Résumé

Cybersecurity trainer & consultant — permanent contract

LessonSharing

Technical engagements, audits, training and strategic advisory for public and private organisations.

• Penetration tests and architecture reviews for large accounts and public institutions.
• Design and delivery of cybersecurity modules in engineering schools (offensive, defensive, Cloud).
• Support on compliance and hardening of Cloud and IAM environments.

Cybersecurity consultant — independent activity maintained in parallel

Own company

Own company maintained alongside permanent employment: the engagements listed below were contracted and delivered independently.

• Direct ownership of client engagements: scoping, quoting, delivery, debrief.
• Penetration tests and architecture reviews for large accounts and public institutions.
• Support on compliance and hardening of Cloud and IAM environments.

Application pentest & API security

Hexafret

Penetration-testing campaign on business applications and exposed APIs, followed by a prioritised remediation plan built with the development teams.

• Grey-box penetration testing of the business web applications.
• API audit: authentication, authorisation, data exposure (OWASP API Top 10).
• Hunt for business-logic flaws and access-control bypasses (IDOR, BOLA).
• Dependency and build-chain review (SCA, hard-coded secrets).
• Automated replay of attack scenarios in CI (security regression testing).
• Remediation plan prioritised by severity, with developer coaching.

Cyber upskilling — industrial teams

TotalEnergies

International training programme on OT / IT convergence and industrial-systems security.

• Industrial-systems security (SCADA, ICS).
• Network segmentation into zones and conduits (ISA/IEC 62443).
• Cyber-incident handling in OT environments.
• Industrial-protocol vulnerabilities (Modbus, OPC).
• Awareness training on targeted attacks (Stuxnet-like scenarios).

Advanced cryptography & PKI

Boursobank

Applied cryptography and PKI training, then roll-out of an internal certificate authority and automated certificate renewal.

• How a complete PKI works (Root CA / Intermediate CA).
• TLS handshake in detail: PFS, ECDHE, cipher suites.
• Certificate life-cycle management: rotation, CRL, OCSP.
• Set-up of an internal certificate authority.
• Automated renewal (ACME-style, scripts).
• TLS error analysis and configuration hardening (Mozilla guidelines).

Cloud security training

Orange Cyberdefense

AWS / Azure Cloud security training and support of the teams through a hardened migration.

• Hardening of AWS and Azure environments.
• IAM and principle of least privilege.
• Monitoring (CloudWatch, Microsoft Sentinel).
• Logging and detection (SIEM, XDR).
• Cloud-migration support: risk analysis (ENISA, CSA CCM).
• Infrastructure hardening: network segmentation, Security Groups, NSGs.
• Roll-out of DevSecOps best practices.

API security — audit & architecture

Softway Medical

REST API security audit, then implementation of the controls and target Zero Trust architecture.

• REST API security audit: identification of OWASP API Top 10 vulnerabilities.
• Strong authentication: OAuth2, JWT hardening.
• Rate limiting and denial-of-service protection.
• Strict input validation (schema validation).
• Dynamic testing with Burp, Postman and automated scripts.
• Secure-architecture recommendations (Zero Trust API).

Ethical Hacking & Pentest training

French Ministry of Armed Forces

Full offensive-security training: methodology, exploitation, post-exploitation and pivoting, backed by realistic Red Team / Blue Team labs.

• Penetration-testing methodology (OWASP, PTES).
• Vulnerability exploitation: SQLi, RCE, LFI/RFI, SSRF.
• Post-exploitation: privilege escalation on Linux and Windows.
• Network pivoting (proxychains, chisel, ligolo).
• Set-up of realistic Red Team / Blue Team labs.
• Awareness training on adversary techniques (MITRE ATT&CK).

Cybersecurity trainer

Engineering schools (IPSSI, GEMA…)

Design of complete cybersecurity curricula and supervision of student projects, from offensive security to secure Cloud.

• Complete curricula: web, mobile and infrastructure pentesting.
• Forensics: memory analysis (Volatility, Autopsy).
• Reverse engineering: binaries, Android apps, IoT firmware (Ghidra, jadx).
• Applied cryptography: PKI, TLS, certificate management.
• Student-project supervision: IAM (Keycloak, LDAP), secure Cloud (AWS, Azure), DevSecOps pipelines.
• Hands-on Docker / Kubernetes lab sessions.

Master's ESI — Cybersecurity & Cloud

IPSSI

Top of class

BSc Psychology

Aix-Marseille Université

Useful background: human factor, social engineering, pedagogy.