Cybersecurity · Systems · Applied ML

Thierry
Bungaroo

Epitech student specialising in security, on exchange at Beijing Institute of Technology until June 2027. I build detection systems, low-level tools and things that ship.

  • ML threat detection in production
  • $1,000 AWS × Riot hackathon prize
  • Real incident response
Portrait of Thierry Bungaroo
Toulouse → Beijing · open to internships from mid-2027

About

Who I am

I like taking systems apart to see where they break, then building the thing that would have caught it.

Fourth-year Epitech student, French and British, currently spending a year at BIT in Beijing. My internship put me on a real ML detection platform and in front of a real incident, and that settled it: security is the job.

Next

A 5th-year internship in security, part-time then full-time, from mid-2027. Pentest or detection.

Later

Offensive security first, then leading security engagements and the people who run them.

Interests

  1. Boxing

    Retired, planning a comeback: amateur first, then pro.

  2. Martial arts and philosophy

    Same discipline, different arena.

  3. Gym

    Training regularly.

  4. Gaming

    Always. Probably why I build anti-cheat.

Munnin raven logo

Munnin · since Aug 2026

Auto-entrepreneur IT services

Freelance work

Custom apps, hosting, infrastructure and repair for small businesses.

Open and closed-source SaaS

Local-first tools like Munnin Devis and MunninVault, built so your data stays yours.

munnin.fr (coming soon)

Stack

Languages

  • C
  • C++
  • Python
  • Rust
  • Haskell
  • TypeScript
  • Dart

Security + network

  • Zeek
  • WireGuard
  • ASan · Valgrind
  • Cloudflare

ML

  • scikit-learn
  • XGBoost
  • TensorFlow
  • LangChain
  • AWS Bedrock

Infra + data

  • Docker
  • Linux
  • Proxmox
  • PostgreSQL
  • Redis
  • Flask
  • Flutter

Selected work

Commercial detection tools cost six figures a year or ship your traffic abroad. Sentinel watches client networks from a small on-site tap and only spends heavy compute on what actually looks wrong.

How it works

  1. Pi tap · WireGuard
  2. Zeek + syslog
  3. Redis
  4. Isolation Forest
  5. XGBoost
  6. Autoencoder
  7. PostgreSQL
  8. Dashboard + local analyst

Only events the Isolation Forest flags go on to XGBoost and the autoencoder. Normal events go straight to PostgreSQL.

What I did

  • Chose the stack and drove the technical decisions
  • Built the cascade and per-client workers on Redis
  • Set up biweekly retraining with live model hot-swap
  • Designed the database: one PostgreSQL schema per client
  • Built the client dashboard
Role
Lead developer (chose the stack, built most of the platform)
Team
Team of 2
Stack
Python, Redis, PostgreSQL, scikit-learn, XGBoost, TensorFlow/Keras, Zeek, Filebeat, FastAPI, Docker, WireGuard, Raspberry Pi, Ollama
Status
In use at Interface Numérique

No kernel driver, nothing installed on the player's machine. Each player gets a behavioural fingerprint that survives team changes, so aim-locking, pre-aiming through walls and deliberate team-griefing all stand out.

How it works

  1. Raw replay dataCS2 .dem files + match records
  2. High-frequency parser128 ticks per second
  3. Neural and algorithmic auditbiometric vector analysis of aim and movement + physics-based sabotage detection
  4. Forensic verdictrisk score 0–100 + evidence-ready report

A developer API for sending match data directly is planned.

What I did

  • Modelling maths (shrinkage-based optimisation)
  • CI, Docker build checks and Dependabot
  • Architecture decision records and weekly devlogs
Role
Modelling maths and project engineering
Team
Team of 4
Stack
Rust, PostgreSQL, Docker, REST API
Status
In development · CS2 first

Most entries competed on statistics. Ours won the Roast prize at the AWS × Riot Games hackathon by being a coach you can actually argue with: it remembers your past games and checks whether you applied its advice.

How it works

  1. Riot API
  2. Flask backend
  3. Claude on Bedrock
  4. Tool calls
  5. DynamoDB memory

What I did

  • Led backend and cloud: Elastic Beanstalk, DynamoDB, Bedrock
  • Built the AI layer: tool calling and per-player memory
  • Database architecture and CLI testing tools
Role
Backend and cloud lead
Team
Team of 3
Stack
Python, Flask, AWS Elastic Beanstalk, DynamoDB, SQLite, Amazon Bedrock, Claude, LangChain
Status
Shipped · prize winner

A statically typed, C-like language compiled to a custom WebAssembly-like bytecode and run on our own VM, with the AST and IR available for inspection.

How it works

  1. Source
  2. Parser
  3. AST
  4. IR
  5. Bytecode
  6. VM

What I did

  • Co-built the compiler
  • Co-built the virtual machine
Role
Co-built the compiler and the virtual machine
Team
Team of 5
Stack
Haskell
Status
Shipped

Security work

Case 01Incident response

A five-figure remote-access scam

Situation
A business owner was pressured on the phone while an attacker controlled his screen, and transferred a five-figure sum.
Action
Investigated how the attacker got in, closed the access, and rebuilt his account and password security from scratch.
Result
Access shut down and his accounts locked back down. A textbook case of social engineering beating technology.

Case 02Awareness

Briefing a client's engineering team

Situation
A client's engineers needed to understand which security practices actually matter and why.
Action
Wrote and presented the briefing myself, explaining the reasoning instead of handing out rules.
Result
A team that understood the why. Comfort is the threat, not the tooling.

Case 03Maintenance · Munnin

A backup system about to fail

Situation
During routine maintenance for a Munnin client, I found his backups running regularly to a USB drive never built for that much I/O, showing signs it was about to corrupt.
Action
Diagnosed the failing setup and fixed it before the backups were lost.
Result
Backups he can actually rely on, caught before he needed them.

Case 04Detection

Sentinel, in the field

Situation
Small businesses with no SOC and no budget for enterprise tooling.
Action
Led development of an ML detection cascade fed by on-site taps over WireGuard, with each client's data isolated.
Result
A detection platform now in use at Interface Numérique.

My main cybersec training tools

  • Hack The BoxOffensive labs
  • TryHackMeGuided rooms
  • Root MeChallenges
  • Blue Team Labs OnlineDefensive investigations

Experience

Mar – Jul 2026 · Toulouse

AI / Software Engineer Intern

Interface Numérique

Hired to assist on Sentinel; ended up driving its technical decisions and most of its development, alongside client work.

  • Built the ML detection platform: pipeline, retraining, per-client database
  • Incident response after a remote-access scam
  • Security briefing for a client's engineering team
  • Maintenance and security updates across client sites

Read the Sentinel write-up

  1. Aug 2026 – now

    Founder

    Munnin · IT services

    Apps, hosting, infrastructure, repair. Local-first open-source tools.

  2. 2024 – 2026

    Founder and co-lead

    Epitech Toulouse Cybersecurity Club

    Workshops, CTFs and training sessions.

  3. 2024 · 6 months

    Developer Intern

    SARL du Midi

    Order-relay web app prototype for waitstaff.

Education

Let's talk.

Internship offers, security roles or questions about a project. Everything that comes through here reaches me.

Spam check by Cloudflare Turnstile