Malkhaz Z.

OSEP and OSCP certified penetration tester and red team operator. I test the way an attacker works, manually and in context, rather than handing over a scanner report with the logo changed. Member of the Synack Red Team since January 2026, so my testing has been vetted against a live assessment standard by a third party. AZ-500 and AZ-104 certified on the Azure side. What I deliver: - Red team and adversary emulation: initial access, privilege escalation and lateral movement against a defended environment - AI and LLM security testing: prompt injection, agent and tool abuse, insecure output handling, and data exfiltration through model context - Web application and API penetration testing, OWASP Top 10 and beyond, including authorization and business logic flaws - Network and infrastructure testing, external and internal, plus Active Directory attack paths - Cloud security assessment across Azure and AWS - Mobile application security testing, Android and iOS - A written report with reproducible steps, CVSS risk ratings, and remediation a developer can act on Background: Over six years in security, more than four of them hands on in offensive testing. I have tested for a card processor, where PCI DSS scope and payment flows were the core of the work, and I came into testing from a bank SOC, so I know what the defenders on the other side actually see. How I work: I scope tightly and in writing, I test manually, and I report in a way that survives being handed to an auditor. If a finding is theoretical I say so. If it is exploitable I show the chain. I work in UTC+4, so my day starts before European business hours and overlaps the Gulf completely, which helps when testing has to happen outside a client's working window. Happy to start with a short, scoped engagement so you can judge the work before committing to a larger programme.