I used to work in the Information Security Engineering team (an application security team). My role was to design, develop and maintain systems that prevent entire classes of security bugs from being written in the first place, by influencing all the phases in the product lifetime. We were involved in all the steps: initial design reviews, tooling recommendations, static analysis, code reviews, consulting, even lending a hand in analysing bug bounty reports.More specifically, I focused on client-side XSS prevention: through a combination of processes that involve early static analysis, developing libraries such as the Closure goog.html types, and security engineer consultations on-demand, we managed to strongly curb DOM-based XSSes in our TypeScript stacks. I worked closely with the Angular web framework, and with TSLint, but also spent some time applying those principles to other classes of bugs and generally reducing our impact on developer experience.I also participated in other efforts from the broader team: my background in cryptography and networking let me take on security reviews revolving around those concerns, I wrote two challenges for the Google CTF, I hosted interns, helped interview candidates, ...

Thesis title : Protocols and models for the security of wireless ad-hoc networksAdvisor : Pascal LafourcadeThe goal of my PhD is to build and analyze secure protocols for wireless ad-hoc networks. Because of the eventual material constraints (energy, computing power, memory) and environmental hazards of these networks, the protocols must guarantee continued operation in presence of faults or deliberate attacks. With this in mind, we developed several models and protocols:- A model for the verification of k-neighborhoods.- A secure and resilient many-to-one routing protocol for wireless sensor networks based on a reputation mechanism, whose security we formally proved. Experimental evaluations showed both its resiliency and fairness.- A new model to formally find flaws in network-based intrusion detection systems based on their inputs.- A way to formalize the security of routing protocols (work currently in progress).