security-first session model.
security highlights
- Passport auth (local + Google + Facebook), bcrypt-hashed passwords
- Forced 32-byte session-secret check at boot
- Helmet headers, per-route rate limiting, sanitize-html on every input
- Real-time community via Socket.IO
Interactive CV
LIVEThis site · single file, security-first
The page you are reading: one HTML file, zero third-party scripts, no cookies, no analytics, and everything still moves.
security highlights
- Zero external dependencies; gauges and charts are hand-drawn SVG
- Strict Content-Security-Policy; all external links rel=noopener
- Honeypot + validation on the contact form; nothing leaves this page
- Respects prefers-reduced-motion and prefers-color-scheme
scope: education.read
Foundation
Hanson Cambrian College
IT: Mobile Application Development
2017 → 2018 · Toronto
IBT College
IT: Network Administration
2015 → 2016 · Toronto
Universidade Presbiteriana Mackenzie
Bachelor of Sciences
2007 → 2012 · São Paulo
scope: contact.write
Request access
The one scope on this page with write permission. For senior IAM and security leadership conversations, the door is open.