Killian Casarotto

Helptoria operates in web hosting, online casinos, and trading CRMs. I industrialized the infrastructure, automated deployments, and designed robust and scalable network, system, and virtual architectures, with a strong R&D focus on security and automation. My scope covered three main areas: - Automation and industrialization - Security and Zero Trust - Observability and operations On the client side, the challenge was to stabilize heterogeneous platforms, shorten time-to-production, standardize environments, and ensure business continuity. Internally, I replaced non-compliant practices with tooled and traceable processes, centralized secrets, established strong identity management, and implemented encrypted backups with offsite replication. I deployed a full GitOps model. Infrastructure code, images, and charts were versioned. Promotion between environments was handled via merge requests. Kubernetes deployments were orchestrated with ArgoCD and Helm with minimal access policies and encrypted secret management. The CI/CD pipeline was built on GitHub Actions with build, test, security control, artifact publication, and progressive deployments with rollback capability. Platforms ran on vSphere on-prem and on Azure and OVHcloud depending on client needs, with reproducible templates and scalable capacity. Remote access followed a Zero Trust logic with PKI, MFA, segmentation, and application brokering. Outbound traffic was controlled via proxy. Hosts were hardened and continuously monitored. Technologies used: - Ansible Tower, Terraform - Docker, Kubernetes, GitOps, ArgoCD, Helm - GitHub Actions - VMware vSphere - Azure, OVHcloud - OpenZiti, PKI, MFA, Squid Proxy - WireGuard, OpenVPN, Pritunl - Windows Server, VDI, Ubuntu Server - Python, Golang, Powershell, Bash, API - MAAS, Dell PowerEdge - Semaphore UI

NEO Cyber Camp is a French EdTech specialized in cybersecurity (founded in 2024, <10 people), offering online training programs and an asynchronous practice platform. I joined the team to design and produce technical/pedagogical content while industrializing the lab infrastructure and the delivery pipeline. My scope covered two main areas: - Content & pedagogy (learning outcomes, module design, offensive/defensive labs, video recording/editing, evaluations) - Platform & industrialization (virtualized/containerized environments, IaC automation, format standardization, publication pipeline) The constraints of a certification program focused on employability led me toward a modular, measurable, and outcomes-based approach: fine-grained skill mapping, evaluation rubrics, alignment with reference frameworks (OWASP, MITRE ATT&CK, NIST/NICE), and rapid iterations based on learner feedback. Technologies used: - Scaleway - OpenStack - Microsoft Hyper-V, VMware vSphere, VMware Workstation, VirtualBox, Proxmox - Linux (CentOS, Debian, Red Hat Enterprise, openSUSE) & Windows 10/11 / Windows Server 2022 - PowerShell, Bash, Python - Docker, Kubernetes, Ansible, Terraform - Apache, Nginx - Centreon - Microsoft Office 365 (Teams/SharePoint/etc) - Git / GitHub - Firewalling Stormshield Network Security (SNS), PfSense, Cisco - OBS Studio, Elgato Camera Hub, Screen Studio - Studio lights, Sony camera EV

Teaching bachelor's and master's students about cloud computing, various infrastructures, and IT security. RNCP codes 37680 and 37173.

Teaching undergraduate students to obtain the TSSR diploma registered under code RNCP37682

Pegasy (assignment from August 2021 to September 2022) is a structure focused on offensive cybersecurity. I managed technical projects there during the 2021 crypto bullrun, a period when demand for EVM smart contract audits and web3 projects surged. My scope covered two main areas: - Training & support: design and delivery of sessions for professionals and organizations (IT security, networks, systems, offensive/defensive practices), hands-on labs, and educational materials. - Audits & offensive tools: audits of EVM smart contracts and web3 projects, code reviews and threat modeling; development and operation of modular offensive tools (implants, payload generators, orchestration scripts) and the setup of a hardened red team infrastructure (redirectors, communication profiles, OPSEC procedures), without delving into the fine-grained details of C2. OPSEC constraints, the need to bypass or assess defenses (EDR/NDR/SIEM), and aligning our tests with frameworks such as MITRE ATT&CK led us to a very rigorous approach: component separation, traffic shaping, adversary emulation, and rapid iterations based on defensive feedback. Technologies used: - Windows 10, Windows Server 2019, Kali Linux - Proxmox - Git, Gitea CI/CD, Jenkins - Python, Bash, PowerShell, C, x86 Assembly - Docker, Ansible, Terraform - Burp Suite, OWASP ZAP - Solidity, Hardhat, Truffle, Foundry, Slither, Mythril, Echidna - Elasticsearch / Logstash / Kibana (ELK), Wazuh - Volatility, Sysmon, MITRE ATT&CK (forensic & threat modeling) - Payload engineering & evasion: obfuscation, sleep encryption, anti-sandbox/anti-debug, polymorphism - Labs & training: resettable virtualized/containerized environments, hands-on scenarios for professionals and organizations - AWS (EC2, S3, IAM), DigitalOcean

Terrena is a French agri-food cooperative (≈€4.6B revenue, 14,000 employees, 2,000 servers, 400 sites) with its IT department based in Angers. I joined the Production & Infrastructure team as a level 2/3 systems and network administrator, working within a highly heterogeneous IT environment (Windows Server 2000–2016, RHEL, VMware ESXi 6.5/6.7, 9 legacy AD domains) and a significant technical debt. My scope covered two main areas: - Infrastructure industrialization (physical/virtual server deployments, automation, monitoring, documentation) - Security & observability (EDR replacement, NDR/PoC, SIEM/log management, forensic) Business requirements and the complexity of the environment naturally led me to a rigorous approach: automation (IaC), process standardization, tooled PoCs, and offensive testing to validate the effectiveness of security solutions. Technologies used: - Windows Server 2000–2016, Red Hat Enterprise Linux - VMware ESXi 6.5/6.7, vCenter/vSphere, Dell PowerEdge - Active Directory, Citrix XenApp - Centreon - Ansible, Terraform, Docker - PowerShell, Python, Bash - Wazuh, Elasticsearch / Logstash / Kibana, Graylog, Grafana - McAfee, Symantec, Kaspersky, CrowdStrike, Darktrace, Vectra, Panda, ESET, F-Secure - Ivanti Patch Manager - Aruba/HP (L3 switches), DMZ, SSL/PKI (OpenSSL, Nameshield) - FortiGate NGFW firewalling - Git, GitHub - Development of MsfMania (Python/C++) to generate FUD payloads and test EDR detection - Incident forensic (workstations/servers), log centralization, network audits and subnet mapping, security project management and cyber monitoring