Objective

I am a security researcher and low-level software engineer with a focus on fuzzing, binary exploitation, reverse engineering, and systems software development. I am currently pursuing a master’s degree in Computer Science and Engineering at the Technical University of Denmark (DTU).

I am interested in roles and collaborations around vulnerability research, exploit development, program analysis, and low-level systems programming.

I have 5+ years of hands-on experience in software engineering and cybersecurity. During this time, I have worked on research, software development, reverse engineering, fuzzing, and exploit development across a variety of projects and domains. This has given me a solid understanding of industry best practices and the end-to-end software development lifecycle.

I work primarily with C, C++, Python, Rust, and Java. My main technical interests include:

  1. Low-level development (drivers, compilers, operating systems, memory management, emulators, symbolic execution engines, etc.), primarily in C++.
  2. High-performance computing.
  3. Reverse engineering.
  4. Vulnerability research (fuzzing, static analysis, audits).
  5. Exploit development.
  6. Machine learning.

I’m also interested in academic research in the fields stated above.

Although my main focus is cybersecurity, I have extensive experience in product development and have contributed to projects ranging from small utilities to large-scale systems.

In my spare time, I enjoy photography, playing CTFs, reading, mountain biking, and exploring new technologies.

For a full version of my CV or to get in touch, see the Links below.

Skills (Security researcher)

  • Vulnerability research & exploit development. End-to-end vulnerability research and exploit weaponization across mobile, embedded, and desktop platforms (Android, Linux, Windows), including full-chain and boot-chain attacks on modern SoCs (x86/x64, RISCV, ARM). Focus on memory corruption, logic flaws, sandbox escapes, and trusted computing components.
  • Reverse engineering & firmware analysis. In-depth reverse engineering of complex, largely undocumented systems: bootloaders, TrustZone/TEE components, native apps, and proprietary firmware, with a strong emphasis on cryptography, secure storage, and attack-surface mapping.
  • Static analysis & fuzzing at scale. Design and operation of large-scale fuzzing campaigns (AFL++, LibAFL, libFuzzer, AFLNet, custom harnesses). Built QEMU- and Qiling-based fuzzers for userland, kernel, firmware, and TEE targets. Static analysis using CodeQL, LLVM-based tooling and various other frameworks to support exploit development.
  • Program analysis, symbolic execution & SMT. Practical experience integrating symbolic execution into research and exploit pipelines (Triton, TritonDSE, angr, SymCC, KLEE) and working with SAT/SMT solvers (Z3, Bitwuzla).
  • Dynamic instrumentation & tracing. Extensive use of dynamic instrumentation frameworks (Frida, DynamoRIO, QEMU/Qiling) for dynamic analysis, fuzzing, and exploit development. Comfortable building custom tools and plugins to extend these frameworks.
  • Reverse-engineering tooling & automation. Daily driver experience with IDA Pro, Binary Ninja, Ghidra, JEB, BinDiff, Tenet, Lighthouse, and various debuggers (WinDbg, GDB/pwndbg). Comfortable building plugins and automation for these tools to streamline triage, variant analysis, and exploit development.
  • OS & low-level internals. Deep understanding of Linux, Android, and Windows internals: memory management, scheduling, IPC, exception/interrupt handling, system call interfaces, privilege separation, and security hardening mechanisms.
  • Compiler-assisted security analysis. Experience using LLVM for custom instrumentation, passes, and checkers to synthesize fuzz targets, add security-relevant instrumentation, and improve coverage for complex code bases used in fuzzing and static analysis workflows.

Skills (Software engineer)

  • Systems & performance-critical development. Design and implementation of high-performance, low-level components in C and C++ (and, where appropriate, Rust) for fuzzing infrastructure, emulation frameworks, exploit tooling, and data-extraction pipelines. Comfortable working close to the hardware and within tight performance and reliability constraints.
  • Modern C++ in large codebases. Extensive experience with modern C++ (C++17/20), STL, Boost, RAII, templates, and concurrency primitives. Strong background in maintaining and evolving large, production codebases and integrating with legacy components.
  • Compiler, build, and tooling ecosystem. Hands-on experience with LLVM (passes, plugins, custom instrumentation), CMake-based build systems, and the broader tooling stack (sanitizers, coverage, profilers, disassemblers) needed to support large-scale fuzzing and debugging.
  • Python for orchestration, tooling, and services. Python as a primary language for tooling, automation, orchestration of fuzzing campaigns, reverse-engineering scripts, and backend services. Experience with web frameworks (Flask/Django), gRPC-based services, and PostgreSQL-backed systems.
  • Software engineering practices. Full lifecycle development with strong focus on code quality: Git-based workflows, code review, unit and integration testing, fuzz testing, static analysis, performance profiling, and containerization with Docker. Comfortable operating in CI/CD-driven environments.
  • Algorithms, data structures & reliability. Solid foundation in algorithms and data structures applied to real-world problems such as large-scale analysis, tracing, and data extraction.
  • Applied ML / CV for tooling. Practical experience using machine learning and computer vision in support of security and tooling (data preprocessing, model training, and deployment) where automation or signal extraction from complex data is beneficial.

Projects

  • SASCTF 2025 - Qualifier challenges: Trust Issues (TA exploitation) and Broken Trust (OPTEE exploitation). Finals: Gatekeeper (collaboration with one of my team-mates) - Symbolic Verification using Triton + custom QEMU RISCV board.
  • SASCTF 2024 - Developed binary exploitation challenges: Ubercaged, PHP-Phar unsafe deserialization, and stocks++ (finals).
  • Added experimental LAF/Compcov support for the WTF snapshot fuzzer: pull-request (C++).
  • Flare-On 9 - Finalist - writeups
  • Frida-based fuzzer for Firefox IPC
  • Advanced C++ memory allocator with GC and heuristic layouting for improved CPU cache locality: memplusplus
  • Paseca CTF (2019) - Developed re/pwn challenges: angry, blind road, hidden malware, beehive, honeyback, dynamic, no_out.

Findings/Contributions

🐘 Postgres (Postgres Pro)

  1. #16953: OOB access while converting “interval” to char

🦎 Firefox (Independent)

  1. Firefox IPC bug (dup)

🔥 Rizin (ISP RAS)

Show Rizin CVEs
  1. CVE-2022-36042
  2. CVE-2022-36044
  3. CVE-2022-36039
  4. CVE-2022-36040
  5. CVE-2022-36041
  6. CVE-2022-36043

🦕 PyTorch contributor (ISP RAS)

Show PyTorch PRs
  1. Pull request #94298
  2. Pull request #94295
  3. Pull request #91401
  4. Pull request #94300
  5. Pull request #94297

🚀 Passware

  1. Upload mode dumper
  2. Tenet - ARM32 support

Working Experience

  • Mobile Security Researcher, Passware (07.2023 - present).
    • Mobile security researcher building full-chain smartphone exploits and QEMU-based fuzzing/emulation tooling.
  • Developer-researcher, ISP RAS (Sydr team) (11.2021 - 03.2023).
    • Developer-researcher working on LLVM-based fuzzing (Futag) and Triton-based symbolic execution (Sydr) tooling and uncovering bugs/CVEs in projects like PyTorch and Rizin.
  • Postgres Pro. Junior developer (information security department) (09.2020 - 11.2021).
    • Security engineer improving SSDLC and fuzzing for PostgreSQL components.
  • Kaspersky Lab. TAR intern (01.2020 - 11.2021).
    • Malware analyst reverse-engineering targeted threats (incl. bootkits/rootkits), developing decryptors/test malware, and mapping attacker behavior to MITRE ATT&CK.

Education

  • Technical University of Denmark (DTU) - M.Sc. “Computer Science and Engineering” (2023 - present).
  • Higher School of Economics (HSE) - B.Sc. “Information Security”. Bachelor’s degree (2019 - 2023).
    • GPA: 8.84 (with Honours).
  1. LinkedIn: LinkedIn
  2. GitHub: GitHub
  3. Telegram: Telegram
  4. Twitter: Twitter