Beyond offensive work I engineer security software and automation across platforms (iOS, Android, desktop, web and IoT/OT) in Python, JavaScript and PHP — with hardening, monitoring and detection aligned to CIS and NIST benchmarks.
I work in offensive security — penetration testing, red teaming, bug bounty and CTF — aligning my work to the standards the industry runs on: OWASP, MITRE ATT&CK, PTES and NIST. I build and operate real, production-grade security tooling used against live, real-world threats.
Beyond offensive work I engineer security software and automation across platforms (iOS, Android, desktop, web and IoT/OT) in Python, JavaScript and PHP — with hardening, monitoring and detection aligned to CIS and NIST benchmarks.
My core areas on the offensive side of security.
End-to-end security assessments of web apps, networks and systems, run to industry methodologies (OWASP Testing Guide, PTES) and delivered as clear, CVSS-rated findings with remediation guidance.
Adversary emulation of real threat-actor TTPs mapped to MITRE ATT&CK — chaining access across identity, endpoints and Active Directory to measure genuine business risk.
Finding and responsibly disclosing real, reproducible vulnerabilities — with professional, CVSS-scored reports that engineering teams can act on.
National-level Capture-the-Flag competitions across web, reverse engineering, crypto, forensics and OSINT — real problem-solving under pressure.
The standards, systems and tooling I work with day to day — from threat intelligence and OT/ICS security to Linux hardening, network defense and detection engineering.
Operating internet-facing deception sensors (Cowrie, Conpot) that collect live attacker TTPs and malware, enriched via VirusTotal and turned into actionable threat intelligence.
Securing operational-technology environments and protocols (OPC UA, MES, SCADA) aligned to IEC 62443 — the standards that protect critical infrastructure.
Hardening and operating production Linux (Debian) to CIS Benchmark standards — services, automation and least-privilege access.
Designing segmented, defense-in-depth networks — firewalls, VPNs (WireGuard) and zero-trust access on enterprise-grade routing (MikroTik / RouterOS).
Building monitoring and detection pipelines (Prometheus, Grafana, Loki, CrowdSec) with alerting mapped to MITRE ATT&CK.
Engineering secure applications and automation (Python, JavaScript, PHP) with a security-first development lifecycle.
What I actually did — every result links to its official source, fully verifiable.
One of the 10 live finalists of the national cybersecurity competition (Óbuda University, at the Bosch Budapest Innovation Campus). Over an eight-hour final I tackled real industry challenges: IoT and automotive network security, network traffic analysis, AI-assisted cybersecurity, web vulnerabilities and OSINT.
Strong national finishes across the full stack — software development (C++), DevOps, cloud (Azure) and mobile (iOS / Android):
My standout engineering project: a custom-built network scanner and traffic analyzer. It discovers every host and service across a network, analyzes the traffic and results, and presents them clearly — earning 3rd place in the IT Science section and a national OTDK nomination.
Completing practical cybersecurity rooms and learning paths on an international platform (see the badge below).
Self-developed applications across platforms, and real, production-grade projects running in the wild.
Native applications for iPhone and iPad.
Mobile apps for the Android ecosystem.
Desktop tools and programs — including my TDK network scanner & analyzer.
Hands-on IoT and hardware projects — microcontrollers, sensors and wireless security tooling (e.g. ESP32).
A production, internet-facing deception network (Cowrie, Conpot) capturing live attacks and malware in the wild — turned into actionable threat intelligence with automated alerting and VirusTotal enrichment.
A self-hosted, GDPR-compliant visitor management platform in real-world use: digital e-signatures, role-based admin, PDF records and automated data-retention.
An award-winning, custom-built tool that discovers hosts and services across a network and analyzes the traffic — recognized at a national scientific conference.
Enterprise-style Active Directory adversary emulation — real attack chains mapped to MITRE ATT&CK, built end to end together with the detections to catch them.
A live snapshot of my GitHub account — the source code of my projects lives here.
Got a project, a question or an opportunity? I'd love to hear from you.
Contact me