Hire me

Open to a PFE internship · January 2027

Oubella
Ismail.

DevSecOps & Platform Engineer. I build secure-by-default delivery platforms on Kubernetes, and I secure what others deploy.

Download CV See the record
3internships
200+concurrent CTF users
6.18Mlog events processed
97%threat detection accuracy
Live
  • Building an AI vulnerability auto-patcher now
  • Shipped a secure-by-default K8s platform Jul 2026
  • Unsigned images rejected by Kyverno always
  • SBOMs signed with Cosign every build
  • Ran the Info Days CTF for 50+ teams 2026
  • Falco watching the runtime 24/7
  • Promote by digest, never by tag SLSA

Who's in
the arena

Cybersecurity engineering student at ENSA Agadir, shipping platforms where security is the default, not an afterthought.

I build secure-by-default delivery platforms on Kubernetes, with CI/CD, GitOps, policy-as-code, supply-chain security and observability wired in from day one.

I'm strong in Terraform and Ansible infrastructure-as-code and cloud infrastructure, and I bring a cybersecurity engineering background to every pipeline I touch. I'm looking for an end-of-studies internship (PFE) starting January 2027, where I can own reliability and security end to end.

Engineering degree

National School of Applied Sciences (ENSA)

Engineering Degree in Cybersecurity & Digital Trust

Agadir, Morocco · Sep 2024 – Present
DUT

Higher School of Technology (EST)

DUT in Computer Science

Essaouira, Morocco · Sep 2022 – Jun 2024

The record

Three internships, ranked by most recent. Every one shipped something real.

  1. #1

    DevSecOps / Platform Security Engineer Intern

    Onedustry Technologies · Casablanca (Remote)

    • Built a secure-by-default Kubernetes delivery platform (a reusable “paved road”) so every onboarded project inherits scanning, signed artifacts, policy enforcement, runtime protection and observability instead of wiring security by hand.
    • Authored a STRIDE threat model mapping every trust boundary (code, build, artifact, admission, runtime, network, secrets) to a concrete control, and validated each control adversarially by demonstrating blocked attacks.
    • Hardened the CI pipeline with fail-closed security gates: SAST (Semgrep), SCA (OWASP Dependency-Check), secret scanning (Gitleaks) and container scanning (Trivy, Hadolint).
    • Secured the software supply chain end to end: SBOM generation (Syft), keyless image signing and signed SBOM attestations (Cosign/Sigstore), with build-once, promote-by-digest releases following SLSA principles.
    • Delivered pull-based GitOps with ArgoCD plus policy-as-code admission (Kyverno) that rejects unsigned or non-compliant workloads; added runtime and network defense (Falco eBPF, Cilium) and secrets management (External Secrets Operator + Infisical).
    • Wired observability (Prometheus, Loki, Grafana) with alerting, and packaged the platform as a Helm template with ADRs, a runbook and a demo.
    KubernetesArgoCDKyvernoCosignFalcoCiliumHelm
    WhenJul – Aug 2026 TrackPlatform security
  2. #2

    DevSecOps Engineer Intern

    Youssra Trans-Négoce · Casablanca (Remote)

    • Designed and implemented a secure CI/CD pipeline for a full-stack delivery tracking web app with GitHub Actions, integrating SAST (Semgrep), SCA (OWASP Dependency-Check, Dependabot), secrets detection (Gitleaks) and container scanning (Trivy).
    • Automated multi-environment infrastructure provisioning on DigitalOcean with Terraform (VPCs, bastion hosts, managed PostgreSQL, DNS records).
    • Configured Ansible roles for server hardening, Docker runtime setup and secure application deployment (backend, frontend, Nginx reverse proxy).
    • Implemented JWT-based authentication and role-based access control (RBAC) in the Spring Boot backend.
    • Documented the architecture, CI/CD workflows and IaC modules for team collaboration and audit readiness.
    GitHub ActionsTerraformAnsibleSpring BootDigitalOcean
    WhenJul 2025 TrackDevSecOps
  3. #3

    Back-End Developer Intern

    ENCG Agadir · Agadir

    • Designed and built an inventory management application (Laravel) with optimized MySQL schemas.
    • Configured and maintained a secure, high-performing Linux server with Apache.
    • Developed and documented RESTful APIs (Postman) for seamless front-end integration.
    LaravelMySQLLinuxApache
    WhenApr – May 2024 TrackBackend

Case files

Six projects, built end to end: infrastructure, pipelines and the app on top. The newest one is still in the works.

01 Now building · Sprint 2 of 6

Auto-Patching: AI Vulnerability Remediation

A team pipeline that finds vulnerabilities in uploaded code, has a local LLM write the fix, and only accepts patches that pass in a sandbox. Anything doubtful goes to a human.

  • FastAPI job API with language detection, a Streamlit upload page, and SAST scanning with Semgrep, Bandit, Flawfinder and cppcheck (Python and C).
  • Fixes generated by Qwen2.5-Coder running locally through Ollama, so source code never leaves the machine.
  • My seat: LoRA fine-tuning. Compared base models (Qwen2.5-Coder 3B / 7B, DeepSeek-Coder), costed GPU options and set up training on Kaggle (2× T4).
PythonFastAPIOllamaQwen2.5-CoderLoRASemgrepDocker
  1. Uploadfile in, language detected
  2. ScanSAST findings
  3. PatchLLM writes a diff
  4. Sandboxbuild + tests in Docker
  5. Decideaccepted or needs a human
02

Infodays CTF Platform

A scalable CTF platform serving 50+ teams and 200+ concurrent users with isolated, on-demand challenge environments.

  • Provisioned Kubernetes with Terraform (DOKS, DNS, TLS, nginx ingress) and automated the full challenge deployment pipeline (CTFd + Kubernetes + flags) in Bash.
  • FastAPI microservice managing per-team pod lifecycle (deploy, suspend, scale) with strict RBAC and network isolation (Cilium).
  • Per-team HMAC flags with anti-cheating checks and audit logging, plus a custom CTFd plugin (Flask + JS) for live instance control.
  • Highly available data tier: MySQL GTID replication + ProxySQL read/write split + Redis (AOF).
  • Loki + Grafana for centralized logs and real-time observability across all namespaces.
KubernetesTerraformFastAPIMySQLRedisGrafana
03

Cybersecurity Threat Detection Platform

A Lambda Architecture platform processing 6.18M network log events through batch and real-time pipelines, with ML threat classification at 97% accuracy.

  • Batch (HDFS + Spark + HBase) and streaming (Kafka + Spark Streaming + Cassandra) pipelines merged into unified threat scores.
  • FastAPI serving layer with 14 endpoints producing threat scores and blocking recommendations.
  • Grafana dashboard with Prometheus alerting: 4 threshold rules sending email alerts within 60 s of a breach.
  • One-command deployment (make deploy-all) on a 3-node DigitalOcean cluster with Terraform, 6 Ansible playbooks and Caddy HTTPS.
SparkKafkaFastAPIGrafanaTerraformAnsible
04

3assasa-ecom

An e-commerce backend built with Laravel 12, containerized and shipped automatically.

  • User authentication, shopping cart, order tracking, discount management and per-order shipping addresses.
  • PayPal and Stripe payment gateway integration.
  • Dockerized, with a GitHub Actions CI/CD pipeline deploying to DigitalOcean.
Laravel 12PostgreSQLDockerGitHub ActionsNginx
05

Study With Me

A full-stack web app that helps students study more effectively, built as a team.

  • Built and secured the backend with NestJS, with database operations through Prisma and PostgreSQL.
  • Integrated the Next.js frontend and containerized the whole app with Docker for consistent environments.
NestJSPrismaPostgreSQLNext.jsDocker
06

Quiz Game

A desktop quiz game on IT topics, built in Java as a team.

  • Game logic with user levels, difficulty-based progression, multiple question types and personal profiles.
  • MySQL storage for questions, users and scores; Maven for dependencies; JavaFX interface.
JavaJavaFXMavenMySQL
More on GitHub Every repository, including school work

Arsenal

The tools I reach for, grouped by where they sit in the pipeline: from the first commit to the running cluster.

Cloud & Containers

DockerKubernetes (DOKS)HelmDigitalOceanVirtualization (VMs, NAT/bridged)

IaC & CI/CD

TerraformAnsibleGitHub ActionsArgoCD (GitOps)Jenkins (concepts)

DevSecOps Tooling

SemgrepGitleaksOWASP Dependency-CheckTrivyHadolintFalcoCilium

Supply Chain & Secrets

STRIDE threat modelingSBOM (Syft)Cosign/SigstoreKyvernoExternal Secrets OperatorInfisical

Security Foundations

OWASP Top 10 mitigationSystem hardeningNetwork securityCryptography fundamentalsRBACJWT authentication

Observability

PrometheusGrafanaLokiAlerting

Systems & Networking

Linux administrationDNS (BIND)LDAP (OpenLDAP)SSHiptables/ufwSquid proxyNFSDisk quotasNginxApacheCaddy

Web Development

Spring BootLaravelFastAPINestJSFlaskREST APIsPrismaNext.jsHTML/CSSJavaFX

Data & AI

SparkKafkaHDFSMachine learning fundamentalsDeep learning basicsLLMs (Ollama)LoRA fine-tuning

Programming

PythonBashJavaPHPC/C++JavaScriptSQLYAMLAssembly

Databases

PostgreSQLMySQLMongoDBRedisCassandraHBase

Tools & Methods

GitGitHubPostmanApidogMavenMarkdownAgileTechnical documentation

Beyond the code

  • CTF Organizer & Technical Team MemberInfo Days Event, Agadir · Jan 2026 – Apr 2026
  • Training LeadCybersecurity Cell, AppsClubs, Agadir · Oct 2024 – May 2025
  • OrganizerDigiFest, GDG On Campus Universiapolis, Agadir · May 2025

Let's talk

Looking for a DevSecOps or platform engineering intern for your 2027 PFE? One email is all it takes.

oubellaismail00@gmail.com Email me
Phone+212 655 888 706 LinkedInlinkedin.com/in/oubellaismail GitHubgithub.com/oubellaismail RésuméDownload the CV (PDF)