Hi, I'm Marcos Garcia Chillon.
Lead Security Architect with 18 years in cyber security, most of them protecting satellite and space operations at EUMETSAT and the European Space Agency.
I've spent my career bridging business, infrastructure and development teams, and turning security from a perceived obstacle into something that helps projects succeed. Lately my focus has been machine learning and AI, which I see as the next frontier of cyber security.
Chill On Security is where I share my projects, ideas and lessons learned: calmly, clearly, and without the fear-mongering.
My time at EUMETSAT ends in December 2026. From January 2027 I'm available for senior security roles and consulting engagements.
Experience
- 2024 – 2026
Lead Security Architect, EUMETSAT
Overall security architect for Europe's meteorological satellite organisation: one unified architecture across the satellite ground segment, cloud-based data processing and corporate IT.
- 2020 – 2024
Information Security Engineering Team Leader, EUMETSAT
Led a team of around 15 engineers and built a security engineering process that brings threat modelling and risk analysis into every new project from day one.
- 2018 – 2020
Information Security Engineer, EUMETSAT
Endpoint protection for air-gapped operational networks, and a unified firewall architecture for on-premise and cloud.
- 2011 – 2017
IT Security Engineer, European Space Agency (ESOC), via GMV
Implemented the information security management system that earned ESA's operations centre its ISO 27001 certification, plus vulnerability and password management for mission operations.
- 2008 – 2011
Information Security Engineer, GMV (Barcelona)
Security consulting projects and digital forensics for customer incidents.
Highlights
A critical zero-day, found during an incident
While investigating an incident, I discovered two actively exploited vulnerabilities in SmartClient Server, rated CVSS 9.8. I wrote a proof-of-concept for the vendor under coordinated disclosure, and they shipped a fix within hours.
Read the vendor's advisory →Holistic Password Management for the Ground Segment
Peer-reviewed paper presented at SpaceOps 2014 (AIAA): a practical framework for passwords in space mission operations, balancing people, processes and technology.
Kubernetes on four Raspberry Pis
My playground for DevSecOps: a small cluster with a GitLab CI/CD pipeline, where most blog experiments start.
Certifications
- CISSPISC2 · since 2013
- GMLE · Machine Learning EngineerGIAC · 2026
- GCSA · Cloud Security AutomationGIAC · 2025
- ISO/IEC 27001 Lead AuditorBSI · 2012
- AI-300 · Advanced AI Red TeamingOffSec · in progress
Also a GIAC Advisory Board member since 2009. Previously held: CEH, ECIH, GCFA, GSEC, PMI-ACP.Verify on Credly
Education & languages
- Master in Telecommunications EngineeringUniversitat Politècnica de Catalunya, Barcelona
- Bachelor in Telecommunications EngineeringUniversitat de les Illes Balears, Mallorca
Spanish (native) · English and Catalan (proficient) · German (basic) · French (learning)
What I believe
- Security should be an enabler, not an obstacle.
- Pragmatism wins: balance security, technology and business.
- Clarity beats fear. People act on advice they understand.