Axel Roudaut

Cybersecurity DevSecOps Engineer

Design, automation and operation of the internal DevOps & Cloud platforms behind the entity's cybersecurity product lines: an on-premise private cloud hosting security products, attack-simulation environments and data processing services for cyberdefense teams. Agile Scrum on two-week sprints, GitLab workflow with code review and CI validation.

• Orchestration & Platform Engineering Industrialized Kubernetes cluster deployment at customer sites down to a single JSON meta-file (domain name, node count, certificates, application URLs) and one command: node VM provisioning with Terraform on on-premise VMware or OpenStack, prerequisite checks (SSH, DNS, hostnames, certificates), cluster bootstrap with Kubespray, and installation of our product Helm charts templated from that same file. Orchestrated in Ansible and run from GitLab CI with non-regression tests, so the install reproduces identically from one customer site to the next.
  KubernetesKubesprayTerraformOpenStackHelmAnsibleGitLab CI

• Build Orchestration & Virtualization Prototyped Kubernetes orchestration of native C/Rust builds on Windows and Linux without cross-compilation, driven by Temporal and targeting RKE2 in production. Selected the local runtime after benchmarking minikube, kind, k3s and k3d on performance, air-gapped reproducibility and maturity — kind won on CI integration. Windows pods run on Linux-only nodes through KubeVirt, preferred over dockur/windows for performance despite a heavier setup: direct /dev/kvm access and kernel module control to rule out emulation, with a golden qcow2 image built by Packer and QEMU and VirtIO drivers injected via an unattended install file.
  kindKubeVirtRKE2TemporalKVM/QEMUPackerRustCGitLab CI

• Infrastructure as Code Built and maintained Linux/Windows attack-simulation environments on an on-premise VMware platform: image factory industrialized with Packer, VM provisioning and system configuration through Ansible roles and PowerShell scripts. Manual image preparation gave way to a versioned chain, making environments disposable and rebuildable identically.
  VMWare APIPackerAnsibleTerraformPowerShell

• Malware Analysis Platform Operated a self-hosted multi-antivirus file scanning platform (VirusTotal-like): scanning engines isolated in virtual machines on VMware ESXi, file submission and verdict retrieval through a REST API, analysis services written in Python and Go then deployed by Ansible. Analysts can qualify a sensitive file without handing it to an external service.
  PythonGolangAnsibleVMWare ESXiREST API

• DevOps Automation Automated the CI/CD pipelines driving the production chain: dependency packaging, container image builds, security scanning and artifact promotion to target environments, with steps tooled in Python, Go, Bash and PowerShell to cover Linux and Windows components alike. Removing the manual delivery steps cut delivery time.
  GitLab CIDockerPythonGolangBashPowerShell

• Observability & Reliability Designed and implemented infrastructure monitoring and observability: system and application metrics collected by Prometheus, per-service dashboards and alerting in Grafana, containerized stack deployed by Ansible. Tracked service availability, node CPU/memory usage and pipeline duration and failure rate, surfacing capacity saturation before it reached users.
  PrometheusGrafanaSNMPDockerAnsible
• Binary Forensics Tooling Developed a forensic statistics tool for binaries: mounts the filesystem of a Windows or Linux disk, extracts every binary it holds to a MinIO server, computes indicators over the stored executables in PostgreSQL, and exposes exploration and reporting in Jupyter notebooks. Gives analysts a reproducible characterization of a binary over a growing sample volume.
  PythonJupyter NotebookMinIOPostgreSQL

• Secrets Management Centralized secrets management for the deployment playbooks: encryption with ansible-vault and injection at run time through GitLab CI protected variables, so that no credential is ever stored in clear text in the repositories.
  Ansible VaultGitLab CI

Cyberdefense DevSecOps & Data Engineer

Design and rollout of a security monitoring chain (SIEM) and its data processing pipelines for the ministry's cyberdefense needs: incident detection on sensitive information systems from the collection and correlation of heterogeneous network, system and Windows logs. Agile on two-week sprints tracked in Jira.

• Security Monitoring Architected and deployed a Security Information and Event Management (SIEM) system across a distributed environment: network probes and system agents feed a message bus, events are normalized then indexed for the analysts. Sized and deployed the collection, processing and storage components for 4 TB of logs per day. Built out detection with SIGMA-format rules over Windows (Sysmon, Windows Security), system (Auditd, OSSEC) and network (Suricata) collection.
  SuricataAuditdOSSECWindows SecuritySysmonSIGMA

• Big Data Processing Stack Developed and put into production real-time data processing pipelines for streaming workloads: Kafka ingestion, continuous transformation and enrichment with KsqlDB and Apache Spark, Elasticsearch indexing and HDFS archiving. Tuned throughput and latency to shorten the delay between an event occurring and its availability to analysts, with buffering to absorb network or hardware failures.
  ElasticsearchKafkaKsqlDBApache SparkHDFS
• Infrastructure Automation & Reliability Automated infrastructure provisioning and configuration across distributed environments with Ansible and Docker, versioned in GitLab, and monitored the processing chains with Prometheus and Grafana to catch collection losses and pipeline breaks.
  DockerAnsibleGitLabPrometheusGrafana
• Collaboration & Documentation Gathered detection requirements from the SOC analysts and translated them into rules and dashboards, continuously improving detection coverage; wrote the architecture documentation and the operating procedures.
  SOCSIGMAAgileJira

Internship — Hardware Cybersecurity Auditing

Security evaluation laboratory for embedded components and smart cards, running applied research on hardware attacks to assess how well embedded systems resist physical attacks. V-model development cycle.

• Embedded Security Conducted electronic side-channel attacks on embedded systems as part of penetration tests: trace acquisition on an oscilloscope, then signal processing and statistical analysis of the measurements in Python.
  PythonOscilloscopeElectronics
• Low-Level System Exploitation Performed fault injection attacks on the Android kernel via clock signal manipulation, demonstrating that the fault was exploitable from software, and reported the findings as technical evaluation reports.
  CLKSCREW attackBashAndroid

Internship — Cloud Integration Engineer

Platform for deploying high-performance computing (HPC) applications on public clouds, letting compute-intensive workloads run on the main market offerings. Agile.

• Cloud Platform Engineering Implemented a Python connector enabling cloud integration for HPC applications: compute resource provisioning, job submission and result retrieval on AWS, Azure and GCP. Integrated the connector into the automated build and test chain under Jenkins, with development tracked in Jira.
  PythonCI/CDJenkinsAWSAzureGCPJira

Additional Master M2 — Information System and Network Security

Information systems security programme co-accredited by three Toulouse engineering schools — INP-ENSEEIHT, INSA Toulouse and ENAC — backed by the LAAS-CNRS, IRIT and ENAC research labs and by industry partners including Airbus, Thales, CNES, Quarkslab, Cert-IST and ANSSI. Around 400 hours of coursework across nine units, heavy on hands-on lab work, closing on a six-month internship and defense. Builds from low-level foundations (operating systems, IP networks, C and x86 assembly, cryptography) up through software security (vulnerabilities, memory protections, viral techniques, secure development), system and hardware security with reverse engineering, attacks and countermeasures across the OSI layers and wireless networks, secured network architecture design on Cisco ASA firewalls — with the option to prepare the Cisco CCNA Security certification — critical and aeronautical embedded systems, and security governance.

Engineer Degree — Telecommunications and Networks

Three-year engineering degree at Toulouse INP-ENSEEIHT leading to the N7 Computer Science & Telecommunications diploma, formerly named "Telecommunications and Networks". A common first year covers imperative and object-oriented programming, computer architecture and operating systems, formal modelling, applied mathematics and statistics, signal processing and digital communications, and IP and local-area networks; the second year then branches into one of six tracks — telecom systems, networks, system and network architecture, software systems, image and multimedia, HPC and big data — with coursework on concurrent and communicating systems, software and systems engineering, network science, mobile systems, formal methods and machine learning. Second semester of year two was spent on an Erasmus exchange at DCU Dublin, and the final year was replaced by the TLS-SEC specialisation, whose networking core matches the N7 curriculum while adding the cybersecurity hours on top.

Erasmus Exchange — Big Data and Cybersecurity

CPGE — Physics and Engineer Sciences