Available for Internship & Fresher Opportunities

I build reliable software and reason about how systems fail.

Final-year Information Security student at University of Economics Ho Chi Minh City (UEH) with GPA 3.21/4.00. Core contributor with 340+ commits on a live NestJS/PostgreSQL production publishing backend, alongside offensive AD persistence labs and quantitative ISO 27005 risk automation.

View Selected Work Get in Touch
3.21 / 4.00
UEH Academic GPA in Information Security
340+ Commits
Production Backend Codebase (NestJS/PostgreSQL)
ISO 27005
Quantitative Risk Scoring Engine & Annex A Mapping
15 Members
Co-Led Internal IT & Engineering Department
Evidence-Locked Engineering

Featured Technical Projects

Real-world systems, quantitative security tooling, and controlled offensive labs. Every claim is supported by repository commits or academic evaluation.

PRODUCTION SYSTEM Live System · 340+ Commits

nedu-backend: Multi-Platform Publishing & Distributed Synchronization

Core backend microservice orchestrating multi-tenant social media publishing and real-time inbox synchronization via Zernio OAuth REST APIs.

MY DIRECT CONTRIBUTION:

Core contributor responsible for the resilient publish pipeline and OAuth token management. Implemented single-flight mutex token refresh to prevent concurrency race conditions, generation fencing for background workers, and authored 30+ Jest test suites.

  • Single-Flight Token Refresh: Clustered single-promise deduplication preventing duplicate refresh requests when multiple worker threads encounter expired OAuth tokens.
  • Idempotency & Generation Fencing: State-machine atomic row updates ensuring network retries never trigger duplicate posts to third-party social endpoints.
  • Self-Healing Reconcile Cron: Background sweeper detecting stuck or desynced scheduled posts and re-enqueuing with exponential backoff.
NestJS 11 Fastify TypeScript Drizzle ORM PostgreSQL Docker Jest
View Case Study
SECURITY TOOL / GRC UEH Academic Project · Python 3

ISMS Risk Engine: ISO/IEC 27001 & 27005 Quantitative Risk Automation

Modular Python platform automating asset-based risk quantification, technical vulnerability normalization, and ISO 27001 Annex A administrative control mapping.

MY DIRECT CONTRIBUTION:

Designed the entire Python codebase: implemented the ISO 27005 mathematical scoring engine, automated port/HTTP header discovery, knowledge base matching, and HTML/CSV executive compliance report generation.

  • ISO 27005 Mathematical Scoring: Calculates Inherent Risk (Asset × Likelihood × Severity) and Residual Risk (Inherent × [1 - Control Effectiveness]).
  • Automated Annex A Control Mapping: Direct mapping from technical flaws (e.g. missing CSP, exposed ports) to ISO 27001 Annex A controls (e.g. A.14.1.2, A.9.2).
  • Auditable Risk Register: Generates formatted executive reports with asset criticality ratings, vulnerability details, and designated treatment owners.
Python 3 ISO 27001 ISO 27005 Socket Scanner JSON KB HTML Reporting
OFFENSIVE SECURITY LAB Controlled Lab Environment · MITRE ATT&CK

Active Directory Post-Exploitation & Lateral Movement Lab

Segregated enterprise domain lab (Windows Server 2016 DC, Win10 Workstation, Kali Linux) analyzing adversary persistence, credential extraction, and Kerberos abuse.

MY DIRECT CONTRIBUTION:

Designed the isolated NAT network topology, developed a custom Python reverse-shell backdoor with Registry Run-key persistence, executed NTDS.dit password hash dumping via Impacket DRSUAPI, and simulated Pass-the-Hash and Golden Ticket attacks.

  • Registry Run Persistence (T1547.001): Developed a stealth Python payload packaged with PyInstaller establishing persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
  • NTDS.dit Hash Dumping (T1003.003): Used Impacket secretsdump.py over DRSUAPI to extract all domain hashes without halting Active Directory domain services.
  • Pass-the-Hash & Kerberos Ticket Forging (T1550.002): Lateral movement via NetExec SMB and Mimikatz Golden Ticket generation with KRBTGT hash.
Python Impacket Mimikatz NetExec Active Directory Kali Linux
View Case Study
AUTOMATION & PROTOCOL Production Tooling & IoT Lab

Enterprise n8n Automation Workflows & MQTT-Guard IoT Defense

Production workflow automations with chunked byte-range resumable YouTube uploads, coupled with rule-based IoT protocol defense on Mosquitto MQTT.

MY DIRECT CONTRIBUTION:

Implemented JavaScript 100MB byte-range chunking algorithms for large media uploads to YouTube API with HTTP 308 resume handling, orchestrated Telegram bot error-routing, and modeled STRIDE threats for IoT MQTT brokers.

  • Resumable Video Streaming: 100MB chunked byte upload pipeline handling HTTP 308 (Resume Incomplete) without crashing server memory during large multi-gigabyte transfers.
  • Error Routing & Notifications: Automated Telegram Bot alerting and fallback queues for failed automation batches.
  • MQTT-Guard Protocol Defense: Rule-based traffic inspection detecting Flood-DoS and unauthorized topic subscriptions with dynamic Mosquitto ACL locking.
n8n JavaScript YouTube Resumable API Telegram API Mosquitto MQTT Docker
View Case Study
Live Interactive Simulation

ISO/IEC 27005 Quantitative Risk Engine

Direct web replication of the mathematical scoring logic implemented in ISMS_Risk_Engine/ai_risk_engine/scorer.py. Adjust the parameters below to observe real-time risk quantification.

4 / 5
4 / 5
5 / 5
65% (0.65)
Inherent Risk Score
Asset × Likelihood × Severity (Max 125)
80.0
Mitigation Factor
(1 - Control Effectiveness)
0.35
Residual Risk Score
Inherent × Mitigation Factor
28.0
Moderate Risk — Treatment plan required (Annex A Control review)
Practical Competence

Technical Expertise

Grouped by real-world applications and engineering domains. No arbitrary progress bars or inflated ratings.

Backend & Distributed

  • TypeScript / JavaScript
  • NestJS & Fastify
  • Node.js REST APIs
  • PostgreSQL & Drizzle ORM
  • OAuth 2.0 & Webhooks
  • Idempotency & Race Handling
  • Jest Unit / Integration Tests

Security & GRC

  • ISO/IEC 27001 & 27005
  • STRIDE Threat Modeling
  • MITRE ATT&CK Mapping
  • Active Directory Testing
  • Impacket & Mimikatz
  • Network & IoT (MQTT/DICOM)
  • Vulnerability Normalization

Automation & Tools

  • n8n Workflow Automation
  • Docker & Docker Compose
  • Git / GitHub PR Workflows
  • YouTube & Telegram APIs
  • Wireshark & Kali Linux
  • Google Sheets API
  • Linux Server Administration

Core Fundamentals

  • Python 3 Development
  • Computer Networking & TCP/IP
  • Cryptography Principles
  • Malware Analysis Basics
  • Incident Response Flow
  • Technical Documentation
  • Data Structures & SQL
Work & Leadership

Organizational Experience

Demonstrated capability in technical leadership, cross-functional coordination, and workflow automation.

Co-Lead, IT & Engineering Team

NhiLe Team · Sep 2025 – Present

Co-lead an internal engineering department of ~15 members. Architected multi-platform publishing pipelines, established automated n8n workflows for video scheduling and customer follow-ups, and conducted technical reviews for production deployments.

Leader, Content & Media Operations

NhiLe Team · Aug 2023 – Sep 2025

Managed a 20-person multimedia production team across multiple social channels. Scaled one TikTok channel from 0 to 55K+ followers (1.1M likes) through structured publishing workflows and video production pipelines.

Media & Communications Lead

UEH Martial Arts Club · Sep 2023 – Mar 2025

Led communication campaigns, designed media publications, and produced video recaps for major university community volunteer programs including Xuân Tình Nguyện 2024 and Mùa Hè Xanh 2024.

Background & Mindset

About Me

I am a final-year Information Security student at the University of Economics Ho Chi Minh City (UEH). My engineering focus sits at the intersection of backend software reliability and security engineering.

Rather than treating security as an afterthought or building software without understanding how adversaries exploit race conditions and protocol flaws, I enjoy analyzing edge cases: What happens when an OAuth token expires in mid-flight? How does an unindexed query degrade under concurrent worker load? How can security compliance (ISO 27001) be quantified programmatically instead of living in static spreadsheets?

Outside of engineering and coursework, I train martial arts with the UEH Martial Arts Club and enjoy building automations that eliminate repetitive manual workflows.

Get in Touch

Have an engineering role or technical project worth discussing?

I am actively seeking Internship & Fresher opportunities in Backend Software Engineering, Information Security, and DevSecOps in Ho Chi Minh City (or remote).

kylo02.work@gmail.com LinkedIn Profile ↗ GitHub Profile ↗