CV
Curriculum Vitae of Enea Manzi - Cyber Security Researcher, M.Sc. graduate (University of Milan)
Contact Information
| Name | Enea Manzi |
| Professional Title | Cyber Security Researcher |
| enea.manzi@gmail.com | |
| Phone | (+39) 333 132 6901 |
| Location | Bellano, LC |
Professional Summary
Cyber Security graduate (M.Sc., University of Milan, 110/110 cum laude), currently applying for an intersectoral Ph.D. programme at the University of Milan. Research focus on API and cloud-native security, with hands-on experience in Kubernetes, Docker and REST APIs.
Education
-
2024 - 2026 Milan, IT
Master's Degree
University of Milan
Cyber Security
- Thesis: Design and Implementation of an API-Agnostic Tool for REST API Security Assurance
- Supervisors: Marco Anisetti, Claudio Agostino Ardagna
- Final Grade: 110/110 cum laude
-
2021 - 2024 Milan, IT
Bachelor's Degree
University of Milan
System and Network Security
- Thesis: Design and Implementation of a Framework for Evaluating Distributed Systems
- Supervisors: Marco Anisetti, Filippo Berto
- Final Grade: 110/110 cum laude
-
2016 - 2021 Lecco, IT
High School Diploma
IIS Badoni
Computer Science
- Final Grade: 93/100
Experience
-
2025 - 2026 Milan, IT
Curricular Internship for Master's Thesis
SESAR Lab, University of Milan
Secure Service-oriented Architectures Research Lab (SESAR Lab)
- Designed and implemented APIGuard Assurance, an API-agnostic, contract-driven tool for automated REST API security assurance based on a taxonomy of eight domains and specified oracles to establish trust in automated verdicts, validated against a real-world target.
-
2024 - 2024 Milan, IT
Curricular Internship for Bachelor’s Thesis
SESAR Lab, University of Milan
Secure Service-oriented Architectures Research Lab (SESAR Lab)
- Contributed to the design and implementation of an Assurance Engine for the verification of non-functional properties (NFP) in distributed systems, built in Rust and deployed on Kubernetes, developing a new connector to integrate Elasticsearch as an observability backend.
-
2020 - 2020 Casargo, IT
WBL: web developer
DaTrik Solutions
High school work-based-learning
- Developed a web application using HTML, JavaScript, and jQuery as part of a high school work-based learning program (PCTO).
Research
-
2025 - 2026 Milan, IT
SESAR Lab, University of Milan
Secure Service-oriented Architectures Research Lab (SESAR Lab)
- Analyzed existing approaches to REST API testing, observing that most focus on functional and syntactic conformance, while security violations remain comparatively unaddressed.
- Defined a taxonomy of eight security domains to structure systematic assessment coverage.
- Proposed an API-agnostic, contract-driven methodology, based on specified oracles, that derives target knowledge exclusively from the OpenAPI Specification (OAS) and a deployment configuration file.
- Addressed the oracle problem in automated security testing, central to establishing trust in an automated verdict, by deriving, for each security control, an evaluation criterion from the specific knowledge and expectations of the test being performed, traceable to OWASP categories and CWE codes.
- Achieved deterministic, reproducible results, a prerequisite for assurance integrated into continuous development, through a DAG-based scheduling approach exposing semantic exit codes for CI/CD integration.
- Validated the methodology against a real-world target, Forgejo exposed through the Kong API gateway, confirming correct detection of security violations and deterministic, reproducible results.
-
2024 - 2024 Milan, IT
SESAR Lab, University of Milan
Secure Service-oriented Architectures Research Lab (SESAR Lab)
- Investigated existing approaches to verifying and monitoring non-functional properties (NFP) in distributed Edge-Cloud Continuum systems.
- Contributed to the development of an Assurance Engine for distributed systems, building a new connector to integrate Elasticsearch as an observability backend.
- Formalized contracts to jointly evaluate multiple non-functional properties (CIA triad, reliability, scalability, performance), validated experimentally on a Kubernetes testbed with minimal computational overhead.
Projects
-
APIGuard Assurance
Master’s Thesis Project (A.Y. 2025/2026) Development of an API-agnostic, contract-driven tool for REST API security assurance, with a particular focus on semantic security violations that traditional functional and syntactic testing does not capture.
- Built in Python 3.12, with a dynamic test-discovery mechanism allowing new security checks to be added without modifying the core engine.
- Implemented specified oracles directly in each test’s code: every check encodes its own evaluation criterion, derived from the domain knowledge of the control under test.
- Enforced strict static typing (mypy) and runtime validation (Pydantic), with full documentation coverage across the public API.
- Built reproducible packages with Hatch, verifying identical SHA-256 hashes across repeated builds.
- Designed an extensible connector architecture to integrate external security scanners, decoupling test logic from tool-specific output parsing.
-
Event-Driven IoT Architecture (Kafka + Kong)
Cloud Computing Technologies Course Project (A.Y. 2025/2026) Development of a cloud-native microservices infrastructure on Kubernetes for IoT ingestion and monitoring, with a particular focus on non-functional properties such as scalability, fault tolerance, and edge-to-core security.
- Microservices architecture based on Apache Kafka in KRaft mode (ZooKeeper-less) for asynchronous decoupling and reliable message handling (Zero Data Loss).
- Integration of Kong API Gateway to implement the Gateway Offloading pattern, centralizing Authentication (API Key), Rate Limiting, and Load Balancing at the edge.
- Storage layer optimized on MongoDB using Time Series Collections and hybrid compression (LZ4/Zstd) to maximize storage efficiency and analytical performance.
- Full Kubernetes orchestration managed via Helm, featuring automatic scalability (HPA) and advanced security (Secrets, TLS/SASL) to meet non-functional requirements.
-
FTP Client and Server
Computer Networks Course Project (A.Y. 2022-2023) Developed a multi-threaded FTP-compliant client-server application in C for file transfer, fully interoperable with FileZilla.
- Architecture: Multi-threaded server based on Socket Programming for concurrent session management.
- Data Modes: Native support for both Active (PORT) and Passive (PASV) data transfer modes.
- Protocol Management: Implemented essential FTP commands (e.g., USER, PASS, LIST, RETR, STOR, CWD…)
- Key skills: C, socket programming, multithreading, network protocols, FTP, Git.
-
Exhibition Web App
Web and Mobile Programming Course Project (A.Y. 2021-2022) Built a dynamic web application serving as a digital portfolio for displaying multimedia content.
- Developed the backend with Node.js/Express and the frontend with HTML5, CSS3, JavaScript/jQuery.
- Integrated MongoDB for document-oriented storage and AJAX for asynchronous client-server communication (GET, POST, DELETE).
- Managed source code and collaboration using Git and GitHub.
- Key skills: Node.js, Express, MongoDB, AJAX, REST APIs, jQuery, Git.
Publications
-
2026 Security Assurance for Modern Big Data APIs
Submitted to ITADATA 2026
Enea Manzi, Marco Anisetti Automated REST API testing has traditionally focused on functional compliance, leaving security assurance comparatively underexplored; existing tools operate at the syntactic level and cannot reliably detect the semantic vulnerabilities behind several top-ranked OWASP API Security categories. This work proposes a contract-driven approach that derives all target knowledge from the OpenAPI specification and a configuration file, embedding evaluation criteria directly into deterministic test oracles and organizing checks into an eight-domain taxonomy scaling with available privileges. Tested on a realistic setup, the approach correctly classified expected outcomes, revealed a real discrepancy between declared and actual API behavior, and produced reproducible results, contributing a systematic approach to the oracle problem and a process ready for integration into automated pipelines.