Building secure systems that actually ship.
I'm a State Engineer from ENSA El Jadida, currently freelancing for SIB building production systems in both Java (Spring Boot) and Python (FastAPI) — from JWT/RBAC-enforced ERP modules serving 100+ employees to an LLM-powered CV-parsing pipeline where every model output is re-validated locally before it touches the database. I work where security meets engineering. I care about the boring parts: access control, data integrity, and what happens at 3am when something breaks.
Projects
Production systems, graduation projects, and personal builds. All shipped, all secured.
Industrial PO & Subcontracting Platform
A JWT-secured platform automating the full purchase-order and subcontractor execution lifecycle, with multi-level approval workflows and centralized access control.
Purchase orders and subcontractor flows ran on spreadsheets — no audit trail, no access control, and slow multi-level sign-off.
Built an end-to-end platform with centralized JWT-based security, a multi-level approval workflow engine, and containerized deployment.
The full order lifecycle now lives in one secured, auditable system — faster and fully traceable.
Enterprise ERP — HR & Payroll Modules
Three sensitive ERP modules — HR management, payroll automation, and time tracking — serving 100+ employees, with a real-time cost engine for project profitability and fine-grained RBAC data access control.
Sensitive HR and payroll data demanded strict, role-scoped access — and leadership needed real-time financial visibility.
Designed modular services with fine-grained RBAC at the data-access layer and a real-time cost engine feeding profitability dashboards.
Faster financial decisions with zero unauthorized data exposure across the organization.
module
module
tracking
HR-Expense
A full-stack expense & HR management app built from scratch as my graduation (PFE) project — a hardened Spring Boot (Java 22) backend with Spring Security, JWT session encryption, and strict RBAC across four user roles.
My end-of-studies project: prove I could design and harden a real internal tool, not just a prototype.
Passed every internal security audit, with role separation enforced from the filter chain down to the data layer.
Internship Request Portal — R.A.K
A centralized public-sector platform automating the full internship application workflow for a utility handling 500+ cases a year — replacing an entirely manual, paper-based process.
Internship requests were tracked on paper — lost forms, no status visibility, weeks of back-and-forth.
A single auditable queue from submission to approval and archival — handling 500+ cases without paper.
Expense.SIB Mobile
A cross-platform mobile app paired with an encrypted Spring Boot backend for secure inventory and expense management — built so field staff could work without exposing data on the device.
Faster, more accurate stock counts in the field — with encrypted sync back to the central system.
Self-hosted Infrastructure Gateway
A self-hosted Linux server on a Raspberry Pi — hardened config, reverse proxy, DNS routing, and network gateway. Practical, hands-on validation of sysadmin, networking, and security-hardening skills.
Because the best way to understand production infra is to run your own — firewall, TLS, DNS and all.