Graduating 2027 · open to conversations
Segmentation, identity, hardening: I design the security of critical systems at Alstom, one layer at a time.
Defense in depth
Every layer assumes the one before it has given way. Scroll: we open them one at a time.
01 Firewall the perimeter
Anything not explicitly allowed is denied, inbound and outbound.
02 Segmentation zones and flows
Sealed zones and listed flows: a compromise stays where it started.
03 Identity MFA, least privilege
Every access is authenticated and cut down to what it needs. It guards the one open passage.
04 Encryption at rest, in transit
Intercepted or copied data stays unreadable.
05 Data the core
What we protect. Reached only at the end of a path checked at every layer.
Defense in depth
Hostile traffic stops at the perimeter. Whatever tries the one open passage runs into the identity check.
The security layer of critical railway signalling systems, from network segmentation to delivery. Five projects in parallel, in France and abroad.
Cybersecurity engineering apprentice — Systems, networks & automation · September 2024 — September 2027
≈450
cyber validation tests run and tracked through to correction
50VMs
provisioned from a single JSON file
5
projects in parallel, in France and abroad
Designed and built on my own. Now the standard across projects.
A Python and PyQt application that remotely brings Windows and Linux systems into compliance over WinRM and SSH before delivery. No secrets in clear text on disk, a report at the end.
Segmentation (VLANs, port openings, firewall filtering), traffic flow analysis, isolation of the administration network, Active Directory, certificates, endpoint protection.
A method to derive cyber test cases directly from architecture requirements, on a nationwide railway project.
Account and password audit scripts, a study of centralised secrets management, hardening of end-of-life systems.
VMware vSphere automated with PowerCLI, Docker, Kubernetes, Harvester, and a GUI driving a hyperconvergence platform's API.
Before Société Générale, 2023 · Internship — cybersecurity standards documentation. Reworked cyber standards and guides, updated cross-references, fixed inconsistencies.
2022 — 2027
Engineering degree, Networks and security
Work-study programme, SecNumedu-certified by ANSSI, France's national cybersecurity agency.
Noisy-le-Grand
Sept — Dec 2026
Graduate diploma (DESS) in cybersecurity, dual degree
An advanced specialisation semester, alongside the engineering curriculum.
Gatineau, Canada
Earned · October 2026
CompTIA · SY0-701
Risk, secure architecture, incident response, governance.
Earned · December 2025
Cisco Networking Academy
Enterprise Networking, Security & Automation course: advanced routing, WAN, network security.
Targeted · 2027
Microsoft
Taking the identity and security work I do on-premise today into the cloud.
B1
German · Intermediate
819
Projet Voltaire · Professional French writing
Verify — Projet Voltaire · Professional French writing
Homelab
Three machines run day and night, segmented and documented like production. Scroll to open them up.
A hypervisor for the lab, a NAS for data and services, a controller for the house. Running around the clock, documented like production.
UDP 51820, reserved for administration over WireGuard. Everything else is published through a Cloudflare tunnel initiated from the inside, behind Authentik single sign-on.
Proxmox VE
A virtualized OPNsense isolates the lab on 10.1.1.0/24. Windows, Active Directory and CTF VMs only get outbound NAT. Samples under analysis get no network interface at all.
TrueNAS SCALE
Mirrored ZFS pools, regular snapshots and 2 TB encrypted client-side before leaving for off-site storage. The 3-2-1 rule, applied at home.
Zones, traffic flows, deliberate choices and known limitations. The repositories document every machine.
Core & administration
LAN 192.168.1.0/24
Traffic rule : No management interface is ever published. The hypervisor, the NAS, the firewall and SSH access are reachable from the VPN only.
Published services
Docker · outbound tunnel
Traffic rule : The only published zone, and only through a tunnel initiated from the inside: no inbound port. Every service in its own container, behind a single reverse proxy and centralised authentication.
Lab
10.1.1.0/24 · OPNsense
Traffic rule : Behind the virtualized firewall, with outbound NAT as its only way out. The lab initiates no traffic towards the home LAN and is reachable neither from outside nor from the services.
IoT & home automation
Zigbee · local processing
Traffic rule : The sensors speak Zigbee, not IP: they reach their controller and nothing else. Video and automations are processed on site, nothing leaves for a third-party cloud.
Hypervisor: LXC service containers, virtualized firewall, disposable test environments.
Redundant storage and hosting for day-to-day containerized services.
Alarm, automations and video surveillance, processed entirely locally.
Publishing services?
Outbound tunnel, except WireGuard.
No port to expose. WireGuard stays direct: it's the fallback path if the tunnel goes down.
The firewall?
Virtualized.
Flexible and reversible through snapshots, with no room for a box. The price: a single point of failure.
Administration?
VPN only.
An exposed management interface turns an authentication flaw into full compromise.
A VLAN for IoT?
Not yet.
Zigbee sensors are off the IP network, connected devices aren't: that's the next step.
An architecture presented without its blind spots isn't an architecture, it's a brochure. Here's what this one doesn't cover.
Designing, instrumenting and running an incident response exercise: another team takes the SOC analyst shift at a small maple syrup producer and must detect, assess and contain an incident unfolding in real time, without shutting production down.
UQO · Team project in a lab
2 h
SOC shift in real time, at most
5
log sources centralised in Splunk
6 wk
sugaring season, when any shutdown costs the most
Zones, allowed flows, an isolated administration network. On critical systems as well as at home.
Active Directory, PKI, account audits, SSO and MFA. Least privilege, verified.
Pentesting, incident response, DFIR, threat intelligence, IT/OT environments.
Python, PowerShell, PowerCLI: whatever repeats becomes a tool.
Risk analysis and compliance, to decide where security truly matters.
Five years supporting a dyslexic person with note-taking and writing.
One game, one team, one weekend. A good school for shipping under constraint.
Industrial cybersecurity, local AI, OSINT, cryptography. And watchmaking, which fascinates me: understanding what holds a mechanism together.
Graduating in September 2027, open to conversations now.
Gatineau (Québec) until December 2026, Paris region after that
