Paolo Caparrelli

Paolo Caparrelli is the Managing Director of GOLINE SA and the architect of its Security Operations Centre. An IT leader with more than 25 years of experience, he has built his career on running highly reliable IT organisations, where cybersecurity, network architecture and infrastructure management are designed together rather than added afterwards. Since 2012 he has led the three departments of GOLINE, Software Development, Networking and Systems, and Security, delivering carrier-grade connectivity, managed security and infrastructure engineering to customers across Switzerland and Europe.

His security work covers vulnerability assessment, security policy design, proactive threat monitoring and incident response. As a Wazuh Ambassador he designs and runs XDR platforms that integrate Wazuh with the Elastic Stack, Suricata IDS/IPS, Sysmon, MISP and the Fortinet Security Fabric, writes custom detection rules and automated response workflows, and publishes his tools and research for the open-source community.

On the network side he holds the Cisco CCIE Routing & Switching and CCDE certifications and specialises in BGP. He operates GOLINE’s own Autonomous System, AS202032, a MANRS participant peering at major Internet Exchange Points, on Cisco, Juniper, Huawei, MikroTik and Fortinet platforms with VXLAN-EVPN, MPLS, SRv6 and Segment Routing. He works in Linux and Windows environments and writes Python, Go, Rust, Bash, PowerShell and Next.js for security automation and infrastructure as code.

Career

1. Since 2012
   GOLINE SA, StabioManaging Director

   Strategic and operational direction of the company and of its three departments: Software Development, Networking and Systems, and Security. From the carrier network and the SOC to software projects for logistics, content management, e-commerce and web portals, with full responsibility for delivery, budget and compliance.

2. 2009 to 2012
   Buonvicini AG, StabioChief Information Officer

   Led the IT department through the Microsoft Dynamics NAV 2009 R2 migration, web applications on NAV web services for logistics, Cisco Unified Communications VoIP and FoIP, Microsoft CRM 2011, SharePoint 2010 and Exchange 2010, together with new security, video surveillance and environmental monitoring systems.

3. 2000 to 2009
   R. Audemars SA, CadempinoIT Manager

   Almost ten years at a micro-technology pioneer founded in 1898: ERP migration from OpenVMS to Windows, BusinessObjects business intelligence, Cisco VoIP connecting the branches in China and the USA with substantial savings, and ISO quality compliance.

4. 1999
   Banca del Gottardo (now EFG Private Bank), LuganoSolaris and Windows System Administrator, IT Security and Software Developer

   Administration of the Solaris systems running the bank’s trading and market data applications (SWX, Telekurs FIMS, DJ Telerate, Forex), Exchange and Windows administration, help desk integration for BSI Bank and member of the bank’s technical task force.

5. 1998 to 1999
   Selesta SpA, GrandateHead of Networking Department

   Led network management, system administration and project delivery for the networking division; HP OpenView certified.

6. 1996 to 1997
   Selpress, MilanIT Manager

   Redesigned the network of a leading press review and media monitoring company, developed its data transmission and PressReview software and administered its Novell and Microsoft networks.

Education and certifications

• Università degli Studi di Milano, Laurea in Scienze e Tecnologie Informatiche (1992 to 1999)
• Cisco CCIE Routing & Switching
• Cisco CCDE
• Cisco CCNA Security
• Fing IT Professional
• HP OpenView

Languages: Italian (native), English (full professional proficiency), German (working knowledge).

Areas of expertise

• IT and cybersecurity strategy, SOC and SIEM/XDR architecture (Wazuh, Elastic Stack, Suricata, MISP, Fortinet)
• Carrier networking and BGP (AS202032, peering, RPKI, MANRS) on Cisco, Juniper, Huawei and MikroTik
• Data centre operations, disaster recovery and business continuity
• Microsoft and Linux infrastructure, virtualisation, storage, backup, Oracle and SQL Server databases
• Security automation and infrastructure as code (Python, Go, Rust, Bash, PowerShell)
• Digital forensics and incident response
• Project, programme and vendor management, building and leading IT teams

Publications and open source

• How I Built a Custom ML Anomaly Detection Engine Inside Wazuh (Processing 1M+ Events/Hour), 2026
• Building Next-Generation SIEM: from standard Wazuh to an AI-powered Security Operations Center, 2025
• YARA4WAZUH: enterprise-grade malware detection in the SOC, 2025
• SharePoint CVE-2025-53770 (ToolShell) Incident Response Guide, 2025
• On GitHub: Sysmon_Config_for_Wazuh, yara4wazuh, wazuh-mitre-warnings-fix, goline-looking-glass, Suricata-CSF-autoblock and FortiGateToAbuseIPDB

The FAQ articles below are written from real cases handled by GOLINE’s engineers. Questions and corrections are welcome in the comments of each article.