Offensive Security + Red Team Lead + AI & LLM Security
both sides of the wire
Thirteen years breaking into banks, oil & gas operators, carriers and ministries — and then building the SIEM, the detections and the Zero Trust perimeter those attacks get measured against. Now red-teaming production LLM and agent deployments, where the prompt is the new perimeter.
helpThree layers of work — the attack path, the AI attack surface, and the detections that catch both. Each one backed by delivered engagements and production infrastructure.
A representative kill chain from a regulated-environment engagement, anonymised. Click each hop: the red side is what the operator did, the blue side is the telemetry and rule that would have caught it. Every engagement ends with these detections handed to the client's SOC.
Adversarial testing of live LLM and agentic systems — direct and indirect prompt injection through retrieval corpora, tool- and function-calling abuse, guardrail bypass chains, system-prompt and training-data leakage, unbounded consumption. Findings mapped to the OWASP LLM Top 10 and MITRE ATLAS so security and ML teams share one vocabulary.
$ airt run --target prod-assistant --suite owasp-llm-2025 --atlas
[LLM01] prompt-injection.direct ............ 12 cases 3 FAIL
[LLM01] prompt-injection.indirect.rag ...... 18 cases 5 FAIL
[LLM02] sensitive-info.pii-egress .......... 6 cases 1 FAIL
[LLM06] excessive-agency.tool-abuse ........ 9 cases 2 FAIL
[LLM07] system-prompt-leakage .............. 4 cases 0 FAIL
[LLM10] unbounded-consumption .............. 5 cases 1 FAIL
mapped ATLAS AML.T0051 · AML.T0054 · AML.T0057 · AML.T0048
report findings.pdf — 12 findings · 4 critical · PoC per finding · retest planStood up a SOC from nothing — SIEM over 500+ endpoints, ATT&CK-mapped Sigma content, triage workflow and IR runbooks — and replaced the legacy VPN with identity-aware Zero Trust access. The rule below is the blue half of hop 02 in the attack path above.
title: Kerberoasting — RC4 TGS requests from user accounts
status: production
logsource:
product: windows
service: security
detection:
selection:
EventID: 4769
TicketEncryptionType: '0x17' # RC4-HMAC
Status: '0x0'
filter:
ServiceName|endswith: '$' # machine accounts
ServiceName: 'krbtgt'
condition: selection and not filter
level: high
tags: [attack.credential_access, attack.t1558.003]Client names stay out of it — that is the job. The sectors, the techniques and the regulatory frames are exactly what was delivered.
Multi-week adversary simulation across the corporate estate and the IT/OT boundary. Phishing foothold escalated through Active Directory to domain compromise; demonstrated reachability of engineering workstations and supervisory segments across a flat Purdue-model boundary.
External perimeter and assumed-breach operations. Chained Kerberoasting, ADCS certificate-template abuse (ESC1/ESC8) and delegation misconfigurations into privileged access; assessed segmentation around payment-processing scope. CVSS/CWE reporting, executive risk narrative, remediation workshops and full retest evidence.
Recurring external and internal penetration tests, web and API assessments, and social-engineering campaigns; on-call incident response and threat-hunting support during active intrusions.
Adversarial testing of live LLM and agentic systems: direct and indirect prompt injection through RAG corpora, tool-calling abuse, guardrail bypass chains, system-prompt and training-data leakage, unbounded-consumption abuse — mapped to the OWASP LLM Top 10 and MITRE ATLAS.
Three roles run in parallel — a US research platform, a security consultancy I lead technically, and a startup I co-founded. Expand any commit.
Security tooling shipped end to end — design, build, hardening, hosting. All three are live right now; click through.
Security & compliance scanner
Passive, non-intrusive assessment of any domain or IP across six scan modules — DNS/port/geo recon, TLS chain validity, security headers, software versions with CVE exposure, plus GDPR and PCI DSS control checks. PDF/HTML reports. Safe against third-party estates, so it doubles as vendor due-diligence.
Data protection law 18-07 & 25-11
Trilingual FR / EN / AR with full RTL guided self-assessment for Algeria's data-protection regime — the regional counterpart to GDPR. Eight-stage audit from DPO governance and ANPDP notification to cross-border transfer legality. Privacy by design: every answer stays in browser local storage.
Visual Docker Compose builder · open source
Drag services onto a canvas, draw dependencies, export production-ready YAML with healthchecks, named volumes, network isolation and resource limits. 50+ preconfigured services, live validation, YAML import. Bring-your-own-key AI generation runs entirely client-side — keys never leave the browser, zero backend, zero telemetry.
Open-source where possible, internal where it has to be. Star counts are pulled live from GitHub.
View all repositories ↗What could a low-privileged attacker harvest from this host right now? Read-only /proc introspection with 30+ rules for credentials leaked in process environments and command lines — DB, cloud, JWT keys, OAuth, Stripe/Slack/GitHub tokens — needless root, and 0.0.0.0 binds. Severity-scored, JSON for CI, single static binary.
Self-hosted status page and incident platform that closes the detection-to-resolution loop: a processor engine evaluates alert rules every 30s, auto-opens incidents on breach, deduplicates, auto-resolves on recovery. Agent telemetry, SSE, Discord/Slack/email/webhook dispatch.
Cross-platform desktop client for Proxmox VE — multi-cluster nodes, VMs, LXC, storage, backups, live task streams. Security-first: credentials encrypted at rest via OS keychain and never exposed to the renderer, scoped API tokens, context isolation on, per-server TLS verification.
Security operations pipeline where LLMs correlate SIEM alerts, enrich with threat intelligence, map activity to MITRE ATT&CK and draft incident-response playbooks — cutting L1 triage load on repetitive alerts, running inside a working SOC.
Agentless asset and attack-surface discovery across Linux (SSH), Windows (WinRM), Active Directory (LDAP), VMware, Proxmox and AWS/Azure/GCP — surfaces shadow IT, abandoned and unpatched hosts, and risk-scores each asset.
Flipper Zero application (C, FAP SDK) mirroring live AI-agent session events over USB serial, with D-pad approval of privileged tool calls — out-of-band, human-in-the-loop control for autonomous agents.
The CTF circuit is where this career started. Left: the record. Right: a five-question clearance check for recruiters — pass it and unlock a flag (and a shortcut to my calendar).
Some are handed to you, some you must submit. Hints: read the source, open the console, ask the robots, finish the clearance check, and remember the 1986 cheat code.
My work sits at the boundary between the attacker and the defender: Active Directory and identity, cloud control planes, the LLM prompt surface, SIEM telemetry, Zero Trust perimeters — and the leadership work of running the team that owns all of it. Based in Algiers, fluent in French and English, available for on-site, hybrid or fully remote roles in Europe, the Gulf and North America.
PGP / Signal on request · security.txt