Sr Penetration Tester · He/Him
Mobile · Internal / Active Directory · AWS Red Team
I break things for a living, finding the bugs before someone with worse intentions does. In offensive security since 2021, day-to-day work spanning mobile applications, internal Active Directory environments, and cloud red-team operations. I prefer scrappy, on-the-box tooling over uploading binaries, and write a lot of my own helpers when something doesn't exist yet.
Mobile Application Penetration Testing (iOS & Android)
- Static analysis of
.ipaand.apkbinaries — decompilation, secret hunting, third-party SDK inventory, dependency / manifest review - Runtime analysis on jailbroken iOS and rooted Android — Frida instrumentation, method hooking, traffic interception, certificate-pinning bypasses, keychain / keystore extraction
- Aligned with OWASP MASVS / MASTG
Internal / Active Directory blackbox
- Domain enumeration over low-priv VPN sessions
- ADCS misconfiguration hunting (ESC1–ESC8) and exploitation PoCs
- Coercion + relay chains, RBCD abuse, Kerberoasting, gMSA password retrieval
- Constrained Language Mode bypasses
- PowerShell-only tooling for environments with no internet or binary drops
Cloud red team (AWS)
- AWS-focused offensive ops via the HackTricks AWS Red Team Apprentice methodology
Offensive security
- HackTricks AWS Red Team Apprentice (ARTA) — 2025
- Zero-Point Security Red Team Operator (RTO) — 2025
- OffSec OSCP — 2024
- INE Mobile Application Penetration Tester (eMAPT) — 2024
- INE eJPT — 2024
Cloud / governance
- ISC2 CCSP — 2023
- ISC2 SSCP — 2023
CompTIA
- PenTest+ · CySA+ · Security+ · Network+ · A+ · Project+
- Stackables: CSAP (Security Analytics Professional), CSIS (Secure Infrastructure Specialist), CIOS (IT Operations Specialist)
Other
- ITIL Foundation
- Baltimore Cyber Range graduate
Master's graduate — Western Governors University
Mobile · Active Directory · AWS · Offensive Security · Reverse Engineering