About me
Certified Penetration Tester (CPTS) and AI automation engineer with hands-on experience across the full security stack — detection, incident response, offensive testing, and AI-driven workflow automation. Known for building tools and systems that accelerate security operations: from SOAR-integrated triage pipelines to custom offensive tooling. Now moving into Technical Support at Intezer, an AI-first Autonomous Security Operations company — and setting my sights on cloud security engineering next.
I spent two years commanding soldiers in combat, where hesitation costs lives. Now I bring that same precision to the cyber battlefield — protecting 100+ enterprise clients, breaking into systems others believe are locked, and automating the infrastructure that connects defense to offense. Keep reading to see what that looks like in practice.
What I do
-
Offensive Security
I don't knock — I find the door you left unlocked. Web apps, networks, Active Directory: tested and exploited before the real attackers get there.
-
Defensive Security
I've triaged 50+ alerts a day from inside the SOC. QRadar, CrowdStrike, Cortex XDR, SentinelOne — I know exactly what attackers look like when they think no one is watching.
-
AI & Automation
Repetition is for machines. I automate the manual, wire up the intelligent, and ship security infrastructure that runs itself — n8n, Torq SOAR, custom Python, MCP.
-
Infrastructure
A network is only as strong as what attackers can't see. I build the invisible layers — zero-trust, segmented, monitored — so breaches stop before they start.
Certifications & Recognition
-
CPTS
Certified Penetration Testing Specialist. Full-scope penetration testing methodology — web, network, and Active Directory exploitation, reporting.
Hack The Box · July 2026 -
CRTA
Certified Red Team Analyst. Red team methodologies, MITRE ATT&CK TTPs, Active Directory attacks, and lateral movement in enterprise environments.
Cyberwarfare Labs · 2026 -
eJPT V2
Junior Penetration Tester by INE. Foundational penetration testing and vulnerability assessment.
INE Security · June 2025 -
ICCA
Certified Cloud Associate by INE. Practical cloud infrastructure security and deployment concepts.
INE Security · Aug 2025 -
Cloud Security Fundamentals
Core cloud architecture and security fundamentals — building toward cloud security engineering.
Palo Alto Networks · May 2026 -
Torq SOAR
Automation Expert & Practitioner. Security orchestration and automated response workflows.
Torq Academy · March 2026 -
Ethical Hacker
Network intrusion techniques, ethical hacking methodology, and vulnerability exploitation fundamentals.
Cisco · March 2026 -
Bug Bounty Masterclass
Advanced web vulnerability research, responsible disclosure, and bug bounty methodology.
WIZ · January 2026 -
Top 1% TryHackMe
Global ranking reaching Top 1% with 350+ rooms completed. All Cyber Paths certified.
TryHackMe · 2024–2026 -
Claude / AI Fluency
Claude 101 · Claude Code · MCP · Agent Skills · AI Fluency: Framework & Foundations.
Anthropic · 2026
Resume
Professional Experience
-
Technical Support Engineer
July 2026 – Present · IntezerServing as the communication bridge between customers and R&D at Intezer, the industry leader in Autonomous Security Operations. Resolve technical support cases via application and email, distinguishing user error from genuine system defects, and maintaining Python/JavaScript scripts against web services and APIs.
Python JavaScript APIs Customer Support -
Security Analyst — SOC Tier 2 / IR
April 2025 – July 2026 · Citadel Cyber SecurityTriage and resolve 50+ security alerts/day across multi-tenant environments. Investigate IoCs, malware campaigns, and lateral movement using EDR/XDR platforms; produce technical Root Cause Analysis reports. Built and refined Torq SOAR playbooks to reduce manual triage overhead. Operate across IBM QRadar, Splunk, Cortex XDR, SentinelOne, CrowdStrike, and CyberArk in parallel.
QRadar Splunk Cortex XDR SentinelOne CrowdStrike Torq CyberArk -
Curriculum Designer & Python Instructor
September 2024 – Present · CODiiPromoted from classroom instructor to curriculum design — currently building the company's annual cybersecurity training program from scratch. Designed full learning tracks covering Python automation and algorithmic thinking; serve as emergency instructor backup across all classes.
Python Curriculum Design -
Tier 2 Technical Support
January 2025 – April 2025 · Netspark LtdResolved complex L2/L3 network and software issues for enterprise clients across iOS, macOS, Android, and Windows. Diagnosed SSL, URL filtering, and IP-level issues — building a systematic troubleshooting methodology applied later in SOC work.
TCP/IP SSL/TLS Ticketing Systems
Military Service
-
Sergeant — Combat Operations (Nahal Brigade)
March 2021 – November 2023 · Israel Defense Forces (IDF)Led a team in high-pressure combat environments; developed rapid decision-making and crisis management under operational stress. Responsible for mission planning, team readiness, and real-time tactical decisions.
Leadership Crisis Management Tactical Operations
Education
-
KERNELIOS
July 2024 – November 2024 · Tel AvivCybersecurity & System Administration Bootcamp (450+ hrs). Network analysis, web app security (SQLi, XSS, CSRF), malware analysis, Active Directory hardening — 250+ practical lab scenarios.
Active Directory Windows Server Linux Azure AWS -
Ironi Dalet Municipal High School
2015 – 2020 · Tel AvivHigh School Diploma (Baccalauréat Général).
-
Continuous Learning
2023 – Present · Self-directedHackTheBox CPTS Path · PortSwigger Academy · TryHackMe. Self-directed offensive security curriculum — 350+ rooms completed, Top 1% global ranking on TryHackMe. CPTS certification achieved July 2026.
HackTheBox PortSwigger TryHackMe
Security Research & Hobbies
Personal Security Lab
Proxmox / RPi 5 & RPi 500+- Multi-node hybrid lab (x86 + ARM) running Proxmox + Docker for continuous attack/defense simulation
- SIEM & detection: Wazuh for centralized log analysis, intrusion detection, and real-time alerting
- Zero-Trust network: Tailscale + Cloudflare Tunnels + OPNsense firewall with full VLAN segmentation
- Security research environment: Kali ARM, Windows Server 2025, GrapheneOS — CTF prep & vulnerability research
Vulnerability Research & Offensive Tooling
Independent / Intigriti (Bug Bounty)- Research web application vulnerabilities (XSS, SQLi, IDOR, SSTI, auth flaws, file upload bypass) as a learning discipline
- Built custom offensive tooling: blind XSS payload generator with context break-out engine and file upload bypass toolkit
- CPTS certified (Hack The Box, July 2026); continued practice on PortSwigger Academy for offensive skill development
- CTF competitor — 350+ rooms completed, Top 1% global on TryHackMe
Flowly — AI Automation Side Project
Independent · flowly.krf-studio.com- Designed and deployed 10+ automation pipelines integrating LLM APIs, n8n, and custom Python tooling for security and operational use cases
- Architected end-to-end systems that replace manual workflows with autonomous, AI-driven processes — from data ingestion to output delivery
Technical Skills
Blog
-
Loading posts…