─── Shenkar — class of 2026 · Haifa, IL ───
[ ROLE ]Software Engineer |
[ FOCUS ]Cyber · Full-stack · Backend |
[ BASED ]Haifa, Israel |
[ STATUS ]Open to intern & new-grad roles |
Final-year Software Engineering student at Shenkar. My capstone is NavSight — a C++ visual-inertial odometry engine that navigates an Android phone when GPS is gone. Before that: XPlanner, a shift-and-payroll system accountants use in the field, and B.H Nur, ops software for a family construction business.
Most of my work sits between the web and low-level systems — Android + C++ over JNI, AWS serverless pipelines, network attack-and-defense labs in Scapy. The software I care about is the kind you measure in months of uptime, not demos.
[ GRADUATING ]Jul 2026 |
[ REPOS ]29+ |
[ LANGUAGES ]AR · HE · EN |
[ IN PRODUCTION ]3 systems |
[ VOLUNTEER ]Bank Hapoalim |
[ AWARD ]1st — UX Challenge |
[ AVAILABILITY ]Graduating July 2026 · Open to intern and new-grad roles — cyber, full-stack, backend
11 projects · 2024 — 2026
01 NavSight — GPS-denied navigation for Android · In Progress · 2026
Android navigation that keeps tracking position when GPS drops — using only the camera and the phone's inertial sensors. A C++ visual-inertial odometry engine (MSCKF/EKF) tracks KLT optical-flow features, preintegrates IMU between frames, and applies zero-velocity updates to hold a live 6-DOF trajectory with drift correction.
| Attribute | Details |
|---|---|
| Stack | C++ · Kotlin · Jetpack Compose · OpenCV · Android NDK · JNI · CMake |
| Scale | Full pipeline: native sensor-fusion engine → JNI bridge → turn-by-turn UI |
| Performance | Real-time on-device pose estimation; zero-velocity updates suppress drift over long runs |
| Security | Fully on-device — no GPS dependency, no location data leaves the phone |
| Impact | Jetpack Compose UI with route snapping, AR direction overlay on the camera feed, live tracking-quality feedback, and GPX export; core C++ modules covered by unit tests |
| Repository | github.com/morad-z |
The hardest problem I've worked on: state estimation where every sensor lies a little, and the filter has to find the truth between them.
02 XPlanner — Worker shift & payroll system used by real accountants · Production · 2025
Desktop app managing shifts, payroll, and labor compliance — with a constraint engine enforcing real labor law (55-hour weekly cap, night-shift fatigue rules).
| Attribute | Details |
|---|---|
| Stack | TypeScript · React · Node.js · MongoDB · Electron · Jest · Vitest |
| Scale | Real-time multi-client sync via MongoDB Change Streams |
| Performance | Constraint engine validates schedules against compliance rules as they're built |
| Security | Auto-backups on exit and crash — no data loss in the field |
| Impact | In production, used daily by accountants; generates styled Excel reports |
| Repository | github.com/morad-z |
Built with Clean Architecture and the Repository Pattern, fully TDD — because payroll software has zero tolerance for bugs.
03 B.H Nur — Construction, fleet & invoicing ops for a real family business · Production · 2025
Operations platform for a real construction business — tracks invoices, expenses, fuel logistics, workers, vehicles, loans, and projects in one system.
| Attribute | Details |
|---|---|
| Stack | React · Express.js · Electron · TailwindCSS |
| Scale | Covers the full business domain: invoicing, expenses, fuel, fleet, workforce, loans, projects |
| Performance | Multi-destination fuel-transfer tracking with full audit logs |
| Security | Password-protected access; auto-backups; complete audit trail |
| Impact | In production — Hebrew Excel exports built for the accountants who actually use them |
| Repository | github.com/morad-z |
Born from inefficiencies I saw firsthand managing the family business — then engineered into software the business now runs on.
04 TopGear — Full offline garage-management system · Production · 2026
A full offline, Hebrew RTL Tauri desktop app that runs an entire car garage — no server, no subscription, no constant internet. Typing a license plate auto-fills make, model, year, and engine size from Israel's Ministry of Transport registry; a tabbed job flow then tracks parts, labor, and VAT and prints a legally-compliant tax invoice or 14-day price quote to PDF.
| Attribute | Details |
|---|---|
| Stack | Tauri (Rust) · React · TypeScript · Dexie/IndexedDB · Zustand · TanStack Query · Tailwind CSS |
| Scale | Full quote → job lifecycle, appointments board, per-vehicle history, and profit aggregation by plate |
| Performance | Atomic transactional inventory — stock deduction/restore across the job lifecycle; instant local-first reads |
| Security | Code-signed in-place auto-updater; fully offline data ownership with JSON + CSV export/import |
| Impact | In production; license-plate registry API integration, client-side PDF generation, WhatsApp customer messaging from templates |
| Repository | github.com/morad-z/TopGear |
Local-first taken seriously: the garage owns its data, the app works with no connection, and updates ship signed.
05 ZOBIDAT — Avant-garde fashion site, scroll-pinned 3D WebGL lookbook · Production · Live
A bespoke, motion-led brand website for an avant-garde fashion label — a scroll-pinned 3D WebGL lookbook with custom GLSL shader atmospherics and a two-"world" art-directed scroll narrative.
| Attribute | Details |
|---|---|
| Stack | Astro 5 · TypeScript · GSAP (ScrollTrigger/SplitText) · Lenis · OGL/WebGL · GLSL · Cloudflare Pages |
| Scale | Device-adaptive — GPU WebGL lookbook on desktop, touch-native CSS swipe deck on mobile |
| Performance | Lighthouse 100 desktop / 88 mobile, 0 CLS — AVIF/WebP pipeline cut backgrounds ~99%, textures ~90%; self-hosted subset fonts |
| Security | Full prefers-reduced-motion & accessibility support — focus trapping, semantic HTML, keyboard nav |
| Impact | Shipped on GitHub → Cloudflare Pages CI/CD with custom domain, automatic SSL, and content-hashed immutable caching |
| Live | zobidat.com |
06 Data Pipeline — Serverless event-driven ETL on AWS · Academic · 2025
Event-driven serverless pipeline: S3 → SQS → Lambda → PostgreSQL with idempotent upserts, JSON schema validation, and a dead-letter queue for rejected records.
| Attribute | Details |
|---|---|
| Stack | Python · AWS S3/SQS/Lambda · PostgreSQL · Docker · LocalStack |
| Scale | Queue-driven design decouples ingestion from processing |
| Performance | Idempotent upserts guarantee safe replays |
| Security | JSON schema validation at every system boundary; DLQ isolates bad records |
| Impact | Fully reproducible local dev with Docker Compose + LocalStack before cloud deploy |
| Repository | github.com/morad-z/data-pipeline-2025 |
07 Zoobar Red/Blue — RCE chain vs. blockchain integrity ledger · Security Research · 2026
Final project for Advanced Cyber — attack and detection in the same codebase. Three real vulnerabilities chained against a privilege-separated web server, then caught by a custom integrity monitor.
| Attribute | Details |
|---|---|
| Stack | Python · C · Flask · SQLAlchemy · x86 Assembly · SHA-256 |
| Scale | Three chained CVE-class flaws across C parser, IPC socket, and ORM transfer logic |
| Performance | POST /../../bin/sh path traversal in the C URL parser → unauthenticated RCE |
| Security | World-writable microservice socket bypasses privilege separation; SQLAlchemy object-aliasing flaw mints money on self-transfers |
| Impact | A SHA-256 blockchain ledger hashes every legitimate transfer against the previous block — when the aliasing exploit mutates the DB, the ledger math breaks and the integrity monitor flags tampering |
| Repository | github.com/morad-z/Advanced-cyber |
Both sides of the exploit, end to end: how trust boundaries break, and how cryptographic integrity catches the break.
08 Network Security Lab — Layer-2 attack & defense, DHCP spoofing and ARP MITM · Security Research · 2024
A closed-loop Layer-2 lab — attack and defense, demonstrated not just described. Scapy scripts launch DHCP starvation, rogue-DHCP-offer, and ARP MITM traffic against isolated VMs; the same traffic is then blocked by the defense side.
| Attribute | Details |
|---|---|
| Stack | Python · Scapy · Wireshark · Linux VMs · DHCP Snooping · DAI |
| Scale | Repeatable multi-VM lab topology with scripted attack automation |
| Performance | Fully automated attack loop — no manual packet crafting |
| Security | Defenses applied and verified: DHCP Snooping, Dynamic ARP Inspection, port security |
| Impact | Every run is packet-captured in Wireshark so detection and mitigation are provable |
| Repository | github.com/morad-z |
09 — 11 Archive — Netflix Clone · Maze Generator · Connect Four · Archived
| # | Project | Stack | Description |
|---|---|---|---|
09 |
Netflix Clone | Node.js · React · MongoDB · JWT · TMDB | Full-stack streaming app with JWT auth, TMDB API integration, and an admin panel — deployed on Render |
10 |
Maze Generator | C++ (OOP) · Algorithms | DFS/Prim maze generation with BFS/DFS solving, custom dimensions, save/load, and solver visualization |
11 |
Connect Four | Python · Sockets | Multiplayer game over raw TCP sockets with full win detection |
Stacks I've shipped production software with — from C++ over JNI to serverless pipelines on AWS.
-95590a?style=flat-square&labelColor=070605&logo=tauri&logoColor=f4f0e8){kind=icon}
-b8690a?style=flat-square&labelColor=070605&logoColor=f4f0e8){kind=icon}
| Domain | Proficiency | Details |
|---|---|---|
| Offensive & Defensive Security | ▓▓▓▓░ Advanced |
RCE chains (path traversal, privilege-separation bypass), SHA-256 blockchain integrity ledgers, DHCP/ARP attacks, DHCP Snooping & Dynamic ARP Inspection |
| Computer Vision & State Estimation | ▓▓▓▓░ Advanced |
Visual-inertial odometry (MSCKF/EKF), KLT feature tracking, IMU preintegration, zero-velocity updates — real-time 6-DOF pose on Android |
| Production Desktop Engineering | ▓▓▓▓░ Advanced |
Electron & Tauri (Rust) apps in daily production — transactional state, auto-backups, code-signed auto-updates, Excel reporting |
| Backend & Systems Programming | ▓▓▓▓░ Advanced |
Node.js/Express REST APIs, JWT auth, MongoDB Change Streams; C/C++ on Linux — POSIX, threads, sockets, JNI bridges |
| Cloud & Event-Driven ETL | ▓▓▓░░ Proficient |
AWS S3 → SQS → Lambda → PostgreSQL pipelines with idempotent upserts, DLQs, and LocalStack-based local dev |
| Engineering Practices | ▓▓▓▓░ Advanced |
TDD (Jest, Vitest, pytest), Clean Architecture, Repository Pattern, DDD, code review |
[ WHERE ] Kiryat Tivon · [ WHEN ] Jan 2017 – Aug 2020
Managed daily operations, staff training, inventory, and vendor relations — and identified the operational inefficiencies that I later solved by building the XPlanner and B.H Nur software now used in production.
- Led daily operations and trained staff; improved shift coverage and service consistency
- Managed inventory and vendor relations; reduced out-of-stock incidents through tighter ordering
- Turned firsthand operational pain into software requirements — then shipped the software
Leadership · Operations · Inventory management · Team training · Product thinking
[ AWARD ]1st place — Forms UX Challenge Shenkar College |
[ IN PRODUCTION ]XPlanner · B.H Nur · TopGear Used daily by accountants and business operators |
[ VOLUNTEER ]חינוך לפסגות · Education for Excellence With Bank Hapoalim · teacher hours tracked in Tandemwise |
[ LANGUAGES ]Arabic · Hebrew · English Native · fluent · fluent |
current_focus:
learning:
- Visual-inertial odometry & state estimation (MSCKF/EKF)
- Offensive & defensive security — exploit chains, integrity monitoring
- Distributed systems & cloud architecture patterns
building:
- NavSight — GPS-denied navigation engine (C++ / OpenCV / Android NDK)
- Production desktop apps with Electron & Tauri (Rust)
exploring:
- Rust for systems & desktop development
- Real-time 3D / WebGL experiences (Three.js · GLSL)
open_to:
- Cyber / Security Engineering
- Full-Stack & Backend Engineering
- Platform / Systems roles (intern & new-grad)
graduating: "B.Sc. Software Engineering — Shenkar College, July 2026"
● TRACK COMPLETE ───────────────── DEST · 32.79°N 34.98°E · HAIFA
[ Let's build something that stays up ]
© Morad Zubedat — built in Haifa · Open to intern & new-grad roles