I'm Fortino

I've spent over twelve years in software development, and the last five specializing in identity and access — IAM and CIAM — within Brazilian financial institutions. It's a field I learned to take seriously in a specific way: in these systems, an authentication failure isn't just a bug, it's an incident with immediate regulatory consequences.

I spent time at Itaú Unibanco, where I led the authorization team of the identity platform behind the Banking-as-a-Service product — responsible for the production authorization flow of PIX, at tens of millions of requests per day. Later, at Stone, I led the consolidation of the group's authentication systems: multiple in-house solutions, one per company, unified into a single platform for 12 million users, with no incident during the migration.

Along the way, I worked with OAuth 2.0, OpenID Connect, CIBA, SAML, SCIM, FIDO2 and identity modeling in multi-tenant environments — always through the lens of Brazilian data protection law, central bank regulation, and audit controls. I also enjoy the part of the job that's about solving the problem nobody documented: finding the critical dependency with no fallback, or the metric everyone was reading wrong because the baseline was contaminated.

I'm currently an MSc candidate in Cyber Security at the University of London. I write here about the topics in identity and security that interest me most — usually things I learned by solving a real problem, not theory.

I hold dual citizenship (Portuguese/EU) and speak Portuguese, English and Spanish.