Flavio Sens

🔒 Firmware & Cryptography Security Audit (Hitachi)

• Security audit of firmwares on payment terminals and railway systems, with in-depth analysis of encryption mechanisms, key management, and cryptographic primitives. Work carried out in compliance with PCI PTS and EMVCo standards. Identification of critical vulnerabilities (flawed key management, weak cryptographic implementations, integration flaws) and prioritized corrective recommendations for technical teams.

🎯 Automotive ECU Pentest — USB, Wi-Fi, Bluetooth (Renault)

• Penetration testing on embedded control units (ECUs) via USB, Wi-Fi, and Bluetooth interfaces, as part of automotive cybersecurity projects. Identification of attack surfaces and exploitation vectors on connected vehicle systems.

🎓 Embedded Linux Security & DevSecOps Training (Merck, KNDS, Atraltech)

• Design and delivery of customized training programs for major clients, covering embedded Linux security, Secure Coding, and DevSecOps integration on industrial Linux systems.

📋 IoT Regulatory Compliance — CRA & RED

• Support for compliance with the Cyber Resilience Act (CRA) and the RED Directive (Radio Equipment Directive), to secure the product lifecycle of connected objects from the design stage.

🛡️ Securing Embedded Systems & IoT

• Strengthening the security of embedded and IoT architectures: secure boot, secure OTA updates, and cryptography applied to constrained environments.

• Research and vulnerability analysis in cryptographic C code, particularly in post-quantum cryptography (PQC), using static and dynamic analysis tools

• Evaluation, benchmarking, and selection of security tools (SAST, DAST, fuzzing) adapted to sensitive environments
• Contribution to security certification processes: Common Criteria (CC), CESTI evaluations, compliance with ANSSI standards

• Monitoring and support for migration to post-quantum cryptography (PQC) according to ANSSI, BSI, and NIST recommendations
• Participation in defining security requirements and cryptographic best practices

• Relaunch of a critical cybersecurity project (PKI) initially interrupted (COVID), bringing it back into production and structuring the work

• Design and development of a certificate management tool (PKI) in Java
• Implementation and management of the certificate lifecycle (issuance, renewal, revocation)

• Strengthening the security of identity and key management infrastructures (PKI)
• Contribution to the reliability of security processes and business continuity