Overview

Alongside my full-time DevSecOps role, I work as an independent penetration testing consultant. Testing systems from the attacker's side sharpens the defensive work I do every day. I also know the client's side of the table. For more than two years I've managed and delivered my employer's annual penetration testing programme: scoping each test, engaging vendors, and tracking remediation through to closure.

How I work

• Agree scope and rules of engagement with the client before any testing begins
• Carry out reconnaissance and OSINT to map the attack surface
• Run vulnerability scanning with Nessus and Nmap, then verify findings manually
• Test web applications with Burp Suite, and WordPress sites with WPScan
• Analyse traffic with Wireshark where the engagement calls for it
• Report risk-rated findings in plain language, with practical remediation guidance

Tools

Kali Linux, Burp Suite, Nmap, Nessus, WPScan, Wireshark, OSINT Framework.

Credentials

Certified Ethical Hacker (CEH), EC-Council.