Intrusion & Application Security Team Leader

Thales Cyber Solutions Luxembourg (Excellium Services) #

February 2018 – March 2025 (7 years 2 months)

My role as a team leader was to promote the Intrusion & Application Security services that we provided. I advised our clients to efficiently plan security assessments. They were guided through the different tests and audits that can be leveraged to increase the security posture for different scopes, from a single application to a whole company.

I was surrounded by a team of passionate and skilled consultants who were fully dedicated to the activities of our department. We developed together a vision that encompasses both realistic penetration testing (also known as “offensive”), red teaming and in-depth application security consultancy services.

Business development and involvement

I created our offering with a structured catalog of services that allowed us to prepare and deliver in a standardized manner. I ensured that the content and the services that we proposed were innovative, relevant and cost efficient. Based on this model, all the departments adopted a streamlined catalog at the company level.

In charge of the business development, team management, projects organization and quality control of the delivery, I was also involved in presales and close follow-up of opportunities.

Even if my work was mainly focused on team and project management, I regularly took part in the delivery. Indeed, I am a certified penetration tester owning the GIAC GPEN certification, earned during my consultant years at Excellium, after a year leading the Intrusion practice. Notably, I served as Red Team Leader on TIBER-EU engagements, leading threat-intelligence-based red team operations against the live production systems of financial institutions, in coordination with the white team and the regulator’s TIBER cyber team.

Innovation and tooling

My implication in the company extended beyond my team as I brought ideas and tools to increase the overall productivity. I created a tool to automate the creation of the offers. It gathers the information from different systems and combines them to create a ready-to-send proposal.

I also built a tool used by the teams to schedule the upcoming projects, calculate the teams’ occupancy and get a forecast of the revenues. It gives a clear view of the staff planned activities while being easy to use as it retrieves the information seamlessly from consultants’ Outlook calendars.

Security research

While at Excellium, together with Anthony Maia, I discovered and coordinated the disclosure of eight CVEs in Vaultize Enterprise File Sharing. They are detailed on my security advisories page.