Md Shofiur R.Private profile: Upwork shows its earnings only to signed-in members, so we check it every few weeks, not daily. MRR here is a rough estimate (Upwork's six-month earnings ÷ months active). Last read Nov 5, 2026.

If your web application, API, or AI system has vulnerabilities, attackers will find them. My job is to find them first. I'm Md Shofiur, a Certified Ethical Hacker (CEH) and senior penetration tester with 8+ years securing applications and infrastructure across fintech, healthcare, e-commerce, and SaaS. I'm Top Rated on Upwork with a 100% Job Success Score across every engagement I've taken on. What I test: Web applications (OWASP Top 10 methodology) REST and GraphQL APIs (authentication, injection, IDOR, rate limiting) AI-powered applications and LLM systems (OWASP LLM Top 10) WordPress, Laravel, and custom CMS platforms Network and VPS infrastructure PCI DSS, HIPAA, and ISO 27001 compliance environments What makes my work different: I don't run a scanner and call it a pentest. Every engagement starts with manual reconnaissance, follows a structured methodology, and ends with a report your developers can actually act on. Each finding includes a risk rating, business impact, step-by-step proof of concept, and specific remediation guidance — not just a list of CVEs. AI Security Testing: I'm one of the few penetration testers offering dedicated security assessments for AI systems. If your company uses an LLM-powered chatbot, AI agent, RAG system, or AI API, I test it against the full OWASP LLM Top 10 — covering prompt injection, data extraction, insecure output handling, excessive agency, and more. Compliance experience: PCI DSS v4.0 external and internal penetration testing HIPAA security rule technical safeguard assessments ISO/IEC 27001 security control validation SOC 2 readiness penetration testing support Certifications: Certified Ethical Hacker (CEH) API Penetration Testing API Security for PCI Compliance ISO/IEC 27001 Information Security Associate Certified in Cybersecurity What you get from every engagement: Every report I deliver includes an executive summary for management, a technical findings section with full proof of concept for each vulnerability, risk ratings using industry-standard scoring, and a prioritized remediation roadmap your team can follow immediately. I respond within 4 hours and offer a free 15-minute discovery call before any engagement starts. Message me with your project details and I'll tell you exactly what I'd find and how I'd approach it.