Salah Chafai

About

Aut viam inveniam aut faciam

Visitors

CTF Achievements

Experience

1. 

   Securinets

   September 2024 – Present · 2 roles
   1. Technical Lead July 2026 - Present
      • Lead, onboard, and mentor a 14-person technical team, owning direction for the competition platform: infrastructure architecture, deployment pipeline, and release standards.
      • Designed the year-round technical curriculum, defining the learning roadmap and teaching approach behind recurring workshops and seasonal bootcamps.
      • Co-led partnership outreach to national industry associations and government-backed cultural institutes, growing sponsorship and funding for events and competitions by over 50%.
   2. Technical Instructor September 2024 - June 2026
      • Sustained 100% platform uptime at events hosting 400+ participants by operating isolated, containerized challenge infrastructure with automated deploy and teardown.
      • Delivered hands-on secure-coding and binary-exploitation workshops to students from 10+ universities.
      • Authored exploitation and reverse-engineering challenges modeling real-world memory-safety and logic flaws.
2. 

   EY

   1. Security Engineering Intern June 2026 - August 2026
      • Designed and threat-modeled Bastion, a hardened bootable Linux platform delivering encrypted competition content while blocking AI-assisted cheating: hardened kernel (lockdown LSM, IOMMU, modules disabled), runtime policy via LSM hooks (execution allowlisting, egress whitelisting, ptrace scoping), and TPM 2.0 boot attestation; documented residual DMA, cold-boot, and hypervisor surface as accepted risk.
      • Built the encrypted delivery and key-release path end to end using AES-256-GCM with per-user HKDF-SHA256 derivation, HashiCorp Vault/HSM key storage, and mutual TLS 1.3 with certificate pinning and replay protection, so no key material ships in the image and a compromised session key cannot decrypt another user's content.
      • Penetration-tested an Android banking application and its backend, reporting three exploitable findings: missing admin-console MFA, an unthrottled submission endpoint enabling email-flood DoS and sender-reputation abuse, and a missing FLAG_SECURE flag leaking PII through screenshots and recents thumbnails.
3. 

   Cargo One Express

   1. Web Security Engineer October 2025 - December 2025
      • Delivered the company's internal recruitment platform end to end, adding OAuth 2.0 authentication and encrypted at-rest storage so applicant documents and PII were never persisted in cleartext.
      • Designed least-privilege role-based access control for applicant review, task allocation, and time-tracking dashboards.
      • Hardened the REST API with server-side authorization on every endpoint, closing cross-account access to applicant records.
4. 

   FL1TZ

   1. CTF Player September 2024 - Present
      • Consistently achieved top rankings in competitive CTFs at both national and international levels.
      • Qualified for prestigious competitions including Arab Security Cyber Wargames, Blackhat, Cybersecurity Tech Olymics & CSAW
      • Specialized in Pwn and Reverse Engineering categories across multiple CTF formats
5. 

   INSAT

   1. ICT Engineering Student 2023 - June 2028
      • Pursuing a National Engineering Diploma (Diplôme National d'Ingénieur): five-year integrated program, equivalent to a Master's degree
      • Relevant coursework: Ethical Hacking & Cybersecurity, Operating Systems & Virtualization, High-Speed Networks, Algorithms & Data Structures
      • Languages: Arabic (native), English (fluent), French (basic)
6. 

   Phantom Penguin

   1. Lead Game Developer November 2020 - 2022
      • Led a cross-functional team of 6 developers to deliver 5+ desktop and mobile game titles from concept to release.
      • Coordinated task allocation and conducted structured code reviews, increasing team productivity by ~40%
      • Stabilized release builds through systematic testing and pre-release triage, achieving 100% on-time deliveries