Penetration Testing Experts in Berlin

• Responsibilities:
• Collaborate with Product Owner to define functional and technical requirements
• Quarterly Roadmap definition with Executives and Product Owner
• Fix bug and develop new features in Go and Typescript
• Manage and mentor full stack engineering team
• System Design in a micro-service environment
• Guarantee application security
• Improve engineering efficiency and deliverable quality
• Support automation with agentic-AI workflow
• Achievements:
• Improved security and data privacy awareness in the team with workshops around best practices, security measures and attacks types
• Conceptualized, designed and successfully released a new real-time chat application for our partners improving partner/company relationship and collaboration efficiency in Go and Typescript
• Reduced meeting hours for engineers by restructuring projects preparation workflow in collaboration with product team

• Conducting cybersecurity readiness checks based on an in-house assessment methodology
• Analyzing the external attack surface using the Graydaxe EASM platform
• Assessing maturity levels and deriving prioritized recommendations for action

• Projects for federal networks (NdB).
• CR management, EoL change requests, design and documentation according to ITSCM.
• Data center planning.
• Project management and engineering subproject management.
• Software development for virtual server environments according to BSI.

• Defined and executed a comprehensive security roadmap: integrated Shift-Left Security, CNAPP, and DevSecOps principles to streamline secure product development and reduce risk exposure.
• Established a robust threat modeling framework: embedded security into design processes, enabling early identification of vulnerabilities and reducing potential risks.
• Developed a scalable Vulnerability Management program: accelerated detection and remediation of new vulnerabilities, significantly shortening the risk response cycle.
• Enhanced cloud and container security: leveraged advanced tools such as Tetragon to achieve deeper visibility and implement a defense-in-depth strategy.
• Automated security controls within CI/CD pipelines: integrated security measures into the development lifecycle to maintain continuous delivery with robust safeguards.
• Championed cross-functional collaboration: partnered with developers and infrastructure teams to prioritize threats and align remediation efforts, fostering a unified security culture.
• Ensured regulatory compliance and audit readiness: collaborated closely with the InfoSec team to adhere to internal policies and successfully support audits for standards like PCI-DSS and SOC2.

• Developed a custom tool using the Mistral 7B LLM to scan, validate and report security vulnerabilities.
• Security tested AI agents, bots, and other LLMs with a focus on prompt injection, model inversion, data poisoning, EDR/AV bypass and evasion techniques, membership inference, model evasion, overfitting to malicious inputs and contextual manipulation.
• Onboarded repositories to SAST solutions for security scanning, implemented secrets scanning, DAST, SCA, and utilized ZAP for DAST in CI/CD pipelines.
• Engaged in security awareness trainings, developed CTF challenges and training materials to enhance developer security knowledge.
• Planned and executed bi-annual red teaming operations based on the MITRE ATT&CK framework and led internal and external pentests based on the OWASP Top 10 framework for 70+ applications worldwide, resulting in detection, reporting, and remediation of hundreds of vulnerabilities.
• Triaged HackerOne reports.

I worked on automating cold outreach.

• Developed a queue architecture to support the parallel execution of large volumes of background tasks.
• Integrated multiple email delivery providers.
• Implemented an LLM-based data enrichment process.

Technologies: TypeScript, React, Node.js, Next.js, Drizzle ORM, PostgreSQL, Next-Auth, JWT, Docker, Kubernetes, AWS, CloudFlare, Traefik, Groq, Jest, Figma

• Developed Red Team infrastructure for real-world attack simulations using Sliver C2 and custom tools
• Executed advanced Red Team operations, integrating AI/LLM security research for prompt injection attacks
• Conducted comprehensive breach assessment attacks and vulnerability assessments across enterprise infrastructure
• Performed root cause analysis and purple team exercises, generating executive-level reports
• Lead LLM red teaming initiatives to improve AI model security for GPT-4, Mistral, and internal GenAI models

• Operational management of the company: building teams and infrastructure, developing products, analysis and implementation of IT security measures

• Project assignments in the IT security environment focusing on establishing blue teaming activities (defensive processes and technologies) to defend against cyber attacks

• Conducting red teaming processes, including penetration tests and security analyses for companies

• Consulting on setting up Security Operation Centers and implementing SIEM systems, and building Computer Incident Response Teams (CSIRT)

• Auditor for ISO 9001 and ISO 27001, § 8a, ISO 27019, § 11 1a EnWG, TISAX

• Advising companies in critical infrastructures on information security and compliance with the IT Security Act

• Building SIEM/SOC processes and SOC analyst work (Splunk, ELK-Stack)

• Integrating data into monitoring tools (Prometheus, Grafana)

• Consulting on BSI IT baseline protection, ISO 9001, ISO 27001, BCM, ITIL and risk management

• Security assessments and penetration testing of IT and network architectures

• Led telecom security testing team & SOC deployments across Tier-1 carriers; reduced critical vulnerabilities by 30%.
• Conducted 5G/O-RAN fuzzing, penetration testing, and vulnerability research (basebands, RAN, core).
• Designed testbeds for protocol fuzzing (AFL++, LibAFL) on 5G stacks.
• delivered client workshops on secure telecom with AI assisted workflows.
• Researched AI-driven SOC and penetration testing (LLMs for log triage, anomaly detection, adversarial monitoring).

• Preparing an oil company for KRITIS auditing
• KRITIS consulting
• Creating necessary policies, processes, and guidelines in line with KRITIS requirements
• Tools and methodologies used: ISO/IEC 27001, BSI IT Baseline Protection, KRITIS-V