Cybersecurity Engineer specializing in SecOps, Penetration Testing & DevSecOps.
Building defenses. Breaking assumptions.
I'm a Cybersecurity Engineer based in Morocco, currently working as a SecOps Engineer at Tessi, where I monitor and investigate security alerts across Network, SaaS, Email, and Endpoint vectors using SIEM, NDR, EDR, WAF, and IPS/IDS solutions.
I hold a State Engineer Diploma in Computer Security & Cybersecurity from ENSA Oujda (2019–2024). My background spans offensive security (web pentesting, bug bounty), defensive security (SOC, incident response), and cloud security (DevSecOps, Kubernetes, AWS/Azure).
I'm passionate about the intersection of automation and security — from building secure CI/CD pipelines to developing custom Python tooling for SOC operations and threat intelligence.
Web App Pentesting, VAPT, Bug Bounty, CTF competitions
SIEM operations, Incident Response, Threat Hunting, CVE management
AWS, Azure, Kubernetes security, CI/CD pipelines, IaC scanning
Linux, Windows & Android forensics, memory analysis
5-year engineering program covering networks, system administration, cryptography, mobile security, ethical hacking, penetration testing, cloud computing, big data, machine learning, and security audits.
End-to-end DevSecOps pipeline for a 3-tier application on Amazon EKS. CI/CD with Jenkins + ArgoCD + Terraform IaC. Security embedded at every stage: GitLeaks pre-commit hooks, SAST tools, OWASP DependencyCheck (SCA), OWASP ZAP (DAST), Trivy for containers/Kubernetes/IaC, SonarQube for code quality, Vault for secrets, Prometheus & Grafana for monitoring, and EFK for centralized logging.
Real-time global threat map tracking RDP brute-force attacks using Azure Sentinel SIEM. A custom PowerShell script extracts event metadata from Windows Event Viewer and enriches it via geolocation API. Azure Log Analytics ingests custom logs; a Sentinel workbook visualizes global attacks by location and intensity.
Suite of Bash scripts automating repetitive pentesting and bug bounty tasks: recon, WAF detection & bypass, technology fingerprinting (WordPress, GraphQL), fuzzing, spidering, secrets scanning, and comprehensive vulnerability testing (LFI, SQLi, XSS).
In-depth source code analysis of PHP and Node.js applications to identify critical vulnerabilities — input validation flaws, authentication weaknesses, error handling issues, and business logic bugs. Proposed concrete remediations including secure coding practices, input validation, and regular audits.
Web Fundamentals · Pre-Security · Jr. Pentester · Pentest+ · Cyber Defense
Top 1%Offensive Web Security Track
Blue Team Operations Track
CloudGuru · Microsoft Azure Security
CloudGuru · Amazon Web Services
University CTF · Competitive Hacking
I'm open to new opportunities, collaborations, or just a good conversation about cybersecurity. Whether you have a project in mind or want to discuss the latest in threat intelligence — feel free to reach out.