Christopher Cerne

Security Engineer in Meta's Applied AI (AAI) / Agent Data Optimization (ADO) organization, focused on generating high-quality cybersecurity training data for LLMs. Previously on Red Team X, Meta's former offensive security research team.

At Stratum Security, I provided staff augmentation for a major company, conducting security reviews of high-traffic, externally facing applications. Through manual code reviews, dynamic testing, and threat modeling, my work played a critical role in safeguarding the privacy and security of millions of users worldwide.

I helped Fortune 500 companies secure their networks by performing penetration tests and security reviews of internal and external applications.

I independently identified and gained recognition for finding vulnerabilities in web applications and embedded devices. I wrote comprehensive bug reports and notified vendors under a 120-day disclosure policy. I am credited with finding CVE-2020-8797, CVE-2020-8798, CVE-2020-12123, CVE-2020-12124, CVE-2020-12125, CVE-2020-12126, and CVE-2020-12127. I engaged as a member of the prestigious Synack Red Team (SRT) and contributed to the Google Vulnerability Reward Program (VRP), successfully identifying and responsibly disclosing high-risk vulnerabilities.

In the first summer, I researched and found security vulnerabilities in various commonplace embedded devices and developed tooling to exploit those vulnerabilities. In the second summer, I gained experience with JavaScriptCore and V8 vulnerability research and worked with a team to find high-impact bugs.

I evaluated the security of devices on the Virginia Tech network. I developed tooling to facilitate embedded device research. I found numerous high-impact vulnerabilities, notified impacted departments, and worked with them to mitigate the issue.

I worked under the Virginia Tech Computer Science Department, fulfilling 10 hours a week as an undergraduate TA, and helped students in one of the most challenging courses in the CS curriculum, Computer Systems. I learned how to isolate bugs in student code and effectively teach systems-level concepts. I became an expert in debugging in GDB and programming in low-level C.

In the first summer, I worked on a team to develop a mobile application from scratch. In the second summer, I led a team creating embedded systems to collect data.

Vice President of the Cyber Security Club (2020–2021). Webmaster of the VPI Cave Club (2019–2021). Brother of the Theta Tau professional fraternity.

eLearnSecurity. I passed the eJPT certification exam with a score of 95%.

I organized events for the Cyber Security Club at Virginia Tech. I gave technical presentations, including a presentation on attacking embedded devices. I helped the club fundraise by acquiring sponsorships.

I singlehandedly represented Virginia Tech in the University of Nebraska's Andor Assembly Programming Competition. The competition focused on x86, ARM, and RISC assembly.

I won $500 from the Institute of Electrical and Electronics Engineers (IEEE) for developing a prototype of a smartphone with interchangeable parts. I gained experience in embedded device programming and hardware interfaces such as I2C or SPI.

United States Cybersecurity Magazine.