Cybersecurity Engineer

_{Pentest · Red Team · Malware Development
SOC · SIEM · DFIR · Cyber Threat Intelligence
Risk & Compliance · ISMS · EBIOS RM · ISO 27001 · PCI-DSS · PDIS}

_{Windows · Linux · Hardening · Automation · DevOps
Local LLMs · RAG · Fine-tuning · AI Automation}

Cybersecurity professional with a background spanning Offensive Security, Defensive Security, System & Network Administration, and Security Governance (Risk Management, Compliance, Security Strategy).

I build and break things, and I document both.

• HETIC — FullStack Web Development, Design & Communication
• 42 — Low-Level Programming, Algorithms
• Aston Institute — System, Network & Security Administration
• 2600 — Offensive & Defensive Security, Governance
• Oteria Cyber School — Cybersecurity & Governance

• 💼 Freelance / Auto-entrepreneur — IT · Web Developer · SysAdmin · Security Consultant Independent missions across IT, infrastructure, web development and security consulting.

• 🌍 Veolia — IT Global leader in water, waste & energy management — €45B+ revenue, 220+ countries, 213,000+ employees.

• 🇫🇷 French National Assembly — IT Core institution of French democracy — 577 deputies, Palais Bourbon, Paris.

• 🏙 City of Aulnay-sous-Bois — IT → SysAdmin & Network Engineer → CISO Municipal infrastructure — 85,000+ inhabitants, 2,000+ agents, 100+ sites, 1,500+ endpoints, 100+ servers. On-prem datacenter (7+ physical hosts, server racks), 100+ L2/L3 switches over a city-wide fiber network linking sites across several kilometers — schools, police, administrative buildings. Everything managed in-house.

• 🎭 Théâtre des Champs-Élysées · Groupe Caisse des Dépôts — Cybersecurity Engineer Classified French historical monument (1957), Avenue Montaigne — CDC-group property since 1970, via the Société Immobilière du Théâtre des Champs-Élysées (a CDC subsidiary). Hybrid SI security, offensive & defensive operations, SOC deployment.

• 🏦 Crédit Agricole — Cybersecurity & Linux Systems Engineer At one of the world's largest banking groups — €2,000B+ in assets, 150,000+ employees worldwide.

• ⚔️ KatanHack — Founder Cybersecurity consultancy — penetration testing, Active Directory & web audits, security awareness.

Additional engagements conducted as freelance / auto-entrepreneur — multiple confidential clients across pentest, security consulting, IT infrastructure, and development missions.

• CVE-2025-67906 — Stored XSS · MISP (Malware Information Sharing Platform) · Workflow Engine
  
  Zero-click persistent XSS via doT.js template injection. Session hijacking, threat intel data exfiltration.

• Critical 0-Days — Blind SQLi & Zero-Click Stored XSS · GovTech / Enterprise SaaS
  
  Unauthenticated DB exfiltration + zero-click super-admin session takeover.

• Critical 0-Day — Cryptographic Failure + Business Logic · Fortune 500 Payment Infrastructure
  
  Transaction integrity bypass across the entire global payment network.

• Critical — Chained Authentication Bypass · Xelians
  
  Multiple chained vulnerabilities leading to full account takeover across the platform and all client tenants — including sensitive government archive data.

• High — Mass Government Data Exfiltration via Authentication Bypass · DINUM (Direction Interministérielle du Numérique)
  
  Chained enumeration and authentication bypass — exposing criminal investigation files, classified government records, employee PII, and sensitive operational data across the entire French public sector.

• High — CORS Misconfiguration + Regex Bypass · Qwant
  
  Cross-origin exfiltration of authenticated data via origin reflection and suffix bypass.

• High — Healthcare Platform Data Exfiltration · Caisse Nationale d'Assurance Maladie
  
  Unauthenticated access to sensitive internal healthcare data and operational information of France's national health platform.

A curated, non-exhaustive selection — further findings remain private or under NDA.

• Pentest & Red Teaming — Infra., AD, Web, Wi-Fi Assessments, Adversary Emulation, OPSEC.
• Malware Development — Offensive tooling in C, Rust, Go, Python — loaders, rootkits, C2 implants, exploit writing.
• Security Governance — ISMS, risk management (EBIOS RM), compliance, awareness — CISO / Assistant CIO experience.
• System & Network Administration — AD, Cisco, Palo Alto, ESXi, Proxmox, Windows/Linux hardening, automation, DevOps.
• Defensive Security — SOC, detection engineering, incident response, threat hunting, SIEM.

Available for engagements and serious collaborations — consulting or building.
Availability varies with current assignments and workload; always up for a coffee.

• MetaDetective — Metadata intelligence for OSINT & pentesting — the Metagoofil successor.
• SYSTEMatic — Token impersonation: Administrator → SYSTEM, no tools required.
• ADMappingToolkit — Active Directory inventory & network recon — reachability, ports, unconstrained delegation, EOS OS, CSV export.
• AD-AdminSDHolder-Toolkit — Audit, detect backdoors & clean orphaned AdminSDHolder (AdminCount=1) accounts via well-known SIDs.
• CassandraCTI — Collect, process & auto-distribute Cyber Threat Intelligence from RSS across platforms.
• PunyPwn — Typosquatting, IDN homograph & bitsquatting generator for red team & brand protection.
• LastLog-Audit — Linux last-logon forensics from the binary lastlog database.
• hidemylogs — Surgical Linux log cleaner — erase lastlog/wtmp/btmp/utmp records while preserving file metadata.
• CVE-2025-67906 — MISP ≤ 2.5.27 stored XSS via the Workflow Engine (doT.js template injection).
• CVE_2026_24061 — GNU InetUtils telnetd — unauthenticated remote root via NEW-ENVIRON injection.
• do-manager — Modular Go CLI & library to provision, inspect & destroy DigitalOcean infrastructure.
• ubuntu-post-install — One script: hardening, GNOME tweaks, privacy & developer tooling on fresh Ubuntu.
• bmctl — Firefox bookmark toolkit — audit duplicates, compare exports, merge, dashboard.
• whispr — Whisper transcription pipeline — 3 backends, parallel chunks, multi-format output.
• Floodles — Modular DoS/DDoS testing toolkit — 19 vectors across L3/L4/L7 (Python/C/Rust/Go).
• DOSArena — DoS/DDoS training platform with live proof-of-impact scoring — 8 scenarios, 15 containers.

Beyond GitHub — selected work that stays private: Bikochu, a self-hosted internet asset & vulnerability-intelligence platform (host / service / port indexing, CVE correlation, passive DNS and network-flow queries, all exposed through a native MCP interface) · Bluetchi, Bluetooth exploitation research & tooling.

Every tool built, every system broken, every vulnerability documented — the full picture lives in the repositories.