Antoine DUGOGNE

– Creation of an internal CTF platform and staff awareness training using a Golang API. – DevSecOps tooling and Security code review (Golang, NodeJS, terraform): Gitleak, Trivy, Semgrep, Cyberwatch, Gemnasium, renovate. – During benchmark tooling: Sysdig, Cyberwarch, Qualys, Nessus, Rapid7 – Following and conduct Pentest/Audit : PASSI, SNC, HDS, ISO27XXX

– Pentest and Redteam in tourist environments: hotels, train stations, restaurants, shops and businesses (Wifi, IP camera, access badge, reception workstation, etc.) – Securing and hardening audited environments with OWASP, SANS, CWE, ANSSI, NSA, NIST reference guide – Administration, securing et hardening booking.com, tripadvisor, maps.me and website – DevOps tools: AWS, Azure, terraform, github, git, gitlab, CI/CD, puppet, ansible, gitlab, VMWARE environments – Google Cloud certifications: Google Cloud Essentials, Using DevSecOps in your Google Cloud Environment, AWS certifications

– Implementation of SAST/DAST tools in the CI/CD pipeline (Bandit, Qualys WAS, NodeJsScan, ESLint-security, trufflehog, checkmarx, Fortify...) and contribution to the Bandit tool (SAST Python) – Hands-on security awareness for DEVOPS and all employees in the business unit (Conferences, Hands-on, Cheatsheet and secure implementation documentation, etc.) – Coordination with the SOC for the detection of security incidents – Management and conduct of pentests via external entities and execution of counter-audits with my pentester experience – Head of the pentest SG India team

– Pentests in agile life cycle with developers for new features – Management and conduct of pentests Generali – Complete participation in the pentest process with: Pre-sales definition of needs and scope, Pentest, Restitution and participation in remediation with managers and developers. – Techniques OSINT et perfectionnement des techniques d'attaques sur Web/Mobile. – OSINT techniques and Web/Mobile attack techniques. – Responsable of pentest process with: Pre-sales definition of needs and scope, Pentest, Restitution and participation in remediation with managers and developers.

– Environnements: API, Cloud (AWS), CMS, SOAP, REST, JSON et Framework – Web Attacks: XSS, SQLI, XXE, XPATH, LDAP et NoSQL injection, CSRF, CORS and Captcha – Vulnerability Detection (Nessus, NMAP, Nikto, OpenVAS, SSLscan, testssl.sh, Wpscan et Metasploit) – Dynamic/Static analysis of Generali's application with (APK studio, Mobsf, Super-analyzer, apk-tool, Android SDK et DDMS) – Tools: BurpSuite Pro (Proxy, Intruder, Repeater, Scanner et plugins), SQLmap, SOAPui Pro and OSINT

– Scripting Shell, PHP, Python, SQL (Oracle, mysql) et Perl – Security audit with Security guide compliance (NIST, ANSSI and NSA) – Hardening Linux: iptables advanced, Chroot, Tripwire, Ossec, Auditd Selinux/Grsecurity/Apparmor