Experience

Security engineering and research experience.

Security Research Intern

Full-time·Düsseldorf, North Rhine-Westphalia, Germany · On-site

Internship

• Privacy-enhancing technologies: I research data minimization, anonymous authentication, secure credentials, and privacy-preserving, policy-scoped authorization at Huawei Research, Data and Privacy Protection Lab.
• Policy-based anonymous tokens: For my Master’s thesis, I specified, implemented, and evaluated a protocol under a post-quantum security target. The goal is least-disclosure authorization, unlinkability, and local derivation of policy tokens, rather than cryptography in isolation.
• Application to Agentic AI workflows: I designed an authorization architecture in which trusted host components mediate model-proposed tool calls and select among anonymous, identity-bound, and step-up authorization for tools, APIs, and MCP servers. The architecture is analyzed, not deployed or benchmarked end to end.
• Measured trade-offs: At the evaluated endpoint, the policy-bound construction added 16.8% client redemption time including local derivation, 22.4% proof size, and 16.4% verifier time. These are artifact-level results rather than an end-to-end deployment benchmark.
• Operational cost model: In an illustrative same-primitive comparison, one tag-independent master credential became cheaper than repeated ordinary-token issuance from two policy-token uses onward, at 1,040.052 ms versus 1,264.948 ms for two uses.
• Research paper: I co-authored A Post-Quantum-Compatible Generic Construction of Policy-Based Anonymous Tokens, submitted to PKC 2027, covering correctness, freshness, unforgeability, and unlinkability under the stated building-block assumptions.

Agentic AI Security Initiative Member

Remote

Initiative

• Initiative membership: I participate in the OWASP GenAI Security Project with a focus on its Agentic AI Security Initiative.
• Initiative scope: The community develops open guidance around risks and mitigations for LLM applications, autonomous agents, memory, tools, APIs, MCP integrations, multi-step workflows, governance, testing, and secure deployment.
• Professional direction: I joined to follow current agentic-security risks, learn from practitioners, and participate in the community around open threat guidance for agentic systems.

Technical Operations & Partnerships

Turin, Piedmont, Italy · On-site

operations

• Contributing to the Mu Nu Chapter of IEEE-Eta Kappa Nu (IEEE-HKN), supporting technical operations, event organization, and collaboration with industry partners.
• My work focuses on the technical and organizational side of the chapter’s activities, helping create events and initiatives that connect students with the engineering community.
• Coordinated technical infrastructure, logistics, and on-site support for 5+ STEM events with 150 to 250 participants.
• Supported university and industry events and initiatives involving companies including ARM, NXP, and STMicroelectronics.
• Assisted with event infrastructure, technical setup, and real-time operational support.
• In 2025, I represented Mu Nu at the IEEE-HKN International Hackathon, where our team won 1st place internationally with Budget HQ.
• Budget HQ is a full-stack financial management platform for IEEE-HKN chapters. I contributed to its development and secure design, including TOTP-based 2FA, JWT sessions with HTTP-only cookies, RBAC, parameterized PostgreSQL queries, and Dockerized deployment.

Undergraduate Researcher - Software Security

Benevento, Campania, Italy · On-site

research

• Conducted undergraduate cybersecurity research for my Bachelor’s thesis, "Extracting Equivocal Behaviours from Trusted Systems", focusing on software transparency, behavioral analysis, and software supply chain security.
• The main idea was simple: trusted software does not always behave exactly as users expect. Legitimate applications can perform actions that are also commonly associated with malware, without those actions necessarily being malicious. I investigated these ambiguous actions, known as Equivocal Software Behaviours (ESBs), and their possible impact on user security and privacy.
• Multi-sandbox pipeline: I developed a modular, asynchronous, multithreaded Python tool integrating Hybrid Analysis, VirusTotal, and ANY.RUN, then normalized their JSON reports across Windows 10 and 11 environments where supported.
• Behavioral taxonomy: I mapped observations from 60 reviewed MITRE ATT&CK techniques into a 12-category taxonomy of Equivocal Software Behaviours.
• Study scope and result: I analyzed 36 widely downloaded goodware binaries across ten software categories. System and resource discovery appeared in 100% of the analyzed systems, showing why vendor reputation alone is insufficient evidence of safe runtime behavior.
• Reusable analysis: I produced structured JSON data and Pandas/Seaborn visualizations to make behavior comparable across sandbox outputs.