$ Red Team Specialist · Offensive Security Engineer · vCISO Advisor · ICS/SCADA Security
Elite offensive security practitioner with 12+ years spanning red team operations, adversary simulation, nation-state-level threat intelligence and critical-infrastructure security — across the Middle East, Europe and the United States. I translate offensive findings into [ classified ].
tip: press ⌘/Ctrl+K — or type sudo hire
// why_engage — the short version
HackTheBox Omniscient — Top 10 globally (<0.1% of users). Bug Bounty Hall of Fame at Google, Twitter, Bugcrowd. Every claim here is independently verifiable.
Attacker depth — red team, exploit dev, AD attack chains — plus ICS/SCADA (OT), LLM/AI security and vCISO advisory. Few operators cover both ends.
Government-adjacent and critical-infrastructure engagements where discretion is the requirement, not a preference. Sensitive scope stays sensitive.
Open-source tooling with real traction (180★) and findings translated into CFO / board-level financial risk — remediation that survives the readout.
$ echo "you're not hiring a scanner — you're hiring an adversary who can sit in your boardroom."
// rules_of_engagement — how I operate
Read, validate, verify before I touch anything. An assumption is just an unconfirmed vulnerability.
Every finding maps to a decision a board can make and a number a CFO can act on. Risk, not jargon.
High-sensitivity scope stays sensitive. Trust is the actual deliverable — I treat it that way.
I ship tooling and remediation paths, not a report that ages in a drawer. The flaw and the fix.
I run point with the team in the room — mentoring, aligning, and owning the outcome, not narrating from a slide deck.
Claims are cheap. I bring verifiable rank, disclosed bounties, and shipped code to the table.
// case_studies — what I ship, not just what I find
An open-source EDR simulator for red teamers: study and test against endpoint detection logic in a lab — "turn the blue team's telescope into our own mirror" — so tradecraft can be validated before it ever touches an engagement.
A runtime security fabric for LLM agents. v1 catches step-level prompt-injection mid-execution; v2 adds policy-as-code governance, intent-aware goal-drift detection, behaviour-chain analysis and multi-agent identity tracking — the slow, multi-step hijacks static filters miss.
Damn Vulnerable AI — a deliberately vulnerable ecosystem to practice adversarial techniques on real LLMs: logprob side-channels, multi-stage pipeline exploitation, adversarial-suffix optimisation. Zero-infrastructure (player-supplied keys, $0 hosting), anti-cheat hardened.
A runtime dependency-behaviour monitor that watches packages as they execute and gates CI on it — e.g. catching a package that reads ~/.npmrc and POSTs it to an unknown host, scoring it CRITICAL and failing the build. Supply-chain defence at runtime, not just at install.
A strategic cyber-risk intelligence platform that turns raw scan data into executive-ready risk: CVE/EPSS/KEV/MITRE ATT&CK enrichment, attack-graph analysis, remediation prioritisation, compliance mapping and CFO/CISO board reports — 100% client-side, AES-256 encrypted, zero backend.
A research framework for understanding how OPSEC breaks down through emergent signal correlation across abstraction layers — deliberately not a checklist or compliance tool. For research-grade threat modelling, with a clear lawful-use scope.
An open-source verification standard and testing guide for ML/LLM systems — inspired by OWASP MASTG and aligned to MITRE ATLAS, NIST AI RMF and OWASP AI Exchange. Pairs L1/L2 verifiable controls (MLASVS) with step-by-step test cases and executable Python harnesses (ART, SecML).
A structured, machine-readable corpus of 23 real-world vulnerabilities — metadata, CWE, root cause, exploit primitive and discovery methodology — distilled from public PoC research (1 CVE assigned). Built for defensive and educational use: query, cross-reference and learn from how flaws were actually found.
// also_built — AI enablement & cost
A zero-infrastructure learning platform: teams use their own LLM key while the AI assesses skills, builds a personalised roadmap and drills with spaced repetition — in the learner's own language. Security upskilling with no per-seat SaaS cost and no vendor lock-in.
A runtime token proxy — one env var, zero code changes — that strips wasted tokens, injects caching and shows exactly where every token goes. LLM cost governance and observability for teams shipping AI in production.
// stack — click a layer to expand
sabha-devsec, bheeshma, and chanakya-opsec — open-source security tooling.Curated, battle-tested offensive-security task library. Community-validated traction.
Runtime dependency-behavior monitor for Node.js — flags malicious or compromised packages in npm pipelines before they execute.
Translates offensive findings into CFO-level financial impact for executive decisions.
Multi-layer OPSEC failure-analysis framework — surfaces where an operation's tradecraft leaks, for threat modeling & signal correlation.
Global Top 10 Hall of Fame — a rank held by fewer than 0.1% of the platform worldwide.
Google, Twitter, Bugcrowd, Medium — 15+ vulnerability reports to Google Bug Hunters.
"Hacking Human Lives via Body Area Network." International conference speaker.
"Hybrid Cloud Seeding — Hacking Microsoft Hybrid Cloud Infrastructure."
Trained professionals who went on to become SANS instructors themselves.
Global client portfolio across the Middle East, Europe, USA and Asia.
Security research articles and practitioner guides.
4,400+ followers — an active voice in offensive security & threat research.
Active contributor across the information-security community.
LLM/AI red-teaming, runtime supply-chain abuse, OPSEC failure correlation.
Research into the security of Body Area Networks — the wireless mesh of wearable and implantable medical devices around the human body — and how weaknesses turn a connectivity convenience into a life-safety attack surface with physical, human consequences.
focus: medical / IoT device security · wireless protocol attack surface · safety-critical threat modeling
A red-team approach to Microsoft Azure hybrid-cloud environments: enumerating and pivoting across Azure AD and on-premises Active Directory through federated services — correlating cloud and on-prem identities (users, groups, admin roles) to target privileged accounts and move laterally between the two.
focus: Azure AD / hybrid-cloud red teaming · Active Directory attack chains · federated identity · PowerShell enumeration · cloud↔on-prem pivoting
// verify — don't take my word for it