I uncover real-world abuse paths across web & mobile apps, APIs, and enterprise systems - combining manual pentesting, business logic analysis, and DevSecOps integration.
I can help you out with the following core areas:
Check out my skils
What I focus on day-to-day as an AppSec / Red Team practitioner.
Breaking real-world application logic, not just finding bugs.
I test web applications and APIs with an attacker mindset, focusing on authentication flows, authorization boundaries, and business logic abuse. My approach prioritizes exploitability and impact, chaining weaknesses the way a real attacker would rather than relying on checklist scanning.
Designing security into applications, not bolting it on later.
I partner with engineers to threat-model features, review code, and define secure patterns that scale across teams. The focus is on preventing vulnerability reintroduction through better design, developer enablement, and security ownership within engineering.
Assumed-breach, impact-driven security testing.
I conduct internal and external red team exercises to simulate realistic attacker behavior, focusing on attack paths rather than isolated findings. Results are framed in terms of business impact and defensive gaps, not just technical issues.
Securing identity, trust, and data flow in modern architectures i.e., micro-services
I assess APIs and microservices for auth flaws, authorization bypasses, tenant isolation issues, and insecure service-to-service trust. This includes token handling, integration boundaries, and abuse cases specific to distributed systems and modern application stacks.
Embedding security into delivery pipelines without slowing teams down.
I integrate security into CI/CD pipelines using SAST, DAST, and dependency scanning, focusing on fast feedback and actionable findings. The goal is sustainable security that developers can maintain, not controls that get bypassed under delivery pressure.
Prioritizing what actually matters.
I use threat modelling to identify realistic attack paths early in the lifecycle, helping teams focus on risks with real impact. This ensures security effort is proportional, intentional, and aligned with how systems are actually attacked.
Bringing security into engineering decisions at scale.
I work across engineering, operations, and risk teams to assess security impact during design and change discussions. By translating risk into clear engineering and business terms, I help teams move fast without introducing unnecessary exposure.
Some of my writing
Selected real-world findings, technical breakdowns, and security research.
Identified a business logic flaw where client-controlled pricing allowed users to complete valid purchases while paying a fraction of the intended cost.
Built a custom Burp extension and companion browser automation to eliminate session expiry friction during authenticated testing, enabling continuous, hands-free JWT refresh across Burp tools while maintaining a valid user session in the browser.
Led the end-to-end technical delivery of I&M Bank's Inter-university CTF, designing resilient infrastructure, implementing improvised high availability for CTFd, and authoring multiple DevSecOps-themed challenges for over 50 university participants.
Whether you’re strengthening your security program or building out your team, I’m open to meaningful security engagements and long-term opportunities.
