Master of Cybersecurity at La Trobe, Melbourne. Evenings go to a home lab — chaining exploits, escalating privileges, and writing down every step so someone else can follow it. Open to 2026 vacation and graduate roles in offensive security.
└─$ cat origin.md
It started with a video game.
Watch Dogs 2. A group of hackers in San Francisco breaking into companies to prove those companies were quietly harvesting everyone's data. I was young enough to think the hacking was the interesting part. It took me a while to work out that it wasn't. The interesting part was the premise — that behind every convenient app is a database nobody outside the building ever gets to audit, and most people have no idea what's in it.
That was the itch. Then I started watching people who did it for real.
May 2017. Ransomware tore through hospitals, telcos and factories in over a hundred countries in a single day. In Britain it hit the NHS — appointments cancelled, ambulances diverted, surgeries postponed. It spread using EternalBlue, an exploit developed by the NSA and then leaked. A patch had existed for weeks.
A month later, the same exploit, a much worse intent. It looked like ransomware but there was no real way to pay and recover — it just destroyed. Shipping, logistics and pharmaceutical companies lost entire networks, with damages counted in the billions.
Both were built on a government's own stockpiled weapon, after it got out. That's what stuck: offensive capability doesn't stay where you put it. And on the other end of it, an unpatched machine in a hospital becomes a cancelled surgery.
Which is why I want the offensive side specifically. Not because breaking in is the fun half — because a warning nobody acts on is worth nothing, and the person best placed to make an organisation act is the one who can show them exactly how it would happen.
Right now: third semester of a Master of Cybersecurity at La Trobe, a year to go, WAM above 80. Before that, electrical engineering in India and five months writing SAP ABAP in Hyderabad, which is where I learned what shipping to a real client actually feels like.
I'm straight about where I am. I have foundations, not field experience. What I do have is a lab I built myself, thirty-two rooms and a stack of CTFs behind me, and the habit of documenting every step so the person reading it afterwards can follow exactly what I did.
└─$ ls -la ./projects
A Gmail add-on that flags phishing and then tells you why. Layer one scans keywords and headers against known patterns. Layer two hands anything ambiguous to Gemini 2.5 Flash to catch phrasing that hasn't been seen before. The output is a plain-English verdict, not a red banner — because a warning nobody understands is a warning nobody acts on.
A multi-host environment I built and maintain — Kali, Metasploitable, a Windows target. Four full exploit chains end to end: vsftpd 2.3.4, Ingreslock, UnrealIRCd, and EternalBlue (MS17-010). Meterpreter post-exploitation, custom MSFvenom payloads, and a write-up for each covering the CVE, the chain, and the fix that would have stopped it. Thirty-two TryHackMe rooms alongside.
Enumerated misconfigured SUID binaries, cross-referenced GTFOBins, escalated to root. The interesting half was the report afterwards — which binaries should never carry the bit, and what a hardening baseline looks like for a team that actually has to maintain it.
Built a VPC from scratch — public and private subnets, internet gateway, NAT gateway, EC2 across availability zones, EFS for shared storage, ELB out front. Static sites on S3 with bucket policies, versioning, and IAM roles scoped properly instead of scoped wide.
Mapped digital footprints using Shodan, theHarvester, ExifTool and Sherlock, then wrote up how much attack surface is visible before you send a single packet at the target.
A Bundoora burger shop needed to take orders online. I built a static front end with the menu, item pages and a simple cart, wired to a hosted ordering back end so the owner could manage it himself without touching code. Two iterations, scoped directly with him. Small job — but it's the first time something I made had a customer on the other end of it.
I have a spare Android handset and a plan for it: turn it into a genuinely capable field device. Rootless NetHunter, a scripted recon toolchain, and an agent layer that can run a scan, read the output, and tell me what's worth looking at — rather than dumping a wall of text I have to parse myself. Strictly against my own lab, documented as it goes.
└─$ cat skills.txt certs.log
// TOOLKIT
// CERTIFICATIONS
// EDUCATION
└─$ ./contact.sh
Open to vacation programs, graduate roles and industry placements in Melbourne — particularly anything with an offensive security or security engineering edge. Happy to talk about lab work, tooling, or where to start if you're early in this too.