Apr 2021 – Oct 2023 · 2 yrs 6 mos · Dhaka, Bangladesh · On-site

• Develop and execute regular skill gap analyses to assess the team’s offensive security expertise, leveraging findings to shape hiring decisions and professional growth initiatives. Lead red team training programs and mentoring efforts to enhance adversarial simulation skills and foster career development aligned with organizational goals. Design and implement a comprehensive offensive security strategy, including threat emulation, adversary tactics simulations, and breach-and-attack assessments, focusing on increasing automation to improve efficiency and effectiveness.
• Key Contributions:
• ● ​Boosted red team efficiency and precision by implementing automated attack simulation tools.
• ● ​Strengthened team capabilities through tailored training initiatives and strategic skill gap assessments.
• ● ​Refined offensive security operations by developing a cohesive adversary emulation strategy that integrated diverse attack phases.

Jan 2020 – Mar 2021 · 1 yr 2 mos · Colorado, United States · Remote

• Conducted comprehensive threat assessments by identifying and documenting emerging cyber threats, such as malware, phishing schemes, and APTs. Created and disseminated educational materials to enhance stakeholder awareness of cybersecurity protocols and preventive measures. Executed meticulous vulnerability scans across software systems, employing both static and dynamic testing methods to identify security weaknesses. Designed and demonstrated proof-of-concept exploits to bolster system defenses.
• Key Contributions:
• ● ​Advanced integration of modern security practices into cybersecurity research through partnerships with leading industry experts.
• ● ​Strengthened application security by conducting in-depth analyses using static and dynamic analysis techniques aimed at identifying and rectifying critical vulnerabilities.
• ● ​Contributed to the cybersecurity community by publishing research findings and analyses aimed at fostering a collective understanding of application security challenges.
• ● ​Authored the bestselling book "Web Application Hacking, Carnage & Pwnage," significantly influencing the field of web security and serving as a critical educational resource.

Jan 2019 – Dec 2019 · 11 mos · On-site

• Identified potential vulnerabilities in the SSLCommerz Core application by analyzing source code meticulously. Executed comprehensive penetration testing manually and via automated tools to identify security flaws. Partnered with software development teams to classify and rectify vulnerabilities, bolstering application security. Instituted and maintained robust vulnerability management practices to ensure swift identification and resolution of security issues.
• Key Contributions:
• ● ​Administered security protocols by managing ongoing surveillance, detection, and response strategies for security breaches.
• ● ​Reduced overall risk exposure by guiding development teams in the integration of advanced security measures and best practices.
• ● ​Improved application security by collaborating with development teams to streamline the remediation process for identified vulnerabilities.
• ● ​Enhanced the security integrity of the SSLCom