0xmrerror@terminal:~$man 0xmrerror/cv download PDF ↓

CV

Available for a 6-month internship from February 2027

Skandar Hadrich — cv

ICT Engineering student at ENIT specialising in cybersecurity and systems software, ranked in the top 1% on TryHackMe globally. Hands-on expertise in malware analysis, reverse engineering (Ghidra, GDB, Frida, JADX), LLM fine-tuning, penetration testing and security automation. Architected an end-to-end 9-stage nested-VM malware analysis pipeline as a sole-contributor research intern at Keystone Group. Active CTF competitor — the ENIT team placed 77th globally at HTB University CTF 2025.

areas of expertise

Ghidra · Debugging (GDB + WinDbg) · Binary Instrumentation (Frida) · Android (JADX + Android Studio) · Graph neural networks (GCN/GAT) · LLM fine-tuning · Reinforcement learning algorithms (Monte Carlo) · PyTorch · TensorFlow · scikit-learn · OpenCV · Wazuh SIEM · Splunk · ELK

education

ENIT — National School of Engineers of TunisICT Engineering — Telecommunications & Cybersecurity2024 – PresentCybersecurity specialization: malware analysis, network security, cryptography, secure systems design.
IPEIS — Preparatory Institute for Engineering Studies of SfaxPre-Engineering — Mathematics & Physics2022 – 2024National entrance rank 440 / 1800 — top 24%.

professional experience

Keystone GroupJul 2026 – Sep 2026 · Tunis, TN
Security Engineering Intern — Malware Analysis
  • Architected an end-to-end 9-stage automated malware analysis pipeline in five phases: static triage with a .NET/native fork, live KVM/QEMU detonation with concurrent eBPF, VMI and network telemetry, then IOC extraction, threat-intel pivoting, weighted scoring, MinHash/LSH clustering and MITRE ATT&CK mapping into an automated PDF report.
  • Correlated host-side eBPF KVM tracepoints with Volatility3 VMI on a live guest, and patched KUSER_SHARED_DATA.TickCount in guest memory to defeat anti-sandbox timing checks. Validated against live AsyncRAT, AgentTesla and njRAT samples.
  • Deployed a multi-layer C2 sinkhole (iptables + DNSChef + INetSim) to capture malware traffic and extract actionable IOCs with false-positive filtering against Windows telemetry.
  • Automated threat attribution by matching IOCs against VirusTotal, AlienVault OTX and MalwareBazaar, grouping behavioural families with MinHash LSH clustering and generating PDF reports automatically.
Tunisie TelecomJun 2025 – Jul 2025 · Sfax, TN
Network Operations Intern
  • Triaged 15+ daily technical support tickets and provisioned network modems at scale, cutting average per-unit configuration time by 20% through scripted workflows.
  • Maintained network uptime across multiple customer sites.

projects

Nested-VM Malware Analysis Pipeline · Python, QEMU-KVM, eBPF, Volatility3

An end-to-end 9-stage automated malware analysis pipeline in five phases. QEMU/KVM live detonation with host-side eBPF syscall tracing correlated against Volatility3 VMI, anti-sandbox evasion via KUSER_SHARED_DATA patching in guest memory, multi-layer C2 sinkholing with DNSChef + INetSim + iptables, and automated MITRE ATT&CK attribution with MinHash LSH clustering. Validated against live AsyncRAT, AgentTesla and njRAT samples.

CFG Function Localization via Graph Neural Networks · Python, PyTorch Geometric, Ghidra, angr

Stripped ELF/PE binaries disassembled with headless Ghidra and angr, then mapped into directed control-flow graphs whose node features are x86/ARM opcode distributions and API call references. GCNs and GATs (PyTorch Geometric) are trained for node-level classification of malicious functions — anti-debug loops, keyloggers and process-injection routines.

RL-Based Intrusion Detection & Response · Python, Gymnasium, PyTorch, CSE-CIC-IDS2018

Network defense formulated as an MDP with six response actions (DPI, throttle, honeypot, block, isolate, quarantine) inside a custom Gymnasium environment. A Double DQN agent with prioritized experience replay is trained on CSE-CIC-IDS2018 telemetry to choose response actions instead of only raising alerts.

Open-Source SOC Automation · Wazuh, Shuffle SOAR, MITRE ATT&CK, Python

A Wazuh SIEM + Shuffle SOAR lab deployed automatically with Ansible and Docker. A Python suppression microservice filters 33,022 noisy events down to a single actionable incident — over 95% noise reduction — with a human-in-the-loop VirusTotal enrichment pipeline and custom detection rules validated against simulated brute force, lateral movement and privilege escalation.

certifications

  • Certified Cybersecurity Educator Professional (CCEP) — Red Team Leaders (Oct 2026)
  • Efficient Large Language Model Customization — NVIDIA (Jan 2025)
  • Jr Penetration Tester — TryHackMe (Mar 2026)
  • SOC Level 1 — TryHackMe (Sep 2026)
  • DevSecOps — TryHackMe (Jun 2026)
  • Security Engineer — TryHackMe (Jun 2026)
  • Web Fundamentals — TryHackMe (Mar 2026)
  • Cat The Flag V2 — SECURINETS ENIT (2026)
  • CCNA: Introduction to Networks — Cisco Networking Academy (Jun 2025)
  • Machine Learning — 365 Data Science (Nov 2024)

ctf, clubs & languages

CTF — HTB University CTF 2025 — ENIT team ranked 77th globally · TryHackMe — top 1% worldwide ranking
Clubs — SECURINETS ENIT — cybersecurity club · G2FOSS — open-source software group
Languages — Arabic — native · English — C1 · French — B2 · German — A2

Download PDF Back to 0xmrerror