Building secure systems that actually ship.
I'm a State Engineer from ENSA El Jadida, currently freelancing for SIB building production systems in both Java (Spring Boot) and Python (FastAPI) — from JWT/RBAC-enforced ERP modules serving 100+ employees to an LLM-powered CV-parsing pipeline where every model output is re-validated locally before it touches the database. I work where security meets engineering. I care about the boring parts: access control, data integrity, and what happens at 3am when something breaks.
Projects
Production systems, graduation projects, and personal builds. All shipped, all secured.
Industrial PO & Subcontracting Platform
A JWT-secured platform automating the full purchase-order and subcontractor execution lifecycle, with multi-level approval workflows and centralized access control.
Purchase orders and subcontractor flows ran on spreadsheets — no audit trail, no access control, and slow multi-level sign-off.
Built an end-to-end platform with centralized JWT-based security, a multi-level approval workflow engine, and containerized deployment.
The full order lifecycle now lives in one secured, auditable system — faster and fully traceable.
Internal HR Assistant — RAG over a Private Corpus
A retrieval-augmented assistant answering employee questions over a private HR corpus — permission filtering applied before similarity is ever computed, and explicit refusal when the corpus cannot support an answer.
HR answered the same policy questions every week while the answers sat in documents nobody could search. Any assistant over that corpus risks the opposite failure: surfacing a salary or a contract clause to the wrong employee.
Hybrid retrieval — BAAI/bge-m3 embeddings with a tuned relevance floor, plus a lexical rescue path for exact HR terms that vectors miss. Access rights are a SQL predicate applied before scoring, so a forbidden chunk is never ranked. Embeddings run in a dedicated sidecar because the 2–3 GB model would not fit the production VPS.
Answers stay grounded in the corpus, and questions it cannot cover are logged into a weekly gap digest that drives what gets documented next. Rolled out to a pilot group before general access.
bge-m3 ≥ 0.55
rescue path
→ gap digest
Enterprise ERP — HR & Payroll Modules
Three sensitive ERP modules — HR management, payroll automation, and time tracking — serving 100+ employees, with a real-time cost engine for project profitability and fine-grained RBAC data access control.
Sensitive HR and payroll data demanded strict, role-scoped access — and leadership needed real-time financial visibility.
Designed modular services with fine-grained RBAC at the data-access layer and a real-time cost engine feeding profitability dashboards.
Faster financial decisions with zero unauthorized data exposure across the organization.
module
module
tracking
HR-Expense
A full-stack expense & HR management app built from scratch as my graduation (PFE) project — a hardened Spring Boot (Java 22) backend with Spring Security, JWT session encryption, and strict RBAC across four user roles.
My end-of-studies project: prove I could design and harden a real internal tool, not just a prototype.
Passed every internal security audit, with role separation enforced from the filter chain down to the data layer.
Internship Request Portal — R.A.K
A centralized public-sector platform automating the full internship application workflow for a utility handling 500+ cases a year — replacing an entirely manual, paper-based process.
Internship requests were tracked on paper — lost forms, no status visibility, weeks of back-and-forth.
A single auditable queue from submission to approval and archival — handling 500+ cases without paper.
Expense.SIB Mobile
A cross-platform mobile app paired with an encrypted Spring Boot backend for secure inventory and expense management — built so field staff could work without exposing data on the device.
Faster, more accurate stock counts in the field — with encrypted sync back to the central system.
Self-hosted Infrastructure Gateway
A self-hosted Linux server on a Raspberry Pi — hardened config, reverse proxy, DNS routing, and network gateway. Practical, hands-on validation of sysadmin, networking, and security-hardening skills.
Because the best way to understand production infra is to run your own — firewall, TLS, DNS and all.