Nicolas Bareil
Principal Incident Response Consultant at Palo Alto Networks Unit 42
Toulouse, Occitania, France
Summary
👤
Senior🎓
Top SchoolNicolas Bareil is a Principal Incident Response Consultant with 16 years in cybersecurity, specializing in detection, response and threat hunting across critical national and enterprise environments. He co-created Airbus CERT in 2013 and has driven its Incident Response, Threat Intelligence and Threat Hunting pillars while building hands-on detection capabilities and investigative playbooks. Now at Palo Alto Networks Unit 42, he leads high-stakes APT response and proactive hunts, blending malware analysis, TTP research and team leadership. An active open-source contributor, he has improved PyMISP and advanced parsing for Cobalt Strike artifacts, bringing production-quality tests and Python 3 modernizations to forensic tooling. Based in Toulouse, he pairs deep engineering chops from early VoIP and pentest research with a pragmatic focus on operational resilience and cross-organizational collaboration.
16 years of coding experience
11 years of employment as a software developer
Licence Computer Science, Licence Computer Science at Université Paris 13Master of Engineering (MS/MSc) Computer Science, Master of Engineering (MS/MSc) Computer Science at Telecom Bretagne
English, Spanish, French
Stackoverflow
1reputation
0reached
0answers
0questions
Github Skills (12)
unit-testing10
cybersecurity10
cobalt10
api10
msp10
reverse-engineering10
python10
apidoc10
file-parsing10
api-client10
threat-intelligence9
pytest5
Programming languages (10)
Github contributions (5)
Sentinel-One/CobaltStrikeParser
May 2021 - May 2021
Role in this project:
Security Engineer
Security EngineerContributions:8 commits, 2 PRs, 1 comment in 2 days
Contributions summary:Nicolas contributed significantly to the project by implementing and enhancing functionality for parsing and analyzing Cobalt Strike configuration data. They introduced a new method for handling non-PE beacon configurations, crucial for broader analysis of threat actor activity. The contributions also included refactoring and integration of a decryption function, as well as the addition of unit tests to validate functionality for various beacon types, including encrypted and trial versions.
MISP/PyMISP
Nov 2016 - Dec 2016
Python library using the MISP Rest API
Role in this project:Back-end Developer
Back-end DeveloperContributions:5 commits, 1 PR, 1 comment in 2 days
Contributions summary:Nicolas primarily refactored and improved the `pymisp` library, focusing on attribute handling and API interactions. Their contributions included standardizing attribute addition functions and correcting code for Python 3 compatibility. Furthermore, the user added unit tests, showcasing their focus on code quality and maintainability within the MISP API client.
api-clientapipython-librarypythonmisp
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.