Director of Cybersecurity Services at BCNET — the shared-services network behind British Columbia's colleges, universities and research institutions. Former Brazilian Army Lieutenant Colonel and cyberwarfare educator, now building threat intelligence, detection and readiness for the higher-education sector.
Four books in the Unlock the Secrets of the Dark Web series. Volumes 1–2 are the labs track: Volume 1 explains how the dark web works; Volume 2 teaches threat intelligence collection with a companion lab site. Volumes 3–4 are the executive decisions track: the story behind the decisions, then the briefing that keeps only the decisions.
From Tor and onion services to marketplaces, OSINT, and safe lab practice — a practical, ethically-framed tour of how the dark web actually works, written for security professionals, students, and the plain curious.
Unlock the Secrets of the Dark Web: Threat Intelligence and Hands-On Labs. Volume 2 teaches collection — crawling, markets, leak sites, attribution, detection, and reporting — across 109 graded labs on a synthetic range, with a companion lab site you host yourself.
The Story Behind the Decision — Executives Decisions. Volume 3 focuses on the reasoning that informs executive decisions about the dark web: the story, the trade-offs, and the context leaders need before they act.
The Executive Briefing — Decisions Only. Volume 4 distills the series for an executive audience: the decisions only, stripped of lab scaffolding, so leaders can brief, decide, and move.
Vancouver's business & entrepreneurs magazine features Toni on the cover of Volume 4, Issue 14 — alongside nine other leaders shaping the city's business community.
Portfolio.YVR profiles the entrepreneurs and leaders shaping Vancouver's business scene. This issue follows the path from Brazilian Army Lieutenant Colonel and cyberwarfare educator to Director of Cybersecurity Services at BCNET — and the mission of defending BC's research and education network.
Toni Brandao has spent his career at intersections most people never cross: military command and modern cybersecurity, academia and operations, Latin America and Canada. The through-line is defense — of networks, of institutions, and of the people who depend on them.
He commanded and coordinated operations as a Brazilian Army Lieutenant Colonel, then spent roughly seven years as Head Professor of CyberWarfare at the Academia Militar das Agulhas Negras (AMAN), training a generation of officers in offensive and defensive security.
In Canada, he moved from securing a design university's network into BCNET — rising from SIEM administrator to cybersecurity architect to Director of Cybersecurity Services, where he protects the shared network serving British Columbia's post-secondary and research community.
Along the way he was invited to run the results and IT for one of the most logistically complex sports at the Rio 2016 Olympic Games and volunteered at the Toronto 2015 Pan American Games — the same instinct to make critical systems work under pressure, applied to a global stage.
From coordinating army operations to architecting a provincial network's defenses — each role built the next.
Leads cybersecurity strategy and services for BC's research & education network, protecting members across the province. Grew into the role from SIEM administrator and cybersecurity architect.
Designed detection and security architecture and ran the SIEM platform underpinning the network's monitoring and threat-hunting capability.
Owned network and security administration for a creative-focused university environment.
He was invited to run the results and IT operations for one of the Games' most logistically complex, multi-discipline sports.
Provided network support and mentoring while completing honours diplomas; volunteered to help deliver the 2015 Pan American Games.
Taught cyberwarfare to army officers for roughly seven years, following a role as information security analyst and network administrator.
Planned and coordinated operations across multiple teams and support structures.
A SANS/GIAC-heavy certification stack spanning detection, incident response, OSINT and offensive testing — backed by military science and computing degrees across two countries.
Currently pursuing the CCISO (Certified CISO) credential at EC-Council.
Regular presenter and workshop facilitator on threat landscape, red teaming, and the dark web — and creator of national capture-the-flag exercises for Canadian higher education.
How AI has industrialized cybercrime — and how leaders can use attacker thinking to sharpen risk prioritization and board-level conversations.
Session detailsA four-scenario national competition for Canadian universities and colleges, powered by the TTX Platform with AI scoring and after-action reports.
Workshop pageA hands-on workshop at BSides Vancouver's 12th annual community conference, demystifying dark-web technology and risk.
ScheduleAn educational deck covering how the dark web works, with detailed ethical and legal framing. Slides published publicly.
Read the slidesGuest lecture on dark-web privacy, plus industrial-partner mentorship guiding two students through an ML-based darknet traffic-classification capstone.
The full red-team lifecycle in a university setting — planning, recon, exploitation and post-exploitation — with hands-on CTF-style exercises.
Workshop pageSole organizer of a two-day CTF investigating breaches at a fictional company — manipulated logs, covert intrusions and cryptographic puzzles.
Competition pageBuilding an incident-response "GO bag" of templates, checklists and communication tools. Slide deck published publicly.
Archive pagePlatforms and tools for threat intelligence, security training and awareness — several of them open and in active use.
Live ransomware command center: victims, leak-site groups, global map, threat feeds, CVEs, and ATT&CK — with hourly updates from dark-web monitoring and exportable IOCs for SIEM integration.
An AI-powered ransomware-negotiation simulator built on real negotiation logs, letting defenders rehearse interactions with different ransomware groups. Referenced in the Casualtek/Ransomchats project.
A custom tabletop-exercise platform with AI facilitation, competition modes, scenario management and PDF reporting — the engine behind BCNET's national Cyber Scenarios Challenge.
Companion lab site for Unlock the Secrets of the Dark Web, Volume 2 — 109 graded labs across fifteen chapters on a synthetic range, with copy-ready commands and scored engines.
Recognizes sustained, high-impact contributions to the cybersecurity community — reflecting years of engagement with the ISACA Vancouver Chapter, mentorship and knowledge-sharing across BC's higher-education and security communities.
Advisor to a national cybersecurity exercise, placing him at the centre of a country-scale cyber-readiness initiative bringing together partners from across Canada's security community.
Open to speaking invitations, advisory conversations, and connecting with others working in threat intelligence, higher-education security and the Canadian cyber community.