Nouaïm Souiki, Developer in Innsbruck, Austria
Nouaïm is available for hire
Hire Nouaïm

Nouaïm Souiki

Verified Expert  in Engineering

Cybersecurity Engineer and Developer

Location
Innsbruck, Austria
Toptal Member Since
December 13, 2022

Nouaïm is an advanced developer and cybersecurity engineer with five years of professional experience. He holds a bachelor's degree in mathematics and computer science and a master's degree in the latter. Nouaïm is also passionate about cryptography, reverse engineering, exploitation and mitigation, low-level programming, robotics, IoT, and all related security challenges.

SecurityKali LinuxCARMC++PythonCloud SecurityAmazon Web Services (AWS)CloudflareLinux KernelEmbedded HardwareSecurity TestingRobot Operating System (ROS)Embedded SystemsSecurity Architecture

Portfolio

Med-El
Burp Suite, Binwalk, Smali, APK, Android Studio, Frida, JADX, Ubertooth...
Technology Innovation Institute
ARM, GDB, Smali, APK, Scapy, Aircrack-ng, Ghidra, OneFuzz, AFL++...
Redline
Linux Kernel, eCos, C, Emacs, Vim Text Editor, Git, GDB, Embedded Hardware...

Experience

Emacs - 6 yearsKali Linux - 5 yearsGDB - 4 yearsC - 2 yearsSmali - 1 yearC++ - 1 yearAPK - 1 yearARM - 1 year

Availability

Part-time

Preferred Environment

Burp Suite, Assembler x86, ARM Assembler, C, C++, NMap, mitmproxy, Visual Studio, Python, AFL++

The most amazing...

...thing I've developed as part of a team is an automated tool to remotely take over drones by exploiting weaknesses in wireless communication protocols.

Work Experience

Product Security Engineer

2022 - PRESENT
Med-El
  • Handled firmware emulation of embedded devices using an EMUX virtual environment.
  • Conducted vulnerability assessment and penetration testing (VAPT) of an Android application.
  • Performed risk analysis, threat modeling, and software bill of materials and SDLC audits.
  • Wrote a secure coding document for the development team to implement.
  • Devised a secure firmware over-the-air strategy to safely update the firmware of remote medical devices.
Technologies: Burp Suite, Binwalk, Smali, APK, Android Studio, Frida, JADX, Ubertooth, Embedded Systems, Threat Modeling, Security Architecture, Software Development Lifecycle (SDLC), DevSecOps, Security, Vulnerability Identification, APIs, IT Security, Cybersecurity

Security Researcher

2021 - 2022
Technology Innovation Institute
  • Handled firmware emulation, reverse engineering, and exploitation.
  • Conducted wifi protocol vulnerability analysis and wireless communications interception.
  • Developed an automated vulnerability framework centered around 0-day vulnerability research through advanced fuzzing and automated patching.
Technologies: ARM, GDB, Smali, APK, Scapy, Aircrack-ng, Ghidra, OneFuzz, AFL++, Network Security, Security, Vulnerability Identification, IT Security, Cybersecurity

Embedded Software Engineer

2021 - 2021
Redline
  • Handled set-top-box embedded programming for eCos and Linux platforms.
  • Chased errors, defects, and bugs in the embedded software.
  • Contributed to improving the graphical user interface code.
Technologies: Linux Kernel, eCos, C, Emacs, Vim Text Editor, Git, GDB, Embedded Hardware, Embedded Linux, Embedded Systems

Embedded and Security Engineer

2019 - 2020
Wyplay
  • Handled the set-top-box embedded programming, kernel drivers, and HAL implementation.
  • Performed the security hardening of the underlying Linux firmware and middleware.
  • Reverse-engineered and took over closed-source, third-party libraries.
Technologies: C, Emacs, Vim Text Editor, Git, AutoTools, GDB, Secure Boot, Embedded Linux, Embedded Systems, Kernel, HAL, Middleware, Security, Vulnerability Identification, IT Security, Cybersecurity, Cryptography, Trusted Execution Environments (TEE)

Security, Networking, and Industrial Engineer

2018 - 2019
Pellenc ST
  • Performed a low-level calibration of the industrial panel PC capacitive touchscreen used on the machines by modifying the Kernel evdev generic driver and configuring the Ubuntu display manager.
  • Put together a networking module using the C++ Boost.Asio framework for low-level sockets and TCP segment handling, allowing intra-machine communications between waste material sensors' drivers and sorting engine.
  • Devised a secure credential storage strategy using hashing schemes, like the bcrypt key derivation function, and Unix security modules, such as AppArmor, Yama, and SELinux, eliminating hard-coded passwords and keys.
  • Presented the DevSecOps methodology to the management to create a security-sensitized environment.
  • Led the progressive upgrade of the Fieldbus networking technology from Modbus to the more secure OPC Unified Architecture standard, meant to secure the intra-components communication of the sorting machines.
Technologies: ISO 27001, Common Criteria, Security Testing, CERT, NMap, OPC UA, C, C++, Robot Operating System (ROS), Security, IT Security, Cybersecurity

Ethical Hacker and C/C++ Engineer

2018 - 2018
Self-employed
  • Conducted VAPT on a cryptocurrency exchange platform for a foreign company.
  • Assessed the security flaws exposed by the web application client, determining the attack surface and potential attack vectors based on OWASP testing guidelines.
  • Exposed SQL injection vulnerabilities and Cloudflare misconfiguration—which allowed bypassing the web application firewall set up by Cloudflare and attacking the origin server—and communicated mitigation steps to the client.
  • Sniffed and reverse-engineered a foreign cryptocurrency exchange Windows application.
  • Countered a man-in-the-middle (MITM) attack on the app's communication protocol using mitmproxy and a fake TLS certificate injection, allowing decryption and modification of the ongoing HTTPS flow between the app and the back-end exchange servers.
  • Maintained a GPS program developed in C++ for a foreign client, debugging the program using GDB to detect and patch the defects the code exposed.
Technologies: IntelliJ IDEA, Python, Kali Linux, OWASP Zed Attack Proxy (ZAP), Wireshark, APK, Smali, Microsoft Message Analyzer, NMap, Cloudflare, C, C++, Emacs, GDB, OWASP, Security, Vulnerability Identification, APIs, IT Security, Cybersecurity

Security and iOS Engineer

2017 - 2018
CAR360
  • Supervised the cybersecurity aspects of the company's components, from the back-end infrastructure and web services to the front-end framework and mobile applications.
  • Conducted the mobile application security's VAPT by reverse-engineering, debugging, and performing static and dynamic analyses.
  • Managed the AWS EC2 instance security and update, primarily through the TLS deployment and enhancement on back-end servers.
  • Helped develop the main application's augmented reality (AR) features on iOS 11 using Swift 4 and ARKit, including displaying a car walkaround path on the AR scene, beautifying the end-user experience.
Technologies: IntelliJ IDEA, iOS, Xcode, Swift, Jira, NGINX, Graylog, REST, OWASP Zed Attack Proxy (ZAP), Burp Suite, Wireshark, APK, Smali, Security, Vulnerability Identification, APIs, Cloud, Authentication, IT Security, Cybersecurity, Cloud Security, Amazon Web Services (AWS), Transport Layer Security (TLS)

C/C++ and .NET Engineer

2015 - 2016
Atos
  • Built a native driver in cutting-edge Modern C++ for the camera device of a Windows 10-based tablet, enabling the main app to access the camera's video flow without relying on the standard camera application or the tablet's local file system.
  • Developed the driver with pure native C++ technology leveraging OpenCV capabilities. The driver is used as a DLL by the .NET main application.
  • Implemented a bridge between the native and the managed code by wrapping the native code layer using Microsoft CLI/C++. This allowed producing the managed driver DLL, making it directly callable from the .NET layer.
  • Deployed the unitary tests using C#, WPF, and XAML.
  • Upgraded, optimized, and deployed a SOAP web service built on ASP.NET, which handles PDF document conversion and merging for the main application and is callable from the client.
  • Executed the related algorithms that fetch all the meaningful remote client-side data using other pre-built, in-house SOAP web services, respecting the given order and document hierarchy constraints.
  • Utilized the third-party tool: Aspose.Total for the entire PDF conversion and merging task. The tool is well-known for its advanced Office and image document processing and PDF/A format support.
  • Upgraded, optimized, and deployed a small Windows desktop app developed with C#.NET, enabling the client to insert a document into the remote server by locally exposing the feature as a right-click menu item.
Technologies: Microsoft SQL Server, SOAP, Aspose Components, OpenCV, XAML, Windows Presentation Foundation (WPF), C#, .NET, C++/CLI, Visual Studio

Trigger Warning Browser Extension for Netflix

http://github.com/programmersn/triggers-warning-browser-extension
A browser extension that intends to provide a thorough and complete process through which movie scenes can be automatically classified into sensitive categories. It currently leverages crowdsourcing and, in the future, artificial intelligence heuristics to achieve segment segregation. This browser extension embeds crowdsourcing capabilities to improve detection and takes advantage of the back-end REST API to provide movie scene detection warnings to the end user.

Languages

C, Python, JavaScript, HTML, C++, Assembler x86, Swift, C++/CLI, C#, XAML, Swift 4

Tools

GDB, Smali, IntelliJ IDEA, OWASP Zed Attack Proxy (ZAP), Wireshark, Emacs, Visual Studio, Android Studio, Vim Text Editor, Git, AutoTools, NMap, Xcode, Jira, NGINX, Graylog

Platforms

Kali Linux, iOS, Burp Suite, Embedded Linux, Kernel, Amazon Web Services (AWS), iOS 11

Industry Expertise

Cybersecurity, Network Security

Other

APK, Security, Vulnerability Identification, IT Security, ARM, Binwalk, APIs, Cloud, Authentication, Microsoft Message Analyzer, Cloudflare, OWASP, Frida, JADX, Ubertooth, Scapy, Aircrack-ng, Ghidra, OneFuzz, AFL++, Linux Kernel, eCos, Embedded Hardware, Secure Boot, ISO 27001, Common Criteria, Security Testing, CERT, OPC UA, Robot Operating System (ROS), Embedded Systems, HAL, Middleware, Threat Modeling, Security Architecture, Software Development Lifecycle (SDLC), Cloud Security, Cryptography, Trusted Execution Environments (TEE), Transport Layer Security (TLS), SOAP

Libraries/APIs

WebExtensions API, OpenCV, Aspose Components, REST APIs

Frameworks

Django, .NET, Windows Presentation Foundation (WPF)

Paradigms

REST, DevSecOps

Storage

Microsoft SQL Server

2015 - 2016

Master of Science Degree in Computer Science

Aix-Marseille University - Marseille, France

2010 - 2013

Bachelor of Science Degree in Mathematics and Computer Science

Aix-Marseille University - Marseille, France

Collaboration That Works

How to Work with Toptal

Toptal matches you directly with global industry experts from our network in hours—not weeks or months.

1

Share your needs

Discuss your requirements and refine your scope in a call with a Toptal domain expert.
2

Choose your talent

Get a short list of expertly matched talent within 24 hours to review, interview, and choose from.
3

Start your risk-free talent trial

Work with your chosen talent on a trial basis for up to two weeks. Pay only if you decide to hire them.

Top talent is in high demand.

Start hiring