Bin Kong

Cybersecurity • Senior • 28 years • Beijing, China • UTC+08:00 • In office, Partially remote, Fully remote • Work permits: China • English: A1 • Can start in 2 weeks • from $80k per year

Cybersecurity Engineer

7+ years exp

20+ projects

C++

Bash

Python

SQL

Java

Assembly

TypeScript

Defensive Hardening: 5/10

Detection & Incident Response: 5/10

Active 4 days ago

Invite to interview

Download CVCV

Overview

Technical skills

Projects

Timeline

Roles

Overview

Linux security engineer (senior) specializing in system-level monitoring and kernel/eBPF-based detection. The strongest proven skill is building kernel-level detection and enforcement (eBPF LSM probes and ringbuf logging) as shown in SysMon-eBPF/eBPF/upchk.bpf.c and SysMon-eBPF/eBPF/secmon.bpf.c. There is little or no public evidence of formal threat modeling, cryptography expertise, or large-scale SIEM/rule-pack integration in the available human-authored sources.

Phone

Technical skills

Languages

C++

Bash

Python

SQL

Java

Assembly

TypeScript

Databases

SQLite

MySQL

MariaDB

DevOps

Linux

CentOS Stream

Jenkins

Other

Gemini

ChatGPT

OpenSSH

eBPF

GitHub

AppSec

CVE

Crypto++

HarmonyOS

OpenAI Codex

Red Hat

Ubuntu

Wireshark

DevOps

Debian

AIOps

Projects

QtPinYin

Provided and embedded a Qt-based Pinyin engine component into a security tool to keep user input responsive under elevated (root) runtime constraints. The CV indicates the component is sourced from an open GitHub repository and used to solve input-method permission isolation issues. The integration enabled smooth UI interaction in a privileged environment.

CAdapt

Open-source repository published by the candidate; the provided CV content does not specify its exact purpose. The candidate referenced this repository via a public GitHub link. No further project scope, features, or outcomes are described in the supplied text.

libarchive Cross-compilation State Leak Fix (PR #3049)

Open-source contribution to libarchive addressing a cross-compilation issue related to global state leakage. Provided a fix submitted as an upstream pull request for main-branch integration. Targeted build-time correctness to prevent incorrect state persistence across compilation steps.

dae eBPF Patch (PR #986)

Open-source contribution to the dae project, delivering fixes addressing debug/compatibility issues and avoiding improper eBPF CO-RE usage patterns. The patch was proposed for upstream inclusion and subsequently integrated into the main branch release. The work included code review-level analysis tied to toolchain and debug-information compatibility.

GLIBC Version Adaptation Tool

A supporting open-source tool published alongside source-level GLIBC 2.35 override and upgrade work on CentOS 7. Focused on helping adapt GLIBC versions during local builds/installation to unblock development environment issues. Used as part of troubleshooting and iterative upgrades for dependent tooling behavior.

Timeline

Senior Systems Developer • Senior

Beijing Chenxin Lingchuang Information Technology Co., Ltd. • Full-Time

May 2021 to Present 5 Years 5 Months Beijing In office

Developed and maintained main-protection kernel drivers and related upper-layer services for endpoint antivirus use cases. Built and migrated cross-compilation packaging environments across multiple OS versions and CPU architectures, and implemented system monitoring/anti-ransom capabilities using kernel tracing and hot-patching research outcomes. Led performance tuning and multi-platform compatibility work, including porting the antivirus to HarmonyOS environments.

C++

eBPF

Linux

Security Systems Developer • Middle

Beijing Zhongan Xingkun Technology Co., Ltd. • Full-Time

Jul 2019 to May 2021 1 Year 10 Months Beijing In office

Worked on development and release/maintenance of domestically oriented security tools, including trace elimination and identity/file protection systems. Built new project work items, assisted with database checking tool environments, and supported UI integration for security products. Took ownership of a USBKey-based dual-factor authentication and encrypted file vault system using Linux PAM and LUKS workflows, including core logic and multi-client Qt interfaces.

C++

MySQL

MariaDB

Linux

Southern New Hampshire University

Bachelor's Degree • Computer Science

Manchester, New Hampshire

Northeast Normal University

Associate's Degree

Changchun, Jilin

Senior Security Engineer Confidence: Medium Detection Engineer

Vulnerability Analysis

3/10

Finding security weaknesses

Contains vulnerability PoC and explanatory README for Dirty COW, but the work is primarily demonstration code without a full root-cause exploitability analysis, affected-version matrix, or mitigation/regression tests.

Evidence

CVE-2016-5195/README.md

CVE-2016-5195/dirtycow_file_payload.c

Cryptography & Secure Protocols

Using encryption correctly

Not evidenced in public code

Offensive Security / Pentesting

2/10

Testing by attacking

Includes working Dirty COW exploit/demo code and test scripts, which are offensive artifacts, but they are PoC/demo-level content without deeper original exploit chaining, universality analysis, or coordinated responsible-disclosure materials.

Evidence

CVE-2016-5195/dirtycow_demo.c

CVE-2016-5195/runtest.sh

CVE-2016-5195/dirtycow_file_payload.c

Defensive Hardening

5/10

Making systems harder to break

Clear defensive engineering at kernel level: eBPF LSM hooks, per-PID baseline maps, blocking on LPE detection, and ptrace-based syscall monitoring demonstrate practical defensive hardening and runtime enforcement.

Evidence

SysMon-eBPF/eBPF/upchk.bpf.c

SysMon-eBPF/eBPF/secmon.bpf.c

SysMon-ptrace/kernel/monitorprocs/procmain.c

Detection & Incident Response

5/10

Spotting and handling attacks

Strong detection-focused artifacts: custom eBPF LSM probes, ringbuf events for exec logging, and baseline tracking for detection of privilege escalations indicate real detection engineering capability, though there is limited FP/FN analysis or SIEM integration shown.

Evidence

SysMon-eBPF/eBPF/secmon.bpf.c

SysMon-eBPF/eBPF/upchk.bpf.c

SysMon-eBPF/eBPF/secmon.h

Compliance & Threat Modeling

Planning against threats

Not evidenced in public code

Expertise

Application Security• Senior

Industries

Cybersecurity• Senior

Technologies

AppSec

Wireshark

CVE

Recommendations

Develop kernel/eBPF-based detection rules and lightweight LSM-based enforcement modules for endpoint protection and integrate their event streams into a SIEM or aggregator.
Build and harden runtime monitoring agents around ptrace and eBPF for suspicious syscall and privilege-escalation detection, with clear FP/FN test cases and regression tests.
Create documented detection test harnesses and labeled datasets (positive/negative examples) to validate and tune eBPF detection heuristics and to produce reproducible alerts for SOC use.
Convert demo PoCs into safe, instrumented research artifacts (sandboxed tests, reproducible baselines) and add responsible-disclosure notes and mitigation guidance when publishing exploit analyses.

Repositories

The developer's experience in this domain has been verified based on AI analysis of the following repositories:

SysMon-ptrace SysMon-eBPF CVE-2016-5195

Middle Embedded Engineer Confidence: High Driver & BSP Engineer

Low-level Linux systems engineer at a competent middle level specializing in ELF and kernel-facing tooling. The strongest proven skill is robust ELF parsing and binary adaptation with thorough validation and regression tests, demonstrated by ElfPtrs.cpp, OperGlibc.cpp and the comprehensive Python regression suites. There is little public evidence of embedded MCU firmware, real-time WCET analysis, HDL work, or production on-device HIL/OTA infrastructure.

Embedded & Firmware

1/10

Low-level device code

Minimal embedded/firmware artifacts; work is Linux userspace and kernel-facing tooling rather than MCU firmware. There is some register-level reasoning for ptrace but no firmware/RTOS/device sleep/power management evidence.

Evidence

KongQBin/SysMon-ptrace/init/init.c:getRegsOffset KongQBin/SysMon-ptrace/kernel/monitorprocs/procmain.c:onProcessTask

Hardware-Software Interface

4/10

Connecting code to hardware

Strong low-level OS interface work: careful ELF/section/version parsing and modification, and ptrace-based syscall monitoring show solid binary and kernel interface engineering. There is explicit validation and repair logic for ELF version tables and kmod metadata rather than simple vendor-library calls.

Evidence

KongQBin/CAdapt/common/ElfPtrs.cpp:initPtrs/validateTables (ELF parsing, mmap/msync, table validation) KongQBin/CAdapt/OperGlibc.cpp:initGlibcInfo and adaptedTargetElfFileGlibcVersion (version mapping and patching) KongQBin/CAdapt/kmod/ExistingModInfo.cpp (kernel module __versions/vermagic handling)

Resource Constraints

2/10

Working with limited resources

Some resource-aware decisions around mmap/msync and guarded file-size checks exist, but there is no explicit linker-script placement, measured RAM/flash budgeting, or packed-struct space-optimizations with quantification.

Evidence

KongQBin/CAdapt/common/ElfPtrs.cpp:flush and initPtrs (mmap, msync, file size and bounds checks) KongQBin/CAdapt/tests/elf_validation_regression.py:module.ko large_bss case (test for large BSS handling)

Real-time & Timing

2/10

Precise timing control

Code handles timing primitives (waitpid/wait4, signal handlers, usleep) and ptrace sequencing but relies on delay loops/usleep and wait-based logic rather than documented WCET or timer-driven real-time design. Some delay-driven patterns reduce strength against real-time scoring.

Evidence

KongQBin/SysMon-ptrace/init/init.c:getRegsOffset (usleep loops and PTRACE_SEIZE/ATTACH sequencing) KongQBin/SysMon-ptrace/kernel/monitorprocs/procmain.c:MonProcMain (wait4 loop, signal handlers, ptrace syscall wakeup handling)

HDL & Circuit Logic

Designing digital circuits

Not evidenced in public code

Reliability & On-device Testing

4/10

Testing on real hardware

Good reliability and test coverage for the ELF tooling: explicit input validation, defensive parsing, and multiple regression tests simulate malformed inputs and end-to-end glibc adaptation scenarios. Some watchdog/OTA style on-device reliability features are not present but CI-style tests and defensive code are strong.

Evidence

KongQBin/CAdapt/tests/glibc_regression.py (extensive end-to-end regression tests) KongQBin/CAdapt/tests/elf_validation_regression.py (many malformed-ELF test cases) KongQBin/CAdapt/common/ElfPtrs.cpp:validateVersions / reject (defensive validation and error reporting)

Verified artifacts

daeuniverse/dae• ★ 6.3K libarchive/libarchive• ★ 3.6K

Expertise

Low-level Development & Tooling• Middle

Peripheral Interfaces & Drivers• Middle

Industries

Cybersecurity• Middle

Recommendations

Develop low-level Linux tooling and security agents that require syscall tracing and ELF/kmod manipulation such as EDR components or compatibility shims.
Own binary compatibility tooling and cross-arch backport utilities that patch ELF versioning and module metadata, leveraging the existing ElfPtrs and OperGlibc code.
Implement hardened CI fuzzing and malformed-ELF test harnesses to expand coverage and reduce risk when modifying binary metadata.
Contribute kernel-integrated drivers or small kmods only when paired with explicit kernel ABI testing; avoid MCU firmware or real-time embedded work until dedicated real-time design evidence exists.

Repositories

The developer's experience in this domain has been verified based on AI analysis of the following repositories:

SysMon-ptrace CAdapt CrossToolchain-GCC

Intern DevOps Engineer Confidence: Low Generalist

A systems-focused junior engineer with hands-on experience in low-level Linux and build/toolchain work and a strength in kernel-level and toolchain fixes. The strongest proven skill is low-level Linux/kernel engineering and build-system reliability, evidenced by merged low-level eBPF loader fixes and CMake build fixes. There is no public evidence of mature CI/CD pipelines, Kubernetes/GitOps deployments, IaC modules or observability SLO/alerting definitions in the analyzed human-authored files.

CI/CD Pipelines

Automated build and deploy

Not evidenced in public code

Infrastructure as Code

Managing servers with code

Not evidenced in public code

Containerization & Orchestration

Working with containers

Not evidenced in public code

Observability & Monitoring

Watching system health

Not evidenced in public code

Reliability & Incident Response

Keeping systems up

Not evidenced in public code

Cloud & Cost Optimization

Smart use of the cloud

Not evidenced in public code

Industries

Software• Intern

Technologies

DevOps

Recommendations

Assign to kernel-adjacent tasks such as eBPF program loading, build-system fixes and cross-toolchain packaging where low-level Linux and C/C++ build experience is required.
Have the developer own cross-compilation toolchain maintenance and packaging workflows, including deterministic builds and release packaging.
Pair with a senior SRE or platform engineer to expand skills into CI/CD pipeline engineering, automated infra tests and observability-as-code practices.

Repositories

The developer's experience in this domain has been verified based on AI analysis of the following repositories:

CrossToolchain-GCC KongQBin CrossToolchain-QT