Lénusan Gunarajah Junior Cybersecurity Engineer

Security auditing · Infrastructure security · Managed services

Lénusan Gunarajah

Junior Cybersecurity Engineer

Security Auditing | Infrastructure Security | Managed Services

Graduate of the Ynov Paris Master's degree in Cybersecurity, with hands-on apprenticeship experience at Novastill under managed services for several clients: Forcepoint and FortiGate firewall rule audits, high-availability web filtering platforms, Active Directory and Kerberos integration, production incident troubleshooting and technical report writing.

Looking for: A junior cybersecurity engineer or consultant position — Luxembourg, Metz, Thionville and the French border area — available from 29 September 2026

Areas of expertise

  • Firewall rule auditing
  • Infrastructure security
  • Multi-client managed services
  • Directories and authentication
  • Incident troubleshooting
  • Governance and compliance
  • Aulnay-sous-Bois, France
  • Open to: Luxembourg / Metz / Thionville
  • Driving licence (EU category B)
  • Available from 29 September 2026
Get in touch LinkedIn GitHub
841 firewall rules reviewed during a Forcepoint NGFW / SMC audit
27 pp. audit report delivered to the client's CISO
8 nodes at most on an Olfeo web filtering cluster
3 clients supported under managed services

About

I am looking for a junior cybersecurity engineer or consultant position, primarily in Luxembourg, the French border area and the Metz / Thionville area.

Background

Technological baccalauréat (STI2D), a two-year BTS SIO diploma at EFREI, then a Bachelor's degree in Computer Science and a Master's degree in Cybersecurity at Ynov Paris (French RNCP 40897 qualification, “Cybersecurity Expert”, level 7). Since November 2025, apprenticeship at Novastill, an IT services company specialising in cybersecurity and managed services.

Positioning

Configuration auditing, infrastructure security and managed services: I work on multi-client production environments, from reviewing a firewall rule set to operating a high-availability web filtering platform, including incident troubleshooting and deliverable writing.

Advisory posture

I talk directly to the client's stakeholders — CISO, IT director, data protection officer — and to the vendors, and I turn a technical finding into an actionable recommendation, in a report or a written summary.

Automation, as a complement

Scripting is not my core discipline. I use Python, Bash and PowerShell as automation and troubleshooting tools: parsing a configuration export, collecting logs, checking a configuration before rollout. My GitHub repositories are small auditing and troubleshooting tools written in that spirit.

Areas of work

The topics I have worked on during my apprenticeship and my studies.

Firewall configuration audits

Forcepoint NGFW / SMC and FortiGate rule analysis, AlgoSec Firewall Analyzer, identification of permissive or obsolete rules, logging review, audit report and recommendations.

Infrastructure security

Olfeo v7 web filtering platforms in high availability: HAProxy, Keepalived / VRRP, virtual IP addresses, filtering policies, PAC files, log retention.

Directories and authentication

Joining platforms to Active Directory, Kerberos and NTLM authentication, Winbind, LDAP, SPNs and keytabs, multi-domain environments, Group Policy.

Production incident troubleshooting

Elasticsearch, PostgreSQL, rsyslog, HAProxy, Linux and Windows Server: qualifying a defect, restoring service, escalating to the vendor with supporting evidence.

Multi-client managed services

Operating production environments for several clients, working with CISOs, IT directors, DPOs and vendors, written summaries, procedures and technical and functional deliverables.

Governance and compliance

Risk management, ISO 27001, GDPR (log retention, usage charters), NIS2 basics, awareness on password hygiene and phishing.

Skills

Skills applied during my apprenticeship, my studies and my personal projects, grouped by area.

Auditing and governance

  • Configuration auditing
  • Firewall rule analysis
  • Risk identification
  • Vulnerability management
  • Technical report writing
  • Security recommendations
  • ISO 27001
  • GDPR
  • NIS2 (basics)
  • Security awareness

Network security and firewalls

  • Forcepoint NGFW / SMC
  • FortiGate (FortiOS 7.x)
  • AlgoSec Firewall Analyzer
  • pfSense
  • IPsec VPN
  • IDS / IPS
  • VLAN
  • DNS
  • DHCP

Infrastructure security

  • Olfeo v7
  • HAProxy
  • Keepalived / VRRP
  • Virtual IP addresses
  • Web filtering and proxy
  • PAC files
  • High availability
  • Wallix Bastion

Systems and directories

  • Windows Server
  • Active Directory
  • Group Policy
  • Linux (Debian, Ubuntu, Kali)
  • Kerberos
  • NTLM
  • Winbind
  • LDAP
  • Multi-domain environments
  • systemd

Monitoring and troubleshooting

  • Elasticsearch
  • PostgreSQL
  • rsyslog
  • logrotate
  • cron
  • Log analysis
  • SIEM concepts
  • Network monitoring
  • Incident troubleshooting

Cybersecurity tools

  • Wireshark
  • Nmap
  • Burp Suite
  • Metasploit
  • Kali Linux
  • GLPI
  • MobaXterm
  • SQL

Supporting automation

  • Python (standard library)
  • Bash
  • PowerShell
  • Configuration export parsing (XML, FortiOS, CSV)
  • Monitoring and alerting scripts
  • Data export

Automation is a supporting skill: I use it to speed up an analysis or a diagnosis, not as my main discipline.

Experience

Apprenticeship in production environments, on real assignments for several clients.

Cybersecurity Engineer — apprenticeship

Novastill

IT services company specialising in cybersecurity, managed services and multi-client assignments.

November 2025 – September 2026

Auditing

Firewall configuration audits

  • Forcepoint NGFW / SMC audit: review of 841 rules across 2 clusters and 7 sub-policies.
  • Identification of obsolete and overly permissive rules, analysis of exposure and associated risks, review of the logging configuration.
  • 27-page audit report delivered to the client's CISO, with rationalisation and hardening recommendations.
  • Audit of a FortiGate 601E (FortiOS 7.4.9) with AlgoSec Firewall Analyzer, for a local government organisation.
  • Python helper tool for the analysis: XML parsing of configuration exports, rule mapping and classification.

Infrastructure

Web filtering and high availability

  • Deployment and operation of Olfeo v7 clusters, up to 8 nodes, across three clients.
  • VRRP / Keepalived high availability and virtual IP management; load balancing with HAProxy.
  • Joining the platforms to the client's Active Directory, with Kerberos and NTLM authentication.

Operations

Filtering policies and PAC files

  • Design and adaptation of PAC files: exclusions by domain and IP range, automatic switchover to a virtual address, failover strategies.
  • URL filtering policies, time-based restrictions, internet usage charters with user sign-off.
  • Configuration of log retention in line with the GDPR.

Incidents

Troubleshooting and incident handling

  • Restored an Elasticsearch statistics pipeline: diagnosed a multi-node aggregation issue and brought an unavailable service back into production.
  • Fixed an HAProxy alerting script that was causing excessive CPU consumption; industrialised log collection with rsyslog.
  • Qualified a product defect affecting VRRP and escalated it to the vendor with supporting evidence.
  • Identified and reported secrets stored in clear text in application logs.

Directories

Identity and authentication

  • Contributed to a study on migrating from NTLM / Winbind to Kerberos.
  • Analysis of SPNs, keytabs and multi-domain environments.
  • Review of browser-related Group Policy settings in Active Directory environments.

Advisory

Advisory and organisation

  • Comparative study of 10 ITSM solutions and recommendation of a multi-client architecture with per-entity isolation.
  • Structured a CMDB, a P1–P4 criticality matrix and the associated service commitments; 12-week deployment roadmap.
  • Wrote technical and functional deliverables; liaised with clients, CISOs, IT directors, DPOs and vendors.

Methods and tools

How I run an audit or troubleshooting assignment, and with what.

Firewall audit approach

  1. Collection

    Retrieval of the configuration export (Forcepoint SMC, FortiOS backup, pfSense) following a documented collection procedure.

  2. Flattening

    Rebuilding the rule table: objects, groups, VDOMs, sub-policies, interfaces.

  3. Qualification

    Spotting permissive, obsolete, disabled, unlogged or undocumented rules; checking the logging setup.

  4. Analysis

    Exposure of sensitive services, clear-text protocols, wide ranges, associated risks and business context.

  5. Reporting

    Audit report with rationalisation and hardening recommendations, presented to the CISO.

Tools by use

Auditing and analysis
  • AlgoSec Firewall Analyzer
  • Forcepoint SMC
  • FortiOS
  • Wireshark
  • Nmap
  • fw-audit
  • fortigate-policy-parser
Operations and troubleshooting
  • Olfeo v7
  • HAProxy
  • haproxy-audit
  • Keepalived
  • Elasticsearch
  • PostgreSQL
  • rsyslog
  • pac-check
  • log-secret-scanner
Directories and access
  • Active Directory
  • Kerberos
  • NTLM / Winbind
  • LDAP
  • Group Policy
  • Wallix Bastion
Deliverables
  • Audit reports
  • Written summaries
  • Procedures
  • Comparative studies
  • Roadmaps
Frameworks
  • ISO 27001
  • GDPR
  • NIS2 (basics)
  • ANSSI SecNumacadémie

Projects

Auditing, troubleshooting and learning tools published on GitHub. They extend situations met on assignments; the code stays deliberately simple and dependency-free, and is not an end in itself.

Auditing tool

fw-audit

Security objective
Automatically spot classic misconfigurations in a firewall rule set.
Problem addressed
Reading several hundred rules by hand is slow and error-prone. The tool applies five checks — “any → any” rule, sensitive service exposed to any source (exact port or a range containing it), clear-text protocol, wide port range, undocumented rule — with a severity and a recommendation for each finding.
Environment and tools
  • Python 3
  • Standard library
  • CSV
  • Command line
Results
18 passing unit tests. Also reads the fortigate-policy-parser CSV export directly (disabled policies skipped, FortiOS services translated into ports, findings tied to the policy id). Validated on a 9-rule sample set and 5 FortiGate policies.
Skills applied
Firewall rule analysis, risk qualification, recommendations.

View the repository

Infrastructure auditing

fortigate-policy-parser

Security objective
Flatten a FortiGate backup into a rule table usable for an audit.
Problem addressed
A FortiOS export runs to thousands of lines. The tool rebuilds VDOMs, objects and groups, exports the policies to CSV and qualifies the rules: any → any accept, disabled rules, accept without logging, unnamed rules.
Environment and tools
  • Python 3
  • Standard library
  • FortiOS 7.x
  • CSV
Results
12 passing unit tests. --resolve option: addresses as subnets and services as protocol/ports, read directly by fw-audit. On the sample configuration: 5 policies, 3 findings. IPv4 policies only.
Skills applied
FortiGate auditing, reading FortiOS configuration, rule mapping.

View the repository

Infrastructure auditing · high availability

haproxy-audit

Security objective
Review an HAProxy configuration with an auditor's eye: exposure, TLS, logging, hardening, and the ability to survive an outage.
Problem addressed
An unauthenticated stats page, an enabled stats admin, TLS 1.0 still accepted or a node without a health check stay invisible until an incident. The tool splits haproxy.cfg into sections, applies defaults inheritance and reports 20 security and high-availability checks with a severity and a recommendation.
Environment and tools
  • Python 3
  • Standard library
  • HAProxy
  • Keepalived / VRRP
Results
13 passing unit tests; on the sample configuration: 1 critical, 3 high and 6 medium findings; the hardened version reports nothing. Static analysis of a single file, ACLs not interpreted.
Skills applied
Infrastructure security, high availability, configuration analysis, recommendations.

View the repository

Web filtering and high availability

pac-check

Security objective
Validate a PAC file before rollout, like any other configuration.
Problem addressed
A badly written exclusion or a misordered failover chain breaks an access path or high availability, and you only notice once the file is deployed. The tool evaluates FindProxyForURL outside the browser and compares the result with an expectations file.
Environment and tools
  • Node.js 18+
  • Zero dependencies
  • vm sandbox
  • PAC / proxy
Results
6/6 expectations verified on the sample PAC; 7 passing automated tests (node:test). Does not reproduce the https URL truncation performed by browsers.
Skills applied
Web filtering, high availability, proxy operations.

View the repository

Operational security

log-secret-scanner

Security objective
Detect clear-text secrets in logs and configuration files, without ever displaying them.
Problem addressed
A service that logs a password or an Authorization header exposes that secret to anyone reading the logs and to the collection platform. Ten patterns, one severity per pattern, already-masked values ignored, .gz archives read as a stream.
Environment and tools
  • Python 3
  • Standard library
  • Regular expressions
  • .gz archives
Results
11 passing unit tests; 6 redacted findings on the sample log. Pattern-based detection only, no entropy analysis.
Skills applied
Operational security, log management, reporting and remediation.

View the repository

Triage / incident response tool

authlog-triage

Security objective
Quickly surface security signals in a Linux authentication log (auth.log / secure).
Problem addressed
During an incident or an audit, reading an auth.log by hand is slow and misses correlations. The tool reports, with a severity for each finding: SSH brute-force sources, a successful login right after a run of failures (possible compromise), denied sudo, account creation and additions to a sensitive group (sudo, wheel).
Environment and tools
  • Python 3
  • Standard library
  • auth.log / secure
  • Command line
Results
14 passing unit tests. Reads multiple files (rotated logs), .gz archives and standard input; text or JSON output and a CI-friendly exit code. Validated on a sample log: brute-force, success-after-failures, denied sudo and addition to the sudo group correctly reported.
Skills applied
Log analysis, SSH/sudo detection, incident triage and response.

View the repository

Defensive reconnaissance

osint-toolkit

Security objective
Measure an organisation's public exposure passively, ahead of an audit.
Problem addressed
Eight commands: DNS over HTTPS, raw-socket WHOIS, IP geolocation, TLS certificate inspection, HTTP security header scoring, subdomains through Certificate Transparency, username presence, email header analysis. No intrusive probing of the target.
Environment and tools
  • Python 3
  • Standard library
  • DNS-over-HTTPS
  • TLS
  • crt.sh
Results
Network commands validated manually on public domains; 6 unit tests on the local modules (email headers, HTTP header grading). Relies on free third-party services.
Skills applied
Passive reconnaissance, header analysis, phishing awareness.

View the repository

Credential hygiene

pwned-check

Security objective
Check whether a password is compromised without ever exposing it.
Problem addressed
Have I Been Pwned's k-anonymity model reimplemented: local SHA-1 hashing, only the first five characters of the digest are sent, final comparison happens locally, response padded through the Add-Padding header.
Environment and tools
  • Node.js 18+
  • Zero dependencies
  • HIBP API
  • SHA-1 / k-anonymity
Results
Hidden input and distinct exit codes (not found, compromised, error). One password at a time; no automated tests.
Skills applied
Credential hygiene, security awareness.

View the repository

Systems administration

pc-tools

Security objective
Apply safe-operations reflexes — dry run by default, explicit destructive action — to file administration tasks.
Problem addressed
Duplicate detection by SHA-256 digest, largest-files search, bulk renaming. Deletion requires --delete, renaming requires --apply; name collisions are listed without overwriting any data.
Environment and tools
  • Python 3
  • Standard library
  • Cross-platform
Results
Used daily; 9 passing unit tests (duplicates, largest files, rename plan, collisions). No recycle bin: a deletion is final.
Skills applied
Systems administration, access error handling, guard rails.

View the repository

Academic project · Ynov Paris

Active Directory infrastructure

Security objective
Deploy and administer an Active Directory domain end to end.
Problem addressed
User and Group Policy management, workstation imaging and deployment through MDT and WDS.
Environment and tools
  • Windows Server
  • Active Directory
  • Group Policy
  • MDT
  • WDS
Results
Practical grounding in directory services and endpoint management, later reused during the apprenticeship on domain-join and authentication topics.
Skills applied
Directories, Group Policy, workstation deployment.

Personal practice · since 2021

Labs and CTFs

Security objective
Keep my understanding of attack techniques current, to assess an infrastructure's exposure correctly.
Problem addressed
Regular practice on lab and CTF platforms: web pentesting, system exploitation, forensics, steganography, privilege escalation.
Environment and tools
  • TryHackMe
  • Root-Me
  • Kali Linux
  • Burp Suite
Results
Ongoing practice, with no ranking or score put forward.
Skills applied
Offensive culture applied to defensive auditing.

My GitHub account also holds one side repository outside cybersecurity, shader-lab (WebGL visual effects), kept public for transparency. View the repository

All my repositories on GitHub

Certifications

Certifications and training completed alongside my degree, verifiable on Credly.

  • Fortinet Certified Fundamentals in Cybersecurity Fortinet 2025 — valid until September 2027
  • FortiGate 7.6 Operator Fortinet
  • NSE 1 — Certified in Cybersecurity Fortinet 2025 — valid until September 2027
  • NSE 2 — Certified in Cybersecurity Fortinet 2025 — valid until September 2027
  • NSE 3 — Certified in Cybersecurity Fortinet
  • Introduction to the Threat Landscape 3.0 Fortinet
  • Technical Introduction to Cybersecurity 2.0 Fortinet
  • CCST Cybersecurity Cisco Cisco Certified Support Technician
  • Junior Cybersecurity Analyst Career Path Cisco Networking Academy
  • Introduction to Cybersecurity Cisco Networking Academy September 2025
  • Cybersecurity Fundamentals IBM SkillsBuild September 2025
  • SecNumacadémie ANSSI — French national cybersecurity agency

Verify my badges on Credly

Education

  1. 2024 – 2026

    Master's degree in Cybersecurity Ynov Paris French RNCP 40897 qualification, “Cybersecurity Expert”, level 7 (EQF).

  2. 2021 – 2024

    Bachelor's degree in Computer Science Ynov Paris

  3. 2019 – 2020

    BTS SIO (two-year higher technical diploma, IT services) EFREI, Villejuif

  4. 2017 – 2019

    Baccalauréat STI2D (technological secondary school diploma) Lycée Eugène Hénaff, Bagnolet

Languages and mobility

Languages

  • FrenchC2
  • TamilNative language
  • EnglishB1 — British Council certification
  • JapaneseA1

Mobility

  • Based in Aulnay-sous-Bois, France
  • Open to: Luxembourg / Metz / Thionville and the border regions
  • Driving licence (EU category B)
  • Available from 29 September 2026

Contact

I am looking for a junior cybersecurity engineer or consultant position, primarily in Luxembourg, the French border area or the Metz / Thionville area. Feel free to get in touch.

Send an email LinkedIn profile GitHub repositories

lenuss@live.fr

CV available on request, by email or through LinkedIn.