Penetration Tester
& SOC Analyst
Dual offensive/defensive background — web app pentesting, bug bounty on HackerOne & Bugcrowd, plus 500+ endpoint SIEM detection engineering.
// about.me
Offensive Mindset,
Defensive Depth
Cybersecurity professional with 3+ years of experience and a dual offensive/defensive background, now focused on web application penetration testing and bug bounty research.
Proficient in full-cycle web app pentesting — recon through exploitation and reporting — applying OWASP Top 10 methodology, Burp Suite Pro, and manual exploitation across XSS, SQLi, IDOR, authentication flaws, and business logic vulnerabilities. Actively hunting on HackerOne and Bugcrowd.
Real-world detection engineering experience — authoring 40+ MITRE ATT&CK-mapped rules across a 500+ endpoint fintech environment — directly informs attacker thinking and exploit identification depth.
// work.history
Professional Experience
Cybersecurity Engineer & SOC Analyst
PostEx (Fintech)
- Engineered 40+ custom detection rules mapped to MITRE ATT&CK (T1059, T1486, T1078, T1053, T1021), developing attacker-pattern intuition applied directly to offensive research.
- Lead full-cycle incident response — triage, containment, eradication, and post-incident review — producing root-cause reports and detection improvements for each engagement.
- Conduct proactive threat hunting across endpoint and network telemetry (Sysmon, Zeek, firewall logs), surfacing lateral movement, persistence, and C2 patterns transferable to purple/red team scenarios.
- Perform vulnerability assessments using OpenVAS and Nmap; lead CVE analysis, CVSS v3.1 prioritization, patch coordination, and OS hardening against CIS Benchmark controls.
- Operate Elastic Defend EDR — monitoring process injection, credential access, and suspicious network behavior — building hands-on understanding of EDR detection logic exploited during offensive engagements.
- Integrate threat intelligence feeds (IOCs, TTPs) into SIEM correlation and enrich alerts with VirusTotal, AbuseIPDB, and OSINT lookups for faster, higher-confidence triage.
- Reduced SIEM false positives by ~40% through correlation tuning, threshold calibration, allow-listing, and log-source filtering — verified to preserve true-positive coverage.
- Designed n8n SOAR automation pipelines achieving sub-2-minute MTTN for P1/P2 alerts via auto-enrichment, ticketing, and Telegram/email notification.
- Author SOC runbooks and playbooks, mentor junior analysts, and report security posture and KPIs to management on a recurring basis.
Assistant Network Administrator
PostEx (Fintech)
- Managed firewall ACL rules, VLAN segmentation, and network topology for a 500+ node environment — network knowledge directly supporting network-layer pentest reconnaissance.
- Configured MikroTik routers with OSPF/BGP routing and L2VPN tunnels; supported threat containment by isolating compromised segments during SOC-flagged incidents.
- Administered core network services — DNS, DHCP, and site-to-site VPN — and enforced least-privilege access between office, server, and production VLANs.
- Deployed network monitoring (SNMP, syslog, uptime alerting) to detect outages and anomalous traffic early, cutting mean time to detection for link failures.
- Hardened network devices — disabled unused services, enforced strong management-plane access, and applied firmware updates — reducing the exposed attack surface.
- Maintained change logs, device configurations, and network documentation supporting audit and compliance requirements.
Technical Support Engineer
StormFiber
- Diagnosed L1/L2/L3 network faults for enterprise customers; coordinated with NOC during outages following SLA escalation procedures.
- Troubleshot GPON / fiber-optic connectivity — signal levels, ONU/OLT provisioning, and last-mile faults — restoring service within SLA targets.
- Managed the ticketing lifecycle end to end, documenting root cause and resolution steps to build a reusable knowledge base for recurring issues.
- Guided customers through remote diagnostics and configuration, consistently maintaining high first-contact resolution and customer-satisfaction scores.
- Escalated and tracked complex incidents with upstream teams, ensuring timely resolution and clear status communication to stakeholders.
// tech.stack
Tools & Technologies
A practical toolkit spanning the full offensive-to-defensive lifecycle — from reconnaissance and exploitation through detection engineering, SIEM operations, and network hardening.
Web & App Pentest
Recon & OSINT
Exploitation & Post-Ex
SIEM & Detection
Networking & Infra
Scripting & Frameworks
// projects
Featured Work
Bug Bounty & Web Application Security Research
Systematic OWASP Top 10 hunting on HackerOne and Bugcrowd. Recon-to-report methodology producing high-signal, reproducible findings across access control, injection, and business-logic flaws.
Web Application Penetration Testing Lab
Self-hosted lab (DVWA, custom Docker targets, PortSwigger) for full exploitation chains: SQLi, XSS, file-upload bypasses, SSRF, JWT flaws, deserialization, SSTI, and API abuse.
Authentication & Session Attack Research
Deep-dive into broken auth chains: JWT alg:none, session fixation, OAuth misconfiguration, MFA bypass, and password-reset host-header injection. PoC-driven with CVSS scoring (lab targets only).
MITRE ATT&CK Detection Rule Library
Authored 40+ detection rules across 15+ ATT&CK techniques (T1059, T1486, T1078, T1053) for ransomware, lateral movement, and persistence. Attacker-informed logic validated against simulated activity.
SOC Automation Pipeline (n8n)
Orchestration achieving sub-2-minute MTTN for P1/P2 alerts: auto-enrichment, ticketing, multi-channel notification, and guarded endpoint containment.
SIEM False Positive Reduction Program
Reduced Wazuh/Splunk false positives by ~40% through correlation tuning, threshold calibration, and log filtering — verified to preserve true-positive coverage.
Vulnerability Assessment & Hardening Program
Recurring OpenVAS and Nmap assessment across a 500+ node estate, prioritized by CVSS and business impact, with CIS Benchmark hardening for Linux and Windows Server.
Zero-Trust Network Segmentation
VLAN-based micro-segmentation across 50+ segments using MikroTik and firewall ACL policy enforcement, with OSPF/BGP routing and L2VPN tunnel management.
EDR Monitoring & Endpoint Hardening
Operate Elastic Defend EDR monitoring process injection, file activity, and network behavior — building hands-on understanding of EDR detection logic relevant to offensive engagements.
// detection.rules
Detection Research
Sanitized, generalized detection logic mapped to MITRE ATT&CK (Splunk, Sigma, Wazuh, Elastic). Shared for demonstration only — no employer-specific thresholds or internal logic. Offensive value: reverse-engineering rule logic exposes detection gaps and informs evasion thinking during pentest engagements.
Brute Force Detection
T1110 · Brute Forceindex=windows_security EventCode=4625
| bucket span=5m _time
| stats count dc(src_ip) as unique_ips
values(src_ip) as src_ips
by _time dest_user Account_Name
| where count > 10
| eval risk_score=if(count>50,"CRITICAL",
if(count>20,"HIGH","MEDIUM"))
| table _time dest_user count unique_ips
src_ips risk_score | sort - countLateral Movement via PsExec
T1021.002 · SMB/Windows Admin Sharestitle: Lateral Movement via PsExec
id: d5866ddf-ce8f-4aea-b28e-d96485a20d3d
status: production
author: Asad Noor
logsource:
product: windows
service: system
detection:
selection:
Channel: System
EventID: 7045
ServiceName: 'PSEXESVC'
condition: selection
falsepositives:
- Legitimate admin usage
level: high
tags:
- attack.t1021.002
- attack.lateral_movementMalicious PowerShell Execution
T1059.001 · PowerShell<group name="powershell,t1059,windows,">
<rule id="100301" level="12">
<if_group>windows_security</if_group>
<field name="win.eventdata.commandLine"
type="pcre2">
(?i)(EncodedCommand|bypass|hidden|
downloadstring|iex|invoke-expression)
</field>
<description>T1059.001: Suspicious
PowerShell execution</description>
<mitre><id>T1059.001</id></mitre>
</rule>
</group>Process Injection Hunt
T1055 · Process Injectionsequence by host.name with maxspan=30s
[process where event.type == "start"
and process.name :
("cmd.exe","powershell.exe")
and process.parent.name :
("svchost.exe","explorer.exe")]
[network where destination.port
in (443, 4444, 8080)
and not destination.ip : "10.0.0.0/8"
and not destination.ip : "172.16.0.0/12"]Ransomware Behaviour Hunt
T1486 · Data Encrypted for Impactindex=sysmon EventCode=11
file_name="*.encrypted" OR
file_name="*.locked" OR
file_name="READ_ME*" OR
file_name="HOW_TO_DECRYPT*"
| stats count dc(file_name) as unique_files
values(file_name) as files by host
| where unique_files > 20
| eval severity="CRITICAL"
| table host unique_files files severity
| sort - unique_filesPersistence via Scheduled Task
T1053.005 · Scheduled Task<group name="persistence,t1053,windows,">
<rule id="100401" level="10">
<if_group>windows_security</if_group>
<field name="win.system.eventID"
type="pcre2">^4698$</field>
<description>T1053.005: Scheduled task
created - possible persistence</description>
<mitre><id>T1053.005</id></mitre>
<group>persistence,</group>
</rule>
<rule id="100402" level="14"
frequency="3" timeframe="300">
<if_matched_sid>100401</if_matched_sid>
<description>Repeated sched task
creation - high confidence T1053</description>
</rule>
</group>// learning.certs
Certifications & Learning
Verified Certifications (in progress / planned marked with a clock)
PortSwigger Web Security Academy
Actively completing all lab modules
// contact
Get In Touch
Open to web app pentesting, SOC analyst, and detection engineering roles — remote or based in Lahore, Pakistan. Send a message below or reach out on any verified profile.
Responsible disclosure: security reports are welcome via email or LinkedIn. I follow coordinated disclosure and program safe-harbor terms.