David Imolai
Security engineering · Python, Linux and application security
I build penetration-testing tooling and work on authentication, verified software updates and Linux (NixOS) deployments. My background combines LLM-agent research, application development and cybersecurity competitions.
Work experience
Research Fellow
Building LLM-based agents for autonomous penetration testing at ELTE's AI Research Group, with a focus on Python agent infrastructure, CTF benchmarks and containerised tool execution.
- Implemented substantial parts of HackSynth in Python, connecting command planning, tool execution and observation summarisation into an autonomous penetration-testing loop.
- Developed and validated the PicoCTF and OverTheWire benchmark integrations for HackSynth's 200-challenge evaluation suite: 120 PicoCTF and 80 OverTheWire tasks.
- Designed and optimised the Docker attackbox setup, including tool installation, container lifecycle management and connectivity to challenge environments.
- Presented research at student conferences and, with my research partner, at the LLAIS workshop within ECAI 2025 in Bologna, explaining the systems and findings to an international audience.
Publications
- Worked on crypto benchmark preparation and validation, and LLM infrastructure design and implementation.
- Designed and implemented large parts of the autonomous penetration-testing agent in python.
Projects
A cooking assistant with a Kotlin/Spring backend, Python AI services, and a deployment and observability stack built for a TUM DevOps course.
- Implemented the Kotlin/Spring API, user authentication, recipe storage and endpoint tests.
- Built container and CI/CD workflows and declarative Kubernetes deployment manifests.
- Added Prometheus metrics, Grafana dashboards, Alloy/Loki logs and Tempo tracing across services.
A Fabric mod connecting our Wynncraft guild to Discord, with account verification, guild-management tools, verified updates and a NixOS-hosted backend.
- Implemented JAR attestation verification and maintained automated GitHub/Modrinth releases and JUnit tests.
- Added WebAuthn passkey login and PKCE support to the guild's Next.js web application.
- Maintained a NixOS deployment with Podman services, PostgreSQL, reverse proxying, encrypted secrets and scheduled database backups.
- Act as the community's primary contact for infrastructure failures, diagnosing problems and restoring services when something breaks.
Leadership
Captain of the Hungarian CyberSecurity Team, coordinating communication and cooperation among players, coordinating with coaches and watchdogs, while continuing to solve challenges, manage infrastructure, etc. Representing Hungary at ECSC every year since 2022, and captaining the team since 2024.
Competitions
4th of 54 competitors in the senior category; 13th of 172 overall. The individual competition ran on 23–26 April.
Represented Hungary as team captain for the third consecutive year. We finished 15th among the competing countries excluding guest teams, and 17th overall out of 42 teams. The competition combined jeopardy challenges with an attack/defence round, where teams had to keep their own services running while exploiting the others'.
Conferences and research awards
First place in the Cybersecurity session of the Informatics section, jointly with Lajos Muzsai, for HackSynth. Supervised by András Lukács; presented at BME during the 23–25 April conference.
Education
BSc in Computer Science
- Member of the John von Neumann Honors Program, a selective program for high-achieving students in computer science and mathematics.
- Erasmus+ exchange at the Technical University of Munich, April–September 2026, studying in an international environment and using German in everyday university life.
- Extended my security studies at TUM with rootkits and hardware security, alongside DevOps and scientific writing.
Skills
- Penetration Testing
- Authentication and Session Management
- Release Signing and Attestation Verification
- Linux
- Network Engineering
- Automated Testing
- Static Analysis and Type Checking
- Large Language Models
- Docker and Docker Compose
- Kubernetes
- Observability
Programming and markup
- Python
- Java
- Nix
- C
- Bash and Shell Scripting
Languages
- Hungarian (Native)
- English (C2)
- German (C1)