Web Design & Development
Fast, privacy-first websites and web apps. Static-first, no trackers, accessible, and built to load instantly — like this page (zero JavaScript).
root@securityops:~$ ./portfolio --boot
Systems & Security Engineering
Cristian Cezar Moisés
Security Engineer/Cryptography /Infrastructure
I design and build post-quantum cryptography, formally verified systems software, secure transport protocols, and privacy-first self-hosted infrastructure — in Rust, C11 and Python, on Linux.
In Code We Trust.Engineering, not marketing.
I'm a Systems & Security Engineer based in Caxias do Sul, Brazil. By day I work in IT for an industrial group; outside that, I independently build and maintain Security Ops — a privacy-first stack of self-hosted services and open-source cryptographic software.
My focus is the parts of security that have to actually hold: post-quantum cryptography (ML-KEM, ML-DSA), formal verification (Jasmin, Frama-C/ACSL), constant-time implementation, secure transport protocols, and data compression. Every performance claim is a measured number or labelled as an estimate — no benchmarks I can't reproduce.
I ship in Rust, C11, Python and Bash, deploy on Linux with Docker and GNU Guix, and host everything across clearnet and Tor. I work in tight, buildable increments: complete code, real tests, NIST/RFC vectors where crypto is involved.
What I build for clients.
Websites, software, and security work — delivered as complete, documented, buildable deliverables.
Software Development
Systems software in Rust, C11 and Python — CLIs, daemons, SDKs and protocol implementations. Zero-warning builds, tested, packaged for real install.
Post-Quantum Migration
Cryptographic inventory, crypto-agility assessment, and migration audits to ML-KEM / ML-DSA. Find what breaks under a quantum adversary — before it does.
Secure Infrastructure
Hardened, self-hosted deployments with defense-in-depth: Docker, GNU Guix, nftables, WireGuard, Tor + clearnet. Threat-modelled in plain English.
Formal Verification & Audit
Constant-time review, side-channel analysis, threat modeling, and machine- checked proofs with Jasmin and Frama-C/ACSL for code that has to be correct.
Commercial Licensing
Several projects ship AGPL-3.0 with a commercial license option for enterprise and banking use. Talk to me about dual-licensing and integration.
Open-source & product work.
A selection of what I build and maintain. Source lives at git.securityops.co.
// transport
Evelin
Post-quantum secure transport layer. Named after my late mother. AGPL-3.0 with a commercial license option.
// protocolBTP
Berkeley Transport Protocol — a post-quantum transport with no CA trust model and a cross-witness mesh. Targeting IRTF / PQUIP discussion.
// compressionVaptVupt
Compression codec: LZ77 + 4-way interleaved tANS + order-1 context model, AVX2-accelerated.
// backupZupt
Compression + post-quantum encrypted backup, with VaptVupt as the default codec. CLI plus an Android client.
// sdklibzuptsdk
In-house cryptography SDK providing a hybrid KEM and primitives shared across the Security Ops projects.
// androidObliterateX
Secure deletion for Android — crypto-erase backed by the Android Keystore for irrecoverable data destruction.
// searchSecurity Search
A privacy metasearch instance — no tracking, no fingerprinting, self-hosted on clearnet and Tor.
// toolingPQC Toolkit
Cryptographic inventory scanner, crypto-agility checks, and migration-audit tooling for the post-quantum transition.
// commsE2EE Suite
End-to-end encrypted communication tools: SecVid · KeyWave · SecChat · TempChat.
// emacswhatsapp.el
A full WhatsApp client for GNU Emacs over a Baileys bridge — 70 commands, 80 keybindings.
Tools of the trade.
Languages
RustC11Python
BashKotlinEmacs Lisp
Cryptography
ML-KEMML-DSASLH-DSA
ChaCha20-Poly1305AES-256-GCM
BLAKE3SHA-3Argon2id
HKDFX25519/Ed25519
Verification
JasminFrama-C/ACSL
EasyCryptdudectThreat Modeling
Systems
LinuxGNU GuixDocker
NginxnftablesWireGuard
TorForgejo
Let's build something secure.
Have a website, a piece of software, or a post-quantum migration in mind? Send a message — I read every one.
sac@securityops.co