SecFall EN FR

Ce site existe aussi en français.

Lire en français →

Paris, France

Cheikh Tidiane Fall

I break systems with permission, then write down what worked.

I’m a cybersecurity student at Epitech in Paris. I build software, then try to break it: penetration testing, application security, and the tools that make both easier.

Looking for a 4–6 month internship in penetration testing or application security from late March 2027, then a work-study placement from September 2027.

Download CV

Selected work

  1. Keter

    1st prize

    A way for investors to prove they’re allowed to trade a regulated token without revealing who they are. Team of four: I built the app and connected it to the blockchain; a teammate wrote the cryptography. Afterwards I went back through the code and wrote down where it breaks.

  2. AYZE

    A lending market on the XRP Ledger where you can see who pays when a loan goes bad. Team of three, built at a hackathon: I did the credentials that let protection sellers guarantee loans, the wallet logins, the dashboard, the tests and a scripted run of the whole thing on the test network.

  3. Juice Shop wallet exploit

    A teammate and I drained the crypto wallet in OWASP’s deliberately vulnerable shop, then wrote it up like a real report: how we found it, what it would cost a business, how to fix it.

  4. Juice Shop write-ups

    Web attacks against the same training shop, each one written up with screenshots so someone else can follow and reproduce it.

  5. REDTEXT

    An open-source tool that drafts phishing and phone-scam scenarios for authorized security tests, tailored to the sector being tested.

  6. gvm-blackarch

    Every OpenVAS tutorial assumes Kali. I use BlackArch, where the vulnerability scanner wouldn’t even install, so I wrote the setup scripts and documented every fix.

  7. ChainBreak

    The hacking-practice platform I work on for PoC Innovation’s workshops: isolated terminals, challenges, flags checked on the server.

    Not public

Also built

  • Radegast — a stock-trading app with privacy-preserving proofs, built at ETHGlobal
  • SAMPO — a job-offer aggregator, my Epitech year-end project
  • GitHub ↗

Experience

  1. Apr 2026 – now

    Head of Cybersecurity Events

    PoC Innovation, a student association · Paris

    I design and run hands-on attack and defense workshops, and coach people through them on the day.

    I work on ChainBreak, the platform those workshops run on.

  2. Summer 2026

    Application Security Intern

    Bank of Africa · France

    I tested the bank’s web applications and APIs for vulnerabilities, reproduced what I found, and wrote reports that told the teams how to fix it. Some of it was critical.

  3. Jan – Jun 2026

    Lead Security Engineer

    A SaaS startup · Paris

    I was responsible for the security of the company’s live platform: who could access what, how data was protected, and fixing vulnerabilities as they came up.

  4. 2024 – Apr 2026

    AI model evaluator

    Outlier, then Alignerr · Remote

    I graded what AI models wrote and explained why each answer was right or wrong. It taught me to say exactly what’s wrong, and nothing more.

  5. 2020 – 2025

    Server administrator

    Scarlet-Community, a game-server network · Senegal, remote

    At fifteen I was given root on a production server and one job: don’t let it fall over. I stayed five years, wrote the anti-cheat, led the moderators, and learned what backups are for the hard way.

Education

Bachelor’s in Cybersecurity

Epitech · Paris · 2025 – 2028

Penetration testing, application security, threat modeling, incident response.

Skills

Attack
Web and API penetration testing, social engineering
Defend
Hardening, access control, detection
Build
Python, TypeScript, Bash, C, Solidity
Speak
French and English

About

Me at five months old, sitting next to an open laptop.
Me at five months, next to an open laptop. Benin, 2005.

I was born in Benin, grew up in Senegal, and moved to Paris at eighteen.

I got into this through a game server. At fifteen I was helping run Scarlet-Community, and that meant real users, real outages, and people actively trying to cheat. Five years of that taught me that production is a different machine from the one you tested on, and that the thing you didn’t back up is the thing that breaks.

That’s why I moved into security on purpose. I like building things, and I like finding out how they fail even more. Most of my projects are both: I make something, then I attack it, then I write down what I found so the next person doesn’t have to.

The writing part matters to me. Grading AI answers for a living taught me to say exactly what’s wrong and nothing more, and that’s what I try to put in every security report.

Off the screen

  • Combat sports

    Judo and taekwondo, with calisthenics on the off days.

  • Golf

    Now and then.

  • Art

    Neo-expressionist painting, mostly Basquiat and Baselitz. Favourite: Basquiat’s In This Case (1983).

Corrections

Things I used to believe, crossed out rather than hidden.

  1. compliance equals secure code compliance is evidence, not a guarantee

    Regulations describe what an auditor needs to see, not what an attacker will look for. Building a compliance system for Keter made that obvious: passing the checklist was the floor, not the ceiling.

  2. if it works in dev, it works in prod production has different users

    On the game server, code that passed every test broke the first time a real player tried something nobody had thought of. After enough of those incidents, I stopped using testing to confirm I was right and started using it to try to prove I was wrong.

  3. I’ll remember it, no need to write it down write it down for yourself in three weeks

    I once skipped writing up an audit because it was all in my head. Three weeks later a partner asked which parts of the app I had covered, and it wasn’t in my head anymore.

Get in touch

For an internship, a security project, or just to talk. I usually reply within a few days.