Services

OEMs now push cybersecurity requirements down the supply chain. I help Tier-1 and Tier-2 suppliers read those requirements, find the gaps and close them in the order that matters.

• Gap assessment against the OEM's flow-down and ISO/SAE 21434 clauses
• Threat analysis and risk assessment (TARA) for a component or system
• CSMS scaffolding: roles, work products, evidence trail for audits
• Cybersecurity A-SPICE preparation
• Review of supplier cybersecurity interface agreements and quotes

Functional safety and cybersecurity are usually run as separate processes. On ADAS systems they cannot be: an attack on perception or on in-vehicle communication is a safety event. I bring the two together in a way both review boards accept.

• Joint hazard and threat analysis (HARA + TARA, STPA-Sec)
• Security requirements written so safety reviewers can read them, and vice versa
• The engineering case for message authentication (SecOC, MACsec) in terms of latency, cost and risk
• Model-based V&V: TARA-driven test generation on Simulink / HIL
• Architecture reviews of camera, radar and compute platforms

For manufacturing sites and their suppliers, delivered with my company METIS in Mexico when the site is there.

• IEC 62443 zones-and-conduits assessment
• PLC, SCADA and remote-access risk review
• MITRE ATT&CK for ICS threat modeling
• Monitoring and alerting for industrial networks
• Secure solar / distributed-energy installations

I use LLM-based tools daily and build them for my own company. The gain is real when an engineer validates the output; I set that up for teams.

• LLM-assisted TARA drafting, test-case generation, requirements review
• Document pipelines (OCR, extraction, structured data) for engineering records
• AI-assisted vulnerability research as an academic line of work
• Evaluation of AI tooling for safety-relevant workflows

One-hour calls and written Q&A for investors, analysts and engineering teams. Available through GLG, AlphaSights, Guidepoint, Dialectica, or booked directly.

• Automotive cybersecurity regulation and practice (R155/R156, 21434, China GB standards, EU CRA)
• ADAS architectures, the safety–security interface and the chip landscape (public information)
• OT security in manufacturing; nearshoring supplier ecosystems in Mexico
• Distributed solar in Mexico: tariffs, installer economics, monitoring

Half-day to multi-day sessions for engineering teams, management and universities. I have taught graduate courses since 2011, in person and online.

• ISO/SAE 21434 and UN R155 for engineers and managers
• OT security fundamentals for plant teams
• MBSE and SysML v2; systems V&V
• Custom curricula with universities (diplomados) in Spanish

Consulting and software development in Spanish for companies in Mexico, Latin America, Canada and Spain, delivered through METIS: industrial automation, monitoring, cybersecurity and custom applications.

• Industrial and energy clients on the Gulf coast, central and southwest Mexico
• Spanish-speaking teams in Canada and Spain that want an engineer who works in their language
• Small and mid-size businesses in the US Hispanic community that need systems built right