Skip to content
~/mandrakis

whoami

Vassilis Mandrakis

Security operator. Blue by background, red by ambition.

I'm Vassilis Mandrakis. I run information security for the University of Western Macedonia in Greece, where I designed and built the SOC in-house rather than buying a managed stack. I'm now systematically moving from defensive practice to red team work — CRTO in progress, OSEP next.

My path here took the long route: web developer in the late '90s, then seventeen years as a Computer Science teacher and IT infrastructure lead for schools across the Corfu region under the Ministry of Education, then the CISO seat in 2021. Throughout, the curiosity that pushed me as a student to find a critical authentication flaw in Piraeus Bank's first e-banking platform — a hidden navigation element passing the account number as a GET parameter, granting access to any account — never went away. Responsibly disclosed. The instinct just compounded into a career.

What's written here lives at the intersection of those two halves: years of running detection engineering and security operations on the blue side, meeting the offensive tradecraft I'm now training in deliberately.

Open to remote red team roles · EU / US

latest writing

all posts →

selected research

full index →

  • Custom university SOC stack

    In production

    Designed and built in-house rather than bought as a managed service. Wazuh as SIEM core, integrated through a custom Python layer with MISP threat intelligence and CrowdSec community reputation data — extended with a separate node feeding deduplicated decisions with preserved TTL. The integration extracts observables from alerts, enriches and scores them, and drives custom Wazuh detection rules that trigger automated firewall-level blocking via active response. Dashboarded in OpenSearch.

  • Piraeus Bank e-banking authentication flaw

    Responsible disclosure · ~2000

    The first-generation e-banking platform exposed a hidden navigation element that passed the account number as a GET parameter. Altering it granted access to any account. Found as a student, reported to the bank.

  • CRTO — Certified Red Team Operator

    In progress

    Hands-on red team operator certification: adversary simulation, C2, evasion, and Active Directory attack paths.