Systems & Security Engineer

Amir Ghayour

Reverse engineering, Android and Linux security, a hardened Fedora install of my own, and the scripts that set up my team's development machines.

Software Engineer at VersaSuite · MS Computer Science, CU Boulder

Resume

About

Systems and security engineer, working as a software engineer at VersaSuite. Before that: an MS in Computer Science from CU Boulder, Android reverse-engineering and penetration-testing research, and two years of teaching.

Open to systems and security engineering roles: platform and product security, Android security, reverse engineering, Linux platform work, and AI security.

  • 300+exploitation challenges solved: system, binary, software, some web
  • 10 yrsLinux: custom Arch, now SELinux-enforcing Fedora (Argbed)
  • 250+students taught across 14 lab sections at CU Boulder
  • 37modules in Argbed, my Fedora kickstart

Experience

Work

  1. to present

    Software Engineer

    VersaSuite

    • Wrote the scripts that set up the whole development environment in minutes, down from eight days; the team relies on them when a machine breaks or is suspected compromised.
    • Designed and built the printing and export system used across the product; it runs under virtual accounts on an isolated network with no internet access in or out.
    • Rebuilt the application’s entire layout to be responsive.
    • Tested AI tools and brought them into the company.
    • Mentored colleagues and directed the work of another engineer.
    • Became the link between IT and development, including diagnosing and repairing staff machines.
    • Given the team’s most difficult tasks and relied on during security incidents.
    • Bash
    • PowerShell
    • C++
    • C#
    • TypeScript
    • React
    • JavaScript

  2. to

    Prompt Engineer (Freelance)

    Handshake AI

    • Evaluated model outputs and wrote and refined the prompts used to test and train AI systems.

  3. to

    System Administrator | IT Specialist (Volunteer)

    Austin Free-Net and the City of Austin

    • Identified and stopped an active threat over RDP and mitigated other exposures.
    • Advised on a simpler setup to increase security and reduce cost and management overhead.
    • Refurbished hundreds of computers (hardware and software) and troubleshot systems and peripherals.
    • RDP
    • Windows
    • Hardware

  4. to

    Student Assistant Supervisor

    University of Colorado Boulder, Parking Services

    • Helped found the student workforce program by creating, improving, and automating its processes.
    • Automated Excel forms and office workflows with VBA; built a Microsoft Access database with forms and financial reporting for department leadership.
    • Wrote the documentation and SOPs, trained new hires, and supervised teams of 5 on the Events Team.
    • Excel
    • VBA
    • Microsoft Access
    • ServiceNow

Research & presentations

  1. Research Assistant

    University of Colorado Boulder, Computer Vision group led by Tom Yeh

    • Helped a PhD student’s bioengineering research on heart disease, a project using images and AI to predict complications of Fontan circulation: read the papers behind it, contributed to the research, and helped develop the tool.
    • Computer vision
    • AI

  2. Android game cheat analysis: reverse engineering obfuscated apps

    University of Colorado Boulder

    • Reverse-engineered obfuscated and encrypted Android applications by tracing how cheats were implemented in several Android games.
    • Worked with JADX, Ghidra, CyberChef and an Android test device.
    • JADX
    • Ghidra
    • CyberChef
    • Android

  3. Penetration Testing

    CU Boulder Penetration Testing Team · pwn.college

    • Found and exploited vulnerabilities in systems, binaries, software, and web as a member of the Penetration Testing Team, in the Collegiate Penetration Testing Competition (CPTC) and Hackazon exercises.
    • Completed Dr. John Black’s Ethical Hacking course at CU Boulder and trained through pwn.college, Arizona State University’s open exploitation course by Dr. Yan Shoshitaishvili.
    • Solved over 300 challenges in system, binary, and software exploitation, with some in web.
    • sqlmap
    • Wireshark
    • Metasploit
    • Nmap
    • Burp Suite
    • GDB
    • IDA Pro

  4. Tweet Origin Determination via Machine Learning for Disinformation Identification

    University of Colorado Boulder

    • Collected over 100,000 tweets over several days through the Twitter API.
    • Compared machine-learning algorithms on the data in Anaconda and JupyterLab.
    • Found that the posting device best predicts US versus non-US origin: US accounts skew to iPhone, non-US accounts to Android.
    • Twitter API
    • Machine learning
    • Python
    • Jupyter

  5. Penetration Testing for Android apps: senior research project with paper

    Azad University (IAU)

    • Examined the methods used on the Android platform to ensure application security, both for and from the end user.
    • Extracted sensitive data and bypassed protections to alter application behavior with Apktool, dex2jar, and JD-GUI.
    • Changed app behavior at runtime through dynamic code instrumentation with Frida, without rebuilding or re-signing.
    • Pulled data from memory and network traffic with a man-in-the-middle setup using Android Device Monitor and Burp Suite.
    • Demonstrated the analysis methods on CTF apps for the project write-up.
    • Apktool
    • dex2jar
    • JD-GUI
    • Frida
    • Burp Suite
    • Android Device Monitor

    Read the paper (PDF) (a translation of selected sections, not the full paper)

  6. Remote Access Trojan (RAT) demonstration

    Azad University (IAU)

    • Presented how malicious code embedded in an Android app can take over the camera, microphone and storage without the user noticing, and how to defend against it.

  7. Router attack and DNS phishing demonstration

    Azad University (IAU)

    • Demonstrated how an attacker can attack a router to get onto its network, change its DNS, and phish users with a site cloned in Metasploit, and how to defend against it.
    • Metasploit
    • DNS

Teaching

  1. to

    Graduate Teaching Assistant | Instructor

    University of Colorado Boulder, General Biology 1 and 2 labs

    • Taught 3 lab sections a semester, about 18 students each, over 250 students across 14 sections; wrote quizzes, managed students and experiments, graded, and helped other TAs.

  2. to

    Tutor (Volunteer)

    Austin Free-Net, University of Colorado Boulder, Azad University

    • Tutored computer-course students at Azad University, 10 Ethical Hacking students at CU Boulder, and clients aged 18 to 80 in digital literacy at Austin Free-Net.

Projects

  1. Argbed: hardened, private, minimal, modular Fedora kickstart

    Personal project · argbed.com

    • Boot and disk: LUKS2-encrypted root; signed UKIs under a machine-local key via stock shim and MOK; GRUB inert, with no boot entry and no configuration; kernel lockdown with signature enforcement; optional TPM2 + PIN keyslot bound to PCR 7.
    • Access and network: SELinux enforcing with confined users (user_u, staff_u), locked root; fail-closed nftables, default-drop in both directions, DNS pinned; systemd-networkd and iwd.
    • Privacy: randomized MACs, anonymized DHCP, microphones and cameras disabled at the audio server and at the device node, boot entries with no identifying information.
    • Minimal and verified: no @core; 24 core + 13 optional modules; a verify script proves the ~670-package closure against live repositories before install; the nftables ruleset is kernel-validated and the SELinux labels of module-written files are checked against the targeted policy; after the first login, verify-install re-checks the security properties the modules set; every core module installed on real hardware.
    • Fedora
    • Kickstart
    • SELinux
    • nftables
    • LUKS2
    • UKI
    • Secure Boot
    • systemd
    • Bash

  2. Four-elevator controller that minimizes power use

    Microcontroller lab project

    • Controlled four parallel elevators on an ATmega32 in C, saving energy by prioritizing elevators based on requests.
    • Designed and simulated the controller in CodeVisionAVR and Proteus Design Suite.
    • C
    • ATmega32
    • CodeVisionAVR
    • Proteus

  3. Algorithm and game projects in Java

    Coursework · source on GitHub

    • Tic Tac Toe: Minimax opponent with a JavaFX GUI.
    • 8 Puzzle: A* solver; puzzles are generated by shuffling from the solved state so every one is solvable.
    • Wumpus World: JavaFX GUI with custom graphics.
    • Traveling Salesman: exact optimal tour by Held-Karp dynamic programming over city subsets, with path reconstruction.
    • Java
    • JavaFX
    • Minimax
    • A*
    • Dynamic programming

  4. to

    Management and accounting software

    Construction company

    • Built and supported employee-management software with salary calculation, saved records, printing and PDF export; several thousand lines of code.
    • First version in VB6, then a second in VB.NET and WPF with a SQL database and a redesigned interface.
    • VB6
    • VB.NET
    • WPF
    • SQL

Education

  1. MS, Computer Science

    University of Colorado Boulder · GPA 3.8/4.0

  2. BS, Computer Engineering

    Azad University (IAU)

Relevant coursework

  • Ethical Hacking and Penetration Testing
  • Computer Systems Security
  • Network Security
  • Embedded Security (including Threat Modeling)
  • Hack for Defense
  • Computer Networks
  • Microprocessor and Assembly Language
  • Computer Architecture
  • Operating Systems
  • Databases
  • Design of Algorithms
  • Data Structures
  • Principles of Compiler Design
  • Artificial Intelligence and Expert Systems
  • Machine Learning
  • Computer Vision

Skills

Security & analysis

  • Reverse engineering
  • Static & dynamic analysis
  • Binary exploitation
  • Penetration testing
  • System hardening
  • SELinux policy (CIL)
  • Encryption & obfuscation
  • Cryptography
  • Network analysis
  • Threat modeling

Platforms & frameworks

  • Linux (Fedora, Arch)
  • SELinux
  • Windows
  • Android
  • AVR microcontrollers
  • React
  • .NET
  • JavaFX
  • WPF

Languages

  • C
  • C++
  • C#
  • Assembly
  • Python
  • Java
  • JavaScript
  • TypeScript
  • SQL
  • Bash
  • PowerShell

Tools

  • IDA Pro
  • Ghidra
  • GDB
  • GCC
  • JADX
  • Frida
  • ADB
  • Wireshark
  • Burp Suite
  • CyberChef
  • Metasploit
  • Nmap
  • sqlmap
  • Apktool
  • dex2jar
  • JD-GUI

Systems & automation

  • Kickstart
  • nftables
  • systemd
  • LUKS
  • Secure Boot / UKI
  • TCP/IP
  • DNS
  • DHCP
  • VPN
  • Git
  • Bash / PowerShell automation
  • Virtualization (VMware, VirtualBox, Hyper-V)

AI tooling

  • AI-assisted development
  • Prompt design & evaluation
How I built these skills
  • Assembly
    • Wrote assembly in my microcontroller lab.
    • Regularly wrote custom shellcode during penetration-testing training.
    • Analyzed assembly in GDB, IDA Pro and Ghidra during reverse-engineering research and penetration-testing exercises.
  • C and C++
    • Built the quadruple elevator controller in C for an ATmega32.
    • Used C in penetration testing to reach memory and system-level functions, and in cryptography research.
    • Work in C++ and C# daily at VersaSuite.
  • Web and application code
    • React, TypeScript and JavaScript at VersaSuite.
  • Python
    • Quick scripting, including pulling data from Twitter.
    • Machine-learning coursework and the Tweet Origin Determination project.
  • Java
    • Game development, Android programming and reverse engineering.
  • VB6 and .NET
    • Learned VB6 and .NET in high school from DVDs borrowed from a public library; I had dial-up at the time.
    • Built management and accounting software for a construction company.
  • Operating systems
    • Linux as primary OS for about 10 years: custom Arch builds, and now Fedora with SELinux in a hardened, minimal configuration I automated as Argbed.
    • Terminal, Bash, and Vim every day, with scripts that automate and customize Linux installation and configuration.
    • Every Windows from 98 to 11, still used at work and when troubleshooting for others; PowerShell for development-environment setup.
    • Android: reverse engineering, penetration research, programming, rooting devices and installing custom ROMs.
  • Static and dynamic analysis
    • JADX, GDB, IDA Pro and Ghidra for static analysis; Frida to attach to running processes and change behavior; Burp Suite and Wireshark to monitor and manipulate network traffic.
    • Discovered spyware by reading an APK’s source in JADX, found a dynamically loaded, heavily obfuscated encrypted payload, extracted and decrypted it, then examined its ARM and x86 binaries in Ghidra.
  • Virtualization
    • Virtual machines for research test environments and for running operating systems and software safely.