Available for new projects
We harden Linux servers and cloud environments, automate delivery with security controls inside the pipeline, and leave everything documented and reproducible. No black boxes: versioned scripts, verifiable evidence, and the operation in your hands when we are done.
Let's talk about your infrastructure See services
Six areas covering the whole cycle: from the server you just bought to answering an incident at 3 a.m.
Servers and VPS hardened against CIS benchmarks, automated and repeatable.
Cloud accounts and networks with least privilege, encryption and costs under control.
Pipelines that inspect the code and block the deployment when something serious shows up.
Inventory, scanning and prioritisation by real risk, with agreed remediation deadlines.
Real visibility into what happens on your servers, with alerts you can actually act on.
Backups and recovery plans that are actually tested, not just written down.
Four stages. In none of them do we touch production without agreeing it first and without a way back.
Read-only audit and inventory of what exists: servers, exposed services, access paths, backups and technical debt. No changes, no risk.
Findings ordered by risk and effort, separating what can be closed in a day from what needs a project. Clear cost and timeline before we start.
Changes inside agreed maintenance windows, versioned and with a prepared rollback. Staging test first whenever the change warrants it.
Before-and-after report with the real command output, scripts and configuration in your repository, plus a handover session so your team can keep it running.
Tools we built, sitting in our public repository: code, tests and results, not screenshots.
Idempotent hardening script for Debian/RHEL with an audit mode. The tests verify that applying it twice changes nothing and that the pre-flight audit catches the expected findings.
Recon pipeline that refuses to run a single active step (DNS brute force, scanning) unless a signed authorisation file exists. Secure by design, not by good intentions.
Pipeline with secret, dependency, IaC and container gates. Tested both red and green: with a real secret or a vulnerable dependency, the deployment fails automatically.
All work is delivered with scripts and configuration in a repository registered under your name.
Nexutrek is an infrastructure and security company. We operate from Brazil and serve clients across Latin America, Europe and the United States in English, Portuguese and Spanish. Our focus is concrete: servers that cannot stop and the breach that has not happened yet.
Our work combines operations and security: we run e-commerce platforms at 99.9% availability with zero breaches, apply OWASP controls inside the pipeline and own vulnerability management end to end. We come from banking, international e-commerce and security analysis, always at the same place: the intersection of infrastructure and attack.
We work by process, not by improvisation: written scope, versioned changes and evidence for every step. Our commitment is simple: if we say something is closed, we show the command output that proves it.
Marcos GómezFounder and technical lead
Marcos Gómez founded Nexutrek after more than 10 years working on servers that cannot stop. He has worked in banking, international e-commerce and security analysis, always at the same place: the intersection of infrastructure and attack.
He leads the company's technical operation: he sets the working standards, runs the critical projects and answers for what is delivered. He speaks English, Portuguese and Spanish.
Remotely, for Latin America, Europe and the United States, in English, Portuguese or Spanish. We are on Brazil time (UTC-3), which overlaps well with Europe and with the US East Coast.
One to two weeks for a small or mid-sized fleet, including the initial assessment and the evidence report. A single server is closed out in a day of work.
Yes. We work with Oracle Cloud, AWS and VPS from any provider. Free tiers and small servers are perfectly valid: what changes is the scope, not the security standard.
Just read-only access for the assessment, or the command output we ask for if you would rather not grant access at all. We never need you to send passwords or credentials over chat or email.
Every change happens inside an agreed window, versioned and with a rollback prepared before anything is touched. When a change is delicate, it is tested in staging first. If something cannot be tested safely, we tell you before, not after.
It depends on scope: how many servers, whether cloud is involved, and what needs cleaning up. We send a fixed quote within 24 to 48 hours with the scope in writing, and no surprises halfway through.
Tell us what you have running and what worries you. We will come back with an initial assessment and concrete next steps.
Typical response within 24 hours, on business days (UTC-3).
If your enquiry involves company data, write to us and we will sign a non-disclosure agreement before you share any technical detail.
