I build and secure the platforms others depend on: airgapped Kubernetes clusters, zero-trust infrastructure, and dark-web threat-intelligence systems. Founder of DarkHuginn (acquired by WhoMeta), where I now serve as Chief Security Officer.
A selection across threat intelligence, platform engineering, offensive security, and detection engineering.
Built end-to-end: automated Tor crawling pipelines discovering onion services, markets, and leak sites; blockchain-intelligence workflows tracing illicit wallets; OSINT enrichment linking indicators to open sources. Scaled on message queues and distributed workers.
Designed WhoMeta's full foundation: Terraform IaC, AKS + self-hosted airgapped RKE2 HA clusters, private git and CI, registry with image signing and scanning, secrets management, SSO, and end-to-end GitOps, all open-source on a startup budget.
Authorized pentest of internal services for a European digital-asset trading and custody provider. Deep testing of authentication, access control (IDOR, privilege escalation), injection, and SSRF, with automated scanning verified manually so every finding carried demonstrable impact. Delivered CVSS-rated report and remediation retest.
Published research with rule packs and tooling: Kubernetes hardening mapped to 7 compliance frameworks, closing kernel-level detection gaps with eBPF/Tetragon, catching Shadow AI via network telemetry, and detecting rogue MCP servers with MITRE ATT&CK-mapped rules.
Leading security architecture, threat-intelligence infrastructure, and monitoring platforms supporting cybercrime investigations, from Terraform-provisioned airgapped Kubernetes to the full SOC stack.
Founded and built a dark-web threat-intelligence platform (crawling, blockchain analysis, OSINT enrichment), later acquired by WhoMeta and integrated into its investigation workflows.
Ran distributed systems across data centers and AWS: monitoring (Grafana, Icinga2, Kibana), Ansible automation, load balancing, disaster recovery, and Linux/AWS security hardening.
Windows Server, Cisco Meraki networking, Microsoft 365 Defender, Zabbix monitoring, and Veeam backup across on-prem and cloud.
Windows Server networks (Active Directory, DNS, DHCP), plus VLANs, trunking, and ACLs on Cisco ASA.
Windows and Linux server operations, disaster-recovery planning, vulnerability assessment and patching.
Small in-browser security utilities I built. Everything runs locally in your browser; nothing is uploaded anywhere.
SHA-256/384/512 digests computed locally with the Web Crypto API.
$ ./ioc-extractorPull URLs, domains, IPs, and hashes out of any text. Dedupe and defang.
$ ./image-inspectorView EXIF/XMP metadata and export a sanitized, metadata-free copy.
$ ./pdf-inspectorTriage suspicious PDFs: actions, JavaScript, embedded files, hidden content.
Open to security engineering, platform builds, penetration testing, and threat-intelligence engagements, remote or on-site. Fluent in English, French, and Arabic.