🟢 Open to work
Junior at the University of Florida, learning to apply code and security practices to finance-adjacent problems through practical externship work.
Portfolio of hands-on work, including the Hydroficient IoT Cyber Defense externship where I tested attacks and implemented defenses like TLS and mTLS.
.jpg)
Hydroficient · ✅ Verified by Extern · ⏱️ In progress
Build, hack, and defend real IoT infrastructure, then hand your security playbook to an actual company. You’ll launch realistic cyberattacks, from spoofing and replay attacks to unauthorized shutoffs, and implement defenses like TLS and mTLS.
Junior at the University of Florida, learning to apply code and security practices to finance-adjacent problems through practical externship work.
I am a junior computer science student at the University of Florida focused on finance-related tech. I have some practical experience through hands-on externship work defending IoT systems and want to build confidence applying technical skills in real-world environments.
Externships
Hydroficient IoT Cyber Defense Externship
Hydroficient
Education
University of Florida
B.S Computer Science · Class of 2027
Skills
✅ Verified by Extern · ⏱️ In progress
Build, hack, and defend real IoT infrastructure, then hand your security playbook to an actual company. You’ll launch realistic cyberattacks, from spoofing and replay attacks to unauthorized shutoffs, and implement defenses like TLS and mTLS.
The work targeted the Grand Marina hotel's IoT water system. The project inventoried assets, produced a STRIDE threat model with three prioritized findings, built tooling to parse mock sensor logs, mapped an MQTT topic hierarchy and exposure analysis, and implemented TLS/mTLS experiments measuring latency and delivery. The deliverables included a provisioning policy and replay-attack experiments
I produced a STRIDE-based threat model with three prioritized findings, Python parsing scripts for mock sensor logs, an MQTT topic map and exposure analysis, a tested TLS/mTLS pipeline with measured latency and delivery metrics, a device provisioning policy, and replay-attack experiments demonstrating that combined defenses stopped all attacks.
The module presented The Grand Marina system, I inventoried assets and mapped STRIDE threats, then produced a threat model that identified three prioritized findings: weak dashboard credentials, cloud-layer flooding risk, and unprotected device-cloud communications.
During the externship I generated realistic mock sensor logs and wrote Python code in Google Colab to parse JSON, normalize nested records with Pandas, and display sample outputs (dataframe head) for analysis.
I mapped an MQTT topic hierarchy for a hotel water system, listing sensors, commands, alerts, and status topics per zone. I analyzed what an open subscription could expose and which command topics an attacker could misuse.
A secured MQTT pipeline was tested across four experiments: eavesdropper, certificate validation, latency, and stress. I observed eavesdropping stopped with TLS, correct CA validation blocked wrong certs, measured ~0.19% latency overhead, and saw 100% delivery at target loads.
During the externship I documented a provisioning policy that specified RSA-2048 key generation, CA signing, secure installation, mTLS usage, certificate rotation (365-day life, rotate 30 days prior), revocation, and decommission steps.
The submission described a controlled test of 12 replay experiments across four defense configurations. I documented attack types, tabulated results, and recommended deploying all three protections together after finding that only the combined defenses blocked every replay.
I summarized the threat model, described four-layer defenses (mTLS, HMAC-SHA256, freshness timestamps, sequence counters), documented the three-phase attack experiments and setup commands, and reported that all simulated attacks were blocked (0 succeeded, 100% blocked).