OWASP ZAP Experts in Germany

Conducted an independent technical assessment of an AI-enabled software platform, combining AI risk auditing, cybersecurity analysis and software architecture review. Reviewed application components, APIs, data flows, LLM integrations, retrieval-augmented generation, multi-agent orchestration, authentication, tenant isolation, dependency vulnerabilities, AI governance and model lifecycle controls. Authored a technical audit report with a structured risk register, source-code evidence, regulatory references, corrective actions, AI system inventory, risk classification, remediation roadmap and Key Risk Indicators.

Technologies: TypeScript, JavaScript, React, Next.js, Node.js, REST APIs, MongoDB, Redis, AWS serverless services, OAuth 2.0 / OpenID Connect, LLM APIs, RAG, vector search, multi-agent orchestration, Model Context Protocol, C4 architecture modelling, threat modelling, NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, OWASP guidance, MITRE ATLAS

• Planned and carried out black-box adversarial testing of traffic-sign computer-vision pipelines; created a threat model and attack-surface analysis for safety-critical scenarios
• Built a programmable hardware proof of concept using a holographic POV fan and a repeatable test harness to run real-time experiments and gather evidence for vulnerability assessment
• Measured misclassification across lighting, distance, and angle, achieving up to 90% untargeted misclassification; delivered reproduction steps, PoCs, and prioritized mitigations, and documented limitations and residual risk

• Developed a custom tool using the Mistral 7B LLM to scan, validate, and report security vulnerabilities.
• Security tested AI agents, bots, and other LLMs, focusing on prompt injection, model inversion, data poisoning, EDR/AV bypass and evasion techniques, membership inference, model evasion, overfitting to malicious inputs, and contextual manipulation.
• Onboarded repositories to SAST solutions for security scanning, implemented secrets scanning, DAST, and SCA, and used ZAP for DAST in CI/CD pipelines.
• Delivered security awareness training and developed CTF challenges and training materials to improve developers' security knowledge.
• Planned and carried out bi-annual red teaming operations based on the MITRE ATT&CK framework and led internal and external pentests based on the OWASP Top 10 framework for 70+ applications worldwide, resulting in the detection, reporting, and remediation of hundreds of vulnerabilities.
• Triaged HackerOne reports.

• Completed 25+ hands-on labs focusing on digital forensics, incident response, and advanced threat hunting techniques.
• Earned top-tier badges in malware analysis, enterprise log analysis, and threat intelligence gathering.
• Developed specialised skills in forensic report writing and evidence collection methodologies to support incident investigations.

• Successful implementation of vulnerability management with DefectDojo
• Consulting and implementation of technical and process-related aspects of vulnerability management with DefectDojo
• Consulting on the implementation of a secure software development lifecycle
• Skills: Gitlab, DefectDojo, Vulnerability Management, SCA, SAST, DAST, Python, Kubernetes, ArgoCD, Docker, AWS, Azure, Whitesource/Mend, Greenbone

• Performed security assessments and penetration testing on Microsoft AI models for text, image, and video generation.
• Conducted prompt injection attacks through diverse input vectors, including crafted text, steganographic images, and manipulated visual elements (e.g., varying opacity and embedded content).

• End-to-end quality assurance in a global S/4HANA transformation program.

• Automated test data setup, evaluation of search and generation solutions, and PoC execution (K2View, EPI-USE).

• Coordination between Siemens teams and external partners, and structured knowledge transfer to internal stakeholders.

• Created a basis for PoC decisions and sped up tool selection.

• Standardized test data provisioning and noticeably reduced lead times.

• Established governance for test data processes (policies, roles, KPIs).

• Sustainable know-how transfer: empowered internal teams to operate solutions on their own.

• Methods & technologies: S/4HANA, SAP, K2View, EPI-USE, test data management, data masking, data provisioning, test strategy, test management, coaching & enablement, Azure DevOps, Microsoft Office 365, Gemini.

• Risk Management
• Incident Management
• Security Analysis
• Secure Coding
• Information Security Management System (ISMS)

• Responsibility for testing and quality assurance of application processes
• Creation and execution of test cases based on defined acceptance criteria
• Documentation of deviations and analysis, as well as initiation of necessary corrective actions
• Ensuring the flow of information within the team and with other specialist departments
• Maintenance and further development of test automation
• Adapting Selenium-based automation to every release and sprint change
• Extending test automation with new processes
• Performing security tests
• Identifying typical vulnerabilities (e.g. XSS, SQL injection, insecure headers) through automated tests in the CI/CD flow
• Use of technologies Selenium (including integration with security scanners such as OWASP ZAP), Unix/SQL environments and optionally Cypress, SAP, C#, Java, GitLab, Jira, Confluence, REST API, Postman, HP-ALM, SSI, Octane, WinSCP.

• Ensured security compliance across 23,000+ endpoints, including 5,000+ business-critical servers and 18,000+ workstations, achieving a >95% compliance rate and aligning with industry standards such as ISO 27001 and CIS benchmarks.
• Led remediation efforts by deploying OS and third-party updates in phased rollouts, eliminating 80%+ of critical vulnerabilities within 6 months while ensuring zero unplanned service disruptions.
• Designed and implemented PowerShell and Python scripts with 99.5% reliability, automating patch validation, compliance tracking, and system health checks—reducing manual intervention by 70%.
• Utilized Kali Linux for proactive threat detection; monitored network traffic and background services using tools like Wireshark, Nmap, and Netstat.
• Conducted web application penetration testing using OWASP ZAP and Burp Suite, identifying and reporting vulnerabilities and reducing overall application risk exposure by 60%.
• Engaged with security teams, developers, and senior IT leadership to discuss risk posture, present vulnerability assessments, and define mitigation strategies aligned with business objectives.
• Monitored system performance during high-impact software and patch deployments, leading support and backup teams to resolve issues swiftly, achieving 98%+ deployment success rate and preventing potential downtime-related financial losses across critical infrastructure.