// software engineer · vancouver, bc

MARKDE GUZMAN

I build identity & access management systems at Global Relay. On the side, I write network security tools in C and Python, from covert channels to supply-chain attack detection.

~/vancouver $ scroll to explore ▍

01 About

I'm a backend software engineer on the Identity & Access Management team at Global Relay, where I build C#/.NET services backed by Kafka, Aerospike, and PostgreSQL, deployed to Kubernetes through Jenkins.

I'm most at home below the UI: backend services, infrastructure, and systems. I care about how services talk to each other, how data stays consistent as it moves between them, and what happens when a part of the system fails. On my own that's meant a distributed password cracker in C that splits work across machines and recovers from crashed nodes, raw-socket networking tools, and a crawler pipeline that maps the npm dependency graph into Neo4j.

At BCIT I studied mainly in two areas: Web & Mobile and Network Security. That's where the C, sockets, and protocol work comes from, and why security shows up in a lot of what I build.

Before Global Relay I interned at Dayforce and PUMA Utility Monitoring, mostly on C#/.NET backends, REST APIs, and SQL Server, plus React frontends and test automation.

interests: cybersecurity news · basketball · hiking · travelling · reading

02 Experience

  1. Software Engineer, Identity & Access Management

    May 2026 — Present

    Global Relay · Vancouver, BC

    • Eliminated a CVSS 7.0+ vulnerability from a dependency scan by migrating a service from .NET 8 to .NET 10 and swapping AutoMapper for Mapster.
    • Replaced constant API polling with a Kafka-based sync that streams changes to a downstream team from a single source of truth.
    • Cut validation traffic from 2 calls per keystroke to 1 per typing pause by debouncing requests.
    C#/.NETKafkaAerospike PostgreSQLKubernetesJenkins

  2. Full-Stack Developer Intern

    May 2025 — Aug 2025

    PUMA Utility Monitoring · Vancouver, BC

    • Cut production client-group records by 36% and improved data integrity by auditing SQL Server and removing stale, superseded, and duplicate groups.
    • Cut report generation time by 30% with a Python + Selenium pipeline, handed off as an automated test in Azure DevOps.
    .NETJavaScriptSQL Server PythonSelenium

  3. Software Engineer Intern

    May 2024 — Apr 2025

    Dayforce · Toronto, ON

    • Extended a cross-team data-import feature in C#/.NET and built new internal REST API routes for it.
    • Sped up automated testing and cut QA overhead by adding 60+ test IDs across React micro-frontends.
    C#/.NETReactDojo

  4. Software Engineer Intern

    Jan 2023 — Aug 2023

    Ceridian · Toronto, ON

    • Set the team's unit-testing standard by designing its Jest architecture, which grew from 110 tests to 1,000+.
    • Built a multi-page benefits-selection cart and navigation flow in React, TypeScript, and Sass.
    ReactTypeScriptSassJest

03 Skills

Backend

C#/.NET · Node.js · Express · REST API design · service migrations & dependency upgrades

Distributed & Event-Driven

Kafka event streaming · work partitioning & scheduling · checkpointing & failure recovery · coordinator/worker design

Infrastructure & DevOps

Docker · Kubernetes · Jenkins CI/CD · Azure DevOps · Linux · Git

Systems & Networking

C · POSIX threads · TCP/IP · UDP · raw & multicast sockets · IPv4/IPv6 · custom wire protocols

Data

PostgreSQL · SQL Server · Aerospike · Redis · MySQL · MongoDB · Neo4j · Prisma

Languages

C# · C · Python · Java · TypeScript · JavaScript · SQL

Security

IDS/IPS & firewall config · packet analysis (Wireshark, tcpdump) · network forensics · reverse engineering · AES/RSA · SSL/TLS

Frontend & Other

React · Next.js · Tailwind · Sass · MUI · Firebase · PyTorch Geometric

Security research

KNOCC

Knock-based Network Operations over Covert Channels

A backdoor simulation that hides its traffic inside UDP header fields — plus a write-up of how defenders catch it.

Pythonraw UDPcovert channelsdetection
View on GitHub

How it works

  • The victim opens no listening port — it stays silent until it sees a configured port-knock sequence.
  • All data rides in the UDP length and checksum fields, not the payload; a go-back-N layer keeps the few-bytes-per-packet transfers ordered.
  • Supports remote execution, two-way file transfer, file/dir watching, evdev keylogging, process renaming, and self-uninstall.

Detection & defence

  • Bulk-modified headers yield malformed packets a tuned IDS/firewall will flag.
  • A renamed process is unmasked by cross-checking /proc (comm, cmdline, exe), which a disguise rarely keeps consistent.

Offensive security research — run only in isolated labs on systems you own or are authorized to test.

Distributed systems

CHASM

Cracking Hashes Across Scattered Machines

A coordinator/worker system in C. One server partitions a crypt(3) search space into blocks, hands them out to clients on many machines, and takes back the work of any client that dies mid-block.

CTCPPOSIX threadswork partitioningcheckpointingfault tolerance
View on GitHub

Coordination & partitioning

  • Every candidate over a 79-character alphabet has an index, odometer style. The server stores no wordlist and computes any block's start word on demand with base-79 arithmetic.
  • The server runs one thread per connected client and hands out fixed-size blocks (e.g. 1M candidates) as clients ask for work.
  • Nodes talk over a plain-text, pipe-delimited TCP protocol: start, a word|len|checkpoint|hash assignment, progress checkpoints, and found_password.
  • Inside each client, worker threads pull from a shared, mutex-guarded odometer, each with its own crypt_r state so they never contend on crypt's static buffer.

Failure recovery

  • Clients checkpoint every N attempts (current_word|attempts_done), so the server always knows how far each block got.
  • A client that disconnects or misses its --timeout is treated as dead. The server computes the unfinished remainder from its last checkpoint and queues it on a list of reclaimed work.
  • Reclaimed ranges go to the next client that asks for work. No candidate is skipped, and at most one checkpoint interval is re-hashed.

Offensive security research — run only in isolated labs on systems you own or are authorized to test.

Machine learning · Jan 2025

Sentinel

GNN-based npm supply-chain attack detection

A graph neural network that flags malicious npm packages by looking at the whole dependency network.

PythonPyTorch GeometricNeo4jRedis
View on GitHub

How it works

  • Crawlers walk the npm registry into Neo4j (Redis caches visited nodes); packages become nodes, dependencies become edges.
  • Each node carries 41 features — install scripts, maintainers, downloads, naming patterns, and dependency relationships.
  • A 2-layer graph convolutional network with skip connections is trained and scored on unseen data by precision, recall, and F1.

Making it real

  • Real malicious samples are scarce, so it simulates maintainer-compromise, dependency-injection, and script-injection attacks to generate training data.
  • A monitor polls dependency trees and re-scans every changed package, with an interactive CLI and a pytest suite.
Steganography · cryptography

SHADE

Steganographic Hiding with AES-Driven Encryption

Hides any file inside a PNG, encrypted, so the image looks unchanged and gives nothing away without the key.

PythonFernetAES-128HMAC-SHA256
View on GitHub

How it works

  • Payload and filename are each encrypted with Fernet (AES-128-CBC + HMAC-SHA256).
  • A bitstream — two 32-bit length headers, filename, payload — is written into the least-significant bit of each pixel's blue channel.
  • A wrong key or tampered payload fails the HMAC check instead of producing garbage.

Numbers & testing

  • ~190 KB of plaintext fits in a 1920×1080 image.
  • Byte-for-byte recovery verified across solid-colour and high-detail covers, plus bad flags, malformed keys, and oversized payloads.
Browser security · Jan 2025

CoDefend

Pre-download malware scanning

A Chrome extension that scans downloads across several antivirus engines before the download completes.

JavaScriptChrome ExtensionsNode.jsExpress
View on GitHub

How it works

  • The extension intercepts Chrome downloads and hands each file to a Node server.
  • The server fans files out to VirusTotal, Cloudmersive, and Bytescale, so detection never rests on one engine.
  • On-click URL reputation checks warn users before a malicious site loads; API keys stay server-side.

See it

  • Demo video and four screenshots — website warning, intercepted download, clean scan, viruses found — are in the repo.
Watch the demo

04 More projects

Melloww

Melloww Mar 2024

Mental-health journaling app with mood tracking, AI encouragement, and a public support feed. Led a team of 5 and set up the Express, MongoDB, and Next.js architecture.

Next.jsTypeScriptExpressMongoDB
NoteTed

NoteTed Sept 2022

Mobile-first note-taking app with Firebase auth and per-user notes synced across devices, deployed on Vercel.

Next.jsReactMUIFirebase

ALNS Nov 2023

Advanced Lossy Network Simulator — real-time sim over IPv4/IPv6 with live-adjustable packet loss and delay, visualising acknowledgement handling on a Matplotlib dashboard.

PythonTkinterMatplotlib

EngineerInTech

Matches engineers by the skills they want to teach and learn.

TypeScriptNode

05 Education & Leadership

BCIT — BSc, Applied Computer Science

Network Security Applications Development · Burnaby, BC · Graduated Apr 2026

Network Security Administration Secure Sockets & SSL/TLS Covert Channels, Rootkits & Malware Analysis Reverse Engineering Cryptology Network Forensics Computer Networks & Protocols

Vice President — BCIT Coding4All Tech Club

Aug 2022 — Dec 2022

  • Led biweekly web-dev and data-structures workshops with live coding for 30+ students.
  • Co-organized midterm and final review sessions for 40+ students — practice sets, logistics, and Q&A.

Let's build something.

Open to conversations about security, backend, and identity.

Email GitHub LinkedIn

markdeguzman.com · Vancouver, BC