With a Computer Engineering foundation from AIUB and hands-on red team experience at QA Pro Limited, I specialize in uncovering hidden attack paths that automated tools miss. My 30+ assessments — spanning web applications, Active Directory, and PCI DSS environments — focus on translating technical findings into business-risk insights aligned with NIST and CIS frameworks. I'm driven by the belief that proactive offense is the foundation of resilient defense.
Comprehensive VAPT across network devices, servers, workstations, and Active Directory environment.
Full domain compromise path identified within simulated timeframe; regulatory exposure under Bangladesh Bank guidelines.
12 prioritized findings delivered; credential policy redesign implemented; 80% risk reduction on re-test; cleared final report.
Targeted VAPT on web applications in cardholder data environments (CDE) to meet PCI DSS Requirement 11.3.
Production payment systems with direct cardholder data exposure; compliance gap with PCI DSS Req 11.3.
All findings fully remediated and re-verified; cleared reports delivered; strengthened PCI DSS readiness across production systems.
Manual and automated VAPT on core web application following OWASP Top 10 methodology.
Sensitive institutional data at risk; potential for unauthorized access to member records.
Detailed exploitation PoC and remediation guidance delivered; fully cleared final report.
Full-scope web application penetration testing combined with firewall rule review and configuration audit.
Financial transaction integrity at risk; potential for transaction manipulation and data exposure.
Actionable hardening recommendations and remediation roadmap delivered.