Lorenzo Susini
Threat Detection Engineer
Madrid, Community of Madrid, Spain
Summary
🤩
Rockstar🎓
Top SchoolLorenzo Susini is a Threat Detection Engineer with seven years of experience specializing in the intersection of security and systems-level programming, currently focused on threat detection at Datadog. He is a long-time contributor and Falco core maintainer in the CNCF runtime security ecosystem, with deep hands-on work improving rule and engine behavior, syscall handling, and event detail modeling. His background at Sysdig spanned roles from intern to senior threat researcher, giving him practical expertise from kernel/syscall tracing to threat research and detection engineering. Lorenzo combines academic training in computer engineering with a cybersecurity track from Università di Pisa and a proven track record of shipping low-level security features and operators in open-source libs. He brings a pragmatic approach to observability-driven security, often bridging gaps between runtime telemetry and actionable detection logic. Colleagues rely on him for hard-to-reproduce syscall-level diagnostics and for making Falco’s engine outputs more precise and usable.
7 years of coding experience
3 years of employment as a software developer
Master's degree Computer Engineering (Cybersecurity Track), Master's degree Computer Engineering (Cybersecurity Track) at Università di Pisa
Stackoverflow
11reputation
3kreached
1answer
1question
Github Skills (22)
syscall10
c-language10
develop10
ebpf10
run-time10
security10
kernel10
kernel-mode10
falco10
engine10
cprogramming-language10
cloud-native10
cap9
lib9
json9
Programming languages (12)
Github contributions (5)
falcosecurity/libs
Nov 2021 - Nov 2022
libsinsp, libscap, the kernel module driver, and the eBPF driver sources
Role in this project:
Backend Engineer
Backend EngineerContributions:69 reviews, 99 commits, 40 PRs in 1 year
Contributions summary:Lorenzo primarily contributed to the `falcosecurity/libs` repository by implementing and modifying core functionalities. They added the mprotect syscall parameters and implemented the copy_file_range syscall. They also performed refactoring tasks, including cleaning up sysdig references and implemented the bcontains and bstartswith operators, with particular focus on syscalls and kernel functionality related to the Falco security project.
kernelbpflibsinspebpflinux
falcosecurity/falco
Dec 2021 - Nov 2022
Cloud Native Runtime Security
Role in this project:Backend & Security Engineer
Backend & Security EngineerContributions:25 reviews, 5 commits, 27 PRs in 11 months
Contributions summary:Lorenzo primarily contributed to the Falco project by implementing and refining features related to rule and engine functionalities. This involved improving output formatting, handling engine versioning, and introducing new classes for rule detail retrieval. Furthermore, the user addressed code comments, modularized the JSON output, and introduced event code details, enhancing the project's overall security and providing more comprehensive rule descriptions. These contributions demonstrate a strong understanding of the Falco engine and its underlying security principles.
containersseccompsecurityruntimeebpf
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.