montreal, qc — cybersecurity analyst @ collège ahuntsic

Cybersecurity analyst and software engineer.

view experience ↓ get in touch github ↗
▼

// 01 — whoami

analyst by day,
engineer always.

I'm a Cybersecurity Analyst and Software Engineer securing enterprise and institutional IT environments across the Microsoft ecosystem — threat detection & incident response, identity and access management, security automation, and data-protection compliance. Perfectly bilingual (English / French). I've been taking software apart to see how it breaks since my teens — now I get paid to make sure it doesn't.

  • edu B.Eng. Software Engineering — Security & Mobility, Polytechnique Montréal (2019–2024)
  • certs CompTIA Security+ · Microsoft SC-200
  • langs English (native) · Français (natif) · 中文 (advanced)
  • base Montreal, QC 🍁

// 02 — experience

where I've defended.

07/2025 — present

Cybersecurity Analyst @ Collège Ahuntsic

  • Lead cybersecurity initiatives strengthening the institution's security posture and data-protection compliance.
  • Deployed Microsoft Defender & Sentinel for threat detection and incident response; log ingestion with ManageEngine Log360.
  • Remediated vulnerabilities surfaced by penetration tests and security audits.
  • Built PowerShell + Microsoft Graph API automation replacing static admin consents with a dynamic, user-driven cloud-app authorization workflow.
  • Designed and implemented a comprehensive IT recovery plan; running monthly compliance and technology-watch meetings.
SentinelDefenderKQLGraph APIPowerShellLog360

06/2025 — 07/2025

IT Support Specialist @ InterRent

  • Automated Windows laptop setup and enrollment with Intune (Settings Catalog).
  • Enforced secure access with Conditional Access policies and privileged-role management via Entra ID + PIM.
  • Monitored endpoints with CrowdStrike Falcon; rolled out YubiKey SSO across the Microsoft ecosystem.
  • Managed mobile fleet via Jamf, Exchange mailboxes, and full user lifecycle.
IntuneEntra IDPIMCrowdStrikeJamfYubiKey

09/2022 — 09/2023

Web Developer & LAN Technician @ Otakuthon

  • Engineered and maintained a centralized staff portal automating staff-management workflows.
  • Ran provisioning and lifecycle for the LAN section's Windows workstation fleet.
  • Hardened the network with pfSense firewall rules, routing policies and monitoring.
WebpfSenseWindowsNetworking

01/2022 — 05/2022

Cybersecurity & Automation @ Hydro-Québec

  • Developed RegEx rules detecting unauthorized configuration-file modifications, hardening critical infrastructure against attacks.
  • Created and managed Ansible playbooks automating server deployment.
RegExAnsibleLinux

// 03 — threat hunting

hunt. detect. respond.

sentinel — advanced hunting

Representative KQL hunting queries: risky sign-ins, encoded PowerShell commands, and brute-force detection.

representative hunts — the real ones live in Sentinel & Defender. 🛡

// 04 — the origin story

🌟hdf.services

licensing & distribution platform for CS:GO script modules · 2020 → 2021 · built & operated solo · retired, fully archived

↑ faithful replica of the original landing page — its tab-title typewriter lives on in your real browser tab. look up. 🌟

Before the blue team, I designed, built and ran hdf.services — a full-stack licensing and distribution platform for CS:GO script modules. Auth server, code-protection pipeline, Discord bot, admin panel: one teenager, one Ubuntu box, hundreds of users. Everything I know about how attackers think started here.

  • HWID-locked auth API — PHP endpoints binding every user to their hardware ID, serving role-gated scripts (User / Beta / Staff) with per-request logging.
  • Code-protection pipeline — every release automatically obfuscated through the Luraph and MoonSec APIs before delivery.
  • Discord bot — discord.py key generation & redemption, account linking and role sync.
  • Admin panel + ban system — live log viewer, IP bans, remote HWID resets and kill-switch.
  • Modular delivery — feature modules shipped as role-gated Lua, versioned and served per user.
PHPLuaPythonMySQLdiscord.pyApacheUbuntu

☠️ retired 2021, preserved as a complete server archive. defending against detection systems taught me more about them than any course — that's why I defend for a living now.

327 registered users
226,220 script deliveries
1,288 HWID auth checks
530 user uploads
49 invite codes

// 05 — shipped

recently shipped.

wendewealth.com ↗

client work · live

The web presence of Wende Wealth Management — an independent financial-advisory practice in Montreal serving families, newcomers and international students across Canada. Fully static, framework-free, and served in four languages (English, French, Simplified & Traditional Chinese) by a hand-rolled per-page i18n system.

  • Privacy done properly — an opt-in consent banner gates every optional cookie and analytics itself. Quebec Law 25 / GDPR-grade by default.
  • Hardened static deploy — strict CSP, HSTS, nosniff and frame-deny on every page.
  • Zero-backend forms — pre-filled mailto out of the box, a one-line Formspree upgrade, honeypot anti-spam.
  • Out of PCI scope by design — insurance purchases hand off to the insurers; the site never touches payment data.
HTMLCSSJavaScripti18n ×4GA4 (consent-gated)CSP

And then there's the .ng collection — sister domain hacks to scripti.ng itself, each parked not behind a boring "for sale" page but behind a self-contained art piece: no frameworks, no third-party requests, audio synthesized in-browser, media generated procedurally, strict CSP, and obfuscated, domain-locked builds. The domains are for sale. This one isn't. 😌

poki.ng ↗

"poking"

A kawaii anime portal. Click to enter and a looping video takes over — its audio track is the music — under canvas sakura petals, a star field, a cursor sparkle trail and an inline-SVG chibi mascot that blinks, sways and waves. Kept H.264/AAC so Safari gets the full show too.

CanvasWeb Audioinline SVGH.264

🏷 domain for sale — serious offers only

ghosti.ng ↗

"ghosting"

The art of disappearing: a dictionary entry for "ghosting", the last conversation (unanswered since 3:47 AM), and a field report of abandonment metrics — 0 replies since 2019. The fog is an ffmpeg-generated loop, every sound is synthesized live in WebAudio, and opening devtools pierces the veil.

WebAudioffmpegdefault-src 'none'

🏷 domain for sale — serious offers only

patchi.ng ↗

"patching"

LIVE PATCH STREAM // ZERO-DAY RESPONSE. A fake terminal patches CVEs on an endless loop under procedural patch-rain, scored by fully synthesized music & SFX. It practices what it preaches: strict CSP, zero third-party requests, and a devtools tripwire that flashes TAMPER DETECTED.

CanvasWeb Audiostrict CSP

🏷 domain for sale — serious offers only

nuki.ng ↗

"nuking"

FACILITY 7G — REACTOR ONLINE. A doomsday control room: T-minus countdown, geiger-counter clicks, falling fallout, and a 16-second toxic-plasma loop generated from scratch with numpy + ffmpeg. Its on-screen coordinates (9.0820°N, 8.6753°E) point at Nigeria — home of the .ng TLD.

numpyffmpegWeb Audiodomain-locked

🏷 domain for sale — serious offers only

// 06 — toolkit

the toolkit.

🛡 Security & SIEM

DefenderSentinelKQLPurviewMITRE ATT&CKCrowdStrike FalconLog360IDS / Firewalls

🔑 Identity & Access

Entra IDPIMConditional AccessIntuneJamfYubiKey / SSO

☁️ Cloud & DevOps

AWS (Boto3)DockerKubernetesTerraformAnsible

⌨️ Programming

PythonC / C++JavaPowerShellKotlinLuaSQL

🌐 Web & Automation

AngularNode.jsPHPFlaskREST / SOAPSeleniumFirebase

🕸 Networking

LAN / WANCisco routerspfSense
🎖

CompTIA Security+

certified

🎖

Microsoft SC-200

Security Operations Analyst

🎓

B.Eng. Software Engineering

Polytechnique Montréal · Security & Mobility · 2019–2024

// 07 — connect

let's connect.

Hiring for security or engineering — or want to talk detection engineering? My DMs are open.

linkedin ↗ github ↗