Director of Cybersecurity Services at BCNET — the shared-services network behind British Columbia's colleges, universities and research institutions. Former Brazilian Army Lieutenant Colonel and cyberwarfare educator, now building threat intelligence, detection and readiness for the higher-education sector.
The hands-on book that grew out of the BSides Vancouver workshop — turning dark-web myth into evidence, and pairing clear theory with self-contained, lawful labs. Now available on Amazon.
From Tor and onion services to marketplaces, OSINT, and safe lab practice — a practical, ethically-framed tour of how the dark web actually works, written for security professionals, students, and the plain curious.
Vancouver's business & entrepreneurs magazine features Toni on the cover of Volume 4, Issue 14 — alongside nine other leaders shaping the city's business community.
Portfolio.YVR profiles the entrepreneurs and leaders shaping Vancouver's business scene. This issue follows the path from Brazilian Army Lieutenant Colonel and cyberwarfare educator to Director of Cybersecurity Services at BCNET — and the mission of defending BC's research and education network.
Toni Brandao has spent his career at intersections most people never cross: military command and modern cybersecurity, academia and operations, Latin America and Canada. The through-line is defense — of networks, of institutions, and of the people who depend on them.
He commanded and coordinated operations as a Brazilian Army Lieutenant Colonel, then spent roughly seven years as Head Professor of CyberWarfare at the Academia Militar das Agulhas Negras (AMAN), training a generation of officers in offensive and defensive security.
In Canada, he moved from securing a design university's network into BCNET — rising from SIEM administrator to cybersecurity architect to Director of Cybersecurity Services, where he protects the shared network serving British Columbia's post-secondary and research community.
Along the way he was invited to run the results and IT for one of the most logistically complex sports at the Rio 2016 Olympic Games and volunteered at the Toronto 2015 Pan American Games — the same instinct to make critical systems work under pressure, applied to a global stage.
From coordinating army operations to architecting a provincial network's defenses — each role built the next.
Leads cybersecurity strategy and services for BC's research & education network, protecting members across the province. Grew into the role from SIEM administrator and cybersecurity architect.
Designed detection and security architecture and ran the SIEM platform underpinning the network's monitoring and threat-hunting capability.
Owned network and security administration for a creative-focused university environment.
He was invited to run the results and IT operations for one of the Games' most logistically complex, multi-discipline sports.
Provided network support and mentoring while completing honours diplomas; volunteered to help deliver the 2015 Pan American Games.
Taught cyberwarfare to army officers for roughly seven years, following a role as information security analyst and network administrator.
Planned and coordinated operations across multiple teams and support structures.
A SANS/GIAC-heavy certification stack spanning detection, incident response, OSINT and offensive testing — backed by military science and computing degrees across two countries.
Currently pursuing the CCISO (Certified CISO) credential at EC-Council.
Regular presenter and workshop facilitator on threat landscape, red teaming, and the dark web — and creator of national capture-the-flag exercises for Canadian higher education.
How AI has industrialized cybercrime — and how leaders can use attacker thinking to sharpen risk prioritization and board-level conversations.
Session detailsA four-scenario national competition for Canadian universities and colleges, powered by the TTX Platform with AI scoring and after-action reports.
Workshop pageA hands-on workshop at BSides Vancouver's 12th annual community conference, demystifying dark-web technology and risk.
ScheduleAn educational deck covering how the dark web works, with detailed ethical and legal framing. Slides published publicly.
Read the slidesGuest lecture on dark-web privacy, plus industrial-partner mentorship guiding two students through an ML-based darknet traffic-classification capstone.
The full red-team lifecycle in a university setting — planning, recon, exploitation and post-exploitation — with hands-on CTF-style exercises.
Workshop pageSole organizer of a two-day CTF investigating breaches at a fictional company — manipulated logs, covert intrusions and cryptographic puzzles.
Competition pageBuilding an incident-response "GO bag" of templates, checklists and communication tools. Slide deck published publicly.
Archive pagePlatforms and tools for threat intelligence, security training and awareness — several of them open and in active use.
A threat-intelligence platform fusing 11+ sources — MalwareBazaar, ThreatFox, CISA KEV, NVD, ransomware.live and more — to monitor ransomware groups, victims, CVEs and dark-web leak sites with automated dashboards.
An AI-powered ransomware-negotiation simulator built on real negotiation logs, letting defenders rehearse interactions with different ransomware groups. Referenced in the Casualtek/Ransomchats project.
A custom tabletop-exercise platform with AI facilitation, competition modes, scenario management and PDF reporting — the engine behind BCNET's national Cyber Scenarios Challenge.
An HTML-based educational course repository supporting dark-web awareness presentations — surface vs. deep vs. dark web, TOR, privacy and safe research practice.
Recognizes sustained, high-impact contributions to the cybersecurity community — reflecting years of engagement with the ISACA Vancouver Chapter, mentorship and knowledge-sharing across BC's higher-education and security communities.
Advisor to a national cybersecurity exercise, placing him at the centre of a country-scale cyber-readiness initiative bringing together partners from across Canada's security community.
Open to speaking invitations, advisory conversations, and connecting with others working in threat intelligence, higher-education security and the Canadian cyber community.