Skip to content
Portrait of Yoav Dory

Yoav Dory

Student Developer & Product Builder

CV

01  / About

The short version of my CV. The full one is a click away.

About me

I'm a second-year Computer Science & Entrepreneurship student at Reichman University with a GPA of 92, on a combined track that builds technical depth alongside product-oriented thinking. Before university I served as a Combat ICT Officer in the IDF Paratroopers Brigade, where I led a team of 23 and delivered 10+ end-to-end technology projects with Israel's top defense firms, from first requirement to operational deployment. During deployment I was the senior-ranking ICT officer in the brigade, keeping systems and connectivity up around the clock. Today I serve in the reserves as a Combat ICT Officer (Captain) in a commando unit, and I build AI and security tools: a permission layer for AI assistants, a credit-risk model you can see inside, and a news map for Asia. I am looking for a student developer or product role.

Languages · Hebrew (native) · English (fluent)

02  / Experience

The pathso far

Service, study and volunteering. Open a row for the details.

  • Combat ICT Officer

    IDF Paratroopers Brigade · 2021–2024

    • Managed 10+ end-to-end technology projects from initiation to operational deployment, with leading defense-tech companies.
    • Led a multidisciplinary team of 23 (3 commanders, 20 soldiers): helpdesk, logistics and ICT infrastructure under pressure.
    • Architected and delivered computing infrastructure and communication networks from complex operational requirements.
    • Senior-ranking ICT officer in the brigade during deployment, responsible for 24/7 reliability and connectivity.

    Combat ICT Reserves Officer (Captain)

    Commando Unit

    • Leading a specialized technical team of 20 (5 commanders, 15 soldiers) running mission-critical ICT operations.
    • Working with elite military technology units to field advanced communication systems and specialized combat tools.
    • Overseeing the integration of new technologies, keeping systems ready and adaptable as conditions change.
  • B.Sc. in Computer Science & Entrepreneurship

    Reichman University · 2025–2028

    • GPA 92 after the first year.
    • Combined CS and Entrepreneurship track: technical depth alongside product-oriented thinking.
    • Relevant coursework: Data Structures, Logic, Linux and C Programming, Java, Calculus and Linear Algebra.
    • Psychometric score: 713.
  • Youth Movement Counselor

    Givat Shmuel · 2016–2018

    • Led group activities and mentored teenagers.
    • Organized educational and social programs for a local youth movement chapter.

03  / Skills

Tools Ireach for

Languages

  • Python
  • Java
  • C
  • C++
  • SQL
  • TypeScript

Backend & ML

  • FastAPI
  • REST APIs
  • scikit-learn
  • LightGBM
  • SHAP
  • pandas

Frontend & tools

  • React
  • Git
  • GitHub Actions
  • Docker
  • pytest
  • Linux
  • Claude Code
  • Cursor
  • MCP
  • LLM APIs
  • OOP
  • Data structures
  • Algorithms

04  / Projects

Things I'vebuilt

Three projects, each built end to end: an AI security layer, an explainable credit model and a news map. All code is public.

All code on GitHub

01Project

Permissionguard

A permission layer between an AI assistant and its tools: every action is allowed, denied, or put to a human.

~/PermissionGuard
Terminal: a file read is allowed, a delete asks a human, rm -rf / is denied, then pytest reports 537 passed and 7 xfailed.
Screen recording

What it does

  1. 01Checks every file or shell action an assistant asks for against a YAML policy: allow, deny, or ask a human.
  2. 02Writes each decision to a hash-chained, tamper-evident audit log before the tool runs.
  3. 03Runs as an MCP server, so any MCP client gets the same policy, with approval through MCP elicitation.
  4. 04Ships a prompt-injection demo and a red-team test suite; attacks that still work are pinned as xfail tests.

How it is built

  • Python 3.11
  • MCP
  • YAML policy
  • pytest
  • GitHub Actions
  • Ubuntu + macOS CI
tests passing
537
known attacks pinned as xfail
7
front ends on one guard
3
operating systems in CI
2
Front endsdemo.pydemo_injection.pymcp_server.pyguard.handle()1 policy.evaluate allow | deny | ask2 approval.py human: y / n / session3 audit (write-ahead)4 run, then log outcomefails closed on any errortools.pyread_filewrite_filedelete_filerun_commandaudit.pyhash-chained JSONLverify / --sandboxpolicy.yamlsandbox_rootallowlist-first commandsHumanapproves in CLIor MCP elicitationrequestallowedask
Request flow, drawn from the repo layout
permission_guard/policies/default.yamlyaml
actions:  # ...  read_file:    inside_sandbox: allow  write_file:    inside_sandbox: ask  delete_file:    inside_sandbox: ask  run_command:    # ...    default: ask# ...commands:  # ...  unknown_program: deny
The default policy fails closed
Terminal recording from the repo: a poisoned file tells the assistant to pipe a script to a shell and read an SSH key; the guard blocks both and the human declines the delete.
Prompt-injection demo, from the repo

02Project

Glassbox

A credit-risk model you can see inside: every approve or decline comes with its reasons.

glassbox-uayo.onrender.com
glassbox landing page: "See inside every credit decision", with a demo-mode banner.
Live demo · synthetic applicants, illustrative numbers

NoteStudent project on public data. The live demo runs a model trained on synthetic applicants, so its numbers are illustrative, never real customers. The results below come from the held-out test set of the public Home Credit data. The free server can take up to a minute to wake.

What it does

  1. 01Predicts the chance an applicant defaults with LightGBM, trained on public Home Credit data.
  2. 02Turns risk into approve or decline with a cost-based cut-off: approve only when expected profit is positive.
  3. 03Explains every decision with SHAP reason codes, computed live on each request.
  4. 04Replays the policy in a portfolio simulator and audits the outcome by gender and age.

How it is built

  • Python
  • LightGBM
  • SHAP
  • scikit-learn
  • pandas
  • FastAPI
  • React
  • TypeScript
  • Docker
  • GitHub Actions
public applications
307,511
test ROC-AUC
0.763
cost-based cut-off
14.3%
tests
53
Decision desk on a phone, with the demo-mode banner.
Decision desk · 390 px
Home Credit data307,511 applicationspublic, Kagglefeatures.py15 fields + 5 ratiosinside the pipelineLightGBM → p(default)monotone constraintstest ROC-AUC 0.763explain.py · SHAPreason codesper requestdecision.pyp < m / (m + lgd)cut-off 14.3%fairness.pygaps by gender, agedescriptive auditFastAPI · api/POST /predictPOST /portfolio/simulateReact · web/decision deskportfolio simulatorJSON
Pipeline, drawn from src/credit_risk
src/credit_risk/decision.pypython
def cost_based_threshold(lgd: float, margin: float) -> float:    """Highest probability of default at which approving still pays off.    ...    """    if lgd <= 0 or margin <= 0:        raise ValueError("lgd and margin must be positive")    return margin / (margin + lgd)def decide(p_default: float, threshold: float) -> Decision:    return "approve" if p_default < threshold else "decline"
The lending policy is two lines of maths
Portfolio simulator on a phone.
Simulator · 390 px

03Project

Eastwire

English-language news from China, India, South Korea and Japan, on a map, with every source shown.

  • China
  • India
  • South Korea
  • Japan
eastwire.pages.dev
The live EastWire site: the front page with country counts and stories, then the map with city pins across Asia.
Screen recording

NoteRuns on free hosting: the search and filter API sleeps when idle, so the first request after a quiet spell can take a while to wake up.

What it does

  1. 01Collects English-language news about four countries every hour, from sources whose terms allow it.
  2. 02Pins stories to cities by role: where they are about, where they are datelined, where the publisher sits.
  3. 03Shows every source and why it is allowed; a publisher that has not allowed reuse is simply not shown.
  4. 04Full-text search with phrases, exclusions and OR, plus six rule-based sector tags you can audit.

How it is built

  • Java 21
  • Spring Boot
  • PostgreSQL
  • React
  • TypeScript
  • Leaflet
  • GitHub Actions
  • Cloudflare Pages
countries covered
4
cities on the map
170
publisher domains reviewed (16 allowed)
61
auditable sector tags
6
eastwire.pages.dev/map
EastWire map page: city pins and clusters across Asia beside a list of stories.
Map · 1440 px
EastWire front page on a phone: country counts and the lead story.
Front page · 390 px
SourcesGDELT GKG filesGlobal VoicesBluesky newsroomsingest (Java 21)GitHub Actions, hourlydomain allowlistcity + sector rulesPostgreSQLNeon free tierFlyway migrationsapi (Spring Boot)Render free tierDisplayPolicy onevery readReact + TypeScriptCloudflare Pagessearch, sectors, mapReaderEnglish, any deviceevery source creditedconfig/*.yamlsources, domains,sectors, citieswriteread-onlyJSON
Architecture, drawn from the repo
eastwire.pages.dev/sources
EastWire sources page: where the news comes from, with the terms checked for each source.
Sources · 1440 px

Open to student roles

Get intouch

Looking for a student developer or product role. If you are hiring, or want to talk about one of the projects, email is the fastest way to reach me.