Security Analyst / Penetration Tester·DevSecOps · AppSec · Offensive Security

Hashar
Mujahid

Architecting Secure Intelligence. Offensive security, DevSecOps, malware research, and production-grade detection, forged across banks, fintech, and enterprise pipelines.

Munich, Germany

View work 350 findings DevSecOps Contact

Currently · 01/2026 – 10/2026

Penetration Testing Engineer

Trillium Information Security Systems

Scroll

// about

Built for the hard problems

I hunt for vulnerabilities across web, API, mobile, and network targets, then bake security into delivery pipelines. Offensive research, Android malware analysis, and shipping ML-backed detection alongside DevSecOps practices that keep shipping safe.

Operating principle
“In the midst of chaos, there is also opportunity”
Sun-Tzu

350Findings reported

85High / Critical

10+Banks assessed

6k+Devices protected

#280HTB global rank

// experience

Career trajectory

Roles and impact drawn directly from my CVs: metrics, timelines, and outcomes.

5 checkpoints · reverse chronology

01
01/2026 – 10/2026Core role
Penetration Testing Engineer
Trillium Information Security Systems
Led VAPT engagements for 10+ banks: offense meets reportable risk.
VAPTOWASPCVSSSTRIDE
- Reported 350 findings with 85 High/Critical issues across 67 CWEs.
- Chained mobile banking flaws into account takeover and unauthorized fund transfer.
- Executed Web, Mobile (Android), API, and Network assessments under OWASP WSTG + MASTG.
- Produced CVSS v3.1 reports and ran technical debriefs with C-level stakeholders.
- Applied STRIDE threat modeling to critical payment and auth flows.
02
12/2023 – 12/2025Core role
Security Researcher / Penetration Tester
Pligence
Offensive research, malware detection, product hardening, and CI/CD security.
Malware REML DefenseDevSecOpsThreat Intel
- Built an Android dynamic analysis engine reaching 92% malware detection at 3% FPR.
- Reverse-engineered native SO libraries in Ghidra/Jadx to feed an ML model at 89% accuracy.
- Wired SonarQube + OWASP ZAP into CI/CD for continuous SAST/DAST gates.
- Stood up a threat-intel pipeline (phishing, malware, IP feeds) improving TI throughput by 10%.
- Led a real-time Safe Browsing solution protecting 6k+ organizational devices.
03
09/2023 – 11/2023
Security Research Trainee
Pligence
Internship focused on web application security and research workflows.
Web AppSecResearch
- Supported vulnerability research and write-up production for internal products.
- Practiced reconnaissance, exploitation, and responsible disclosure end-to-end.
04
04/2023 – 12/2024
Freelance Security Researcher
Independent
Independent consulting for international clients.
CloudAppSec
- Assessed security of web applications, APIs, and databases.
- Hardened cloud infrastructure and advised on remediation priorities.
05
08/2022 – 03/2024
Information Security Content Writer
Infosec Publications
Published 30+ technical blogs on Network, AD, Web, and API security.
WritingCommunity
- Documented exploitation techniques and remediation strategies for practitioners.
- Built a following across Medium with 72k+ reads and 750+ followers.

// devsecops

Security in the delivery loop

Offense informs the pipeline: threat modeling early, SAST/DAST in CI, hardened builds, and runtime signals feeding the backlog.

Stage 01Plan
Threat model early with STRIDE; define security acceptance criteria.
STRIDEThreat DragonRisk rating
Stage 02Code
SAST and dependency hygiene on every pull request.
SonarQubeSnykSecrets scan
Stage 03Build
Hardened images, base scanning, and policy-as-code gates.
DockerKubernetesKube-bench
Stage 04Test
DAST and API abuse paths before promotion.
OWASP ZAPBurp SuiteMASTG
Stage 05Release
Runtime signals feed back into the backlog.
FalcoGrafanaSIEM

// skills & credentials

Capabilities & proof

Tooling, frameworks, certifications, and education, sourced from my CVs.

Proficiency map

English: C1German: A1 (target B1 by 03/2027)

Development

Python (Django, FastAPI, Flask)C#JavaJavaScriptSQLBashRedisApache Kafka

Cyber Security

Web/API/Mobile/Network/AD PentestingAndroid Malware AnalysisReverse EngineeringThreat Intel & ModelingSTRIDE Threat Modeling

DevSecOps & Cloud

DockerKubernetesJenkinsGitHub ActionsSAST / DASTSonarQubeOWASP ZAPSnykFalcoKube-benchAnsibleAzureGCPGrafana

Tools

Burp Suite ProFridaObjectionJadxGhidraRadare2NessusOpenVASHavocWiresharkYARAWazuhSigmaBloodHoundImpacketNetExecThreat Dragon

Frameworks

OWASP Top 10 / WSTG / MASTGCVSS v3.1NISTISO 27001MITRE ATT&CKCI/CD Security

Certifications

CPTS

Hack The Box

12/2025

Certified Penetration Testing Specialist: advanced enterprise & AD assessments.

Mobile App Pentesting

TCM Security

01/2024

Practical API Hacking

TCM Security

07/2023

Co

CompTIA Security+

CompTIA

02/2023

API Penetration Testing

APISec University

01/2023

Cybersecurity Analyst

IBM

08/2022

Ci

Cisco CCNA Training

Cisco

04/2022

Education

MSc International Information Systems

In progress

Friedrich-Alexander-Universität Erlangen-Nürnberg

09/2026 – Present

Graduate studies in information systems with a security and systems focus.

BSc Information Technology

Graduated

The Islamia University of Bahawalpur

09/2019 – 05/2023

Thesis: TeleSpy, Blended Spyware with Advanced Evasion Capabilities. Final grade 1.4 (German scale).

Competitive hacking

#1 country

Global rank #280

Hack The Box · CPTS certified · 300+ PentesterLab labs

// projects

Applied research & development

Bridging offensive research and production-ready defense mechanisms.

01Open source

Stellar Crypto Exchange & Bot Platform

Architected a cryptocurrency exchange on the Stellar network with automated trading bot orchestration.

StellarBlockchainTrading AlgorithmsFinTech

02Proprietary

Android Behavioral Analysis Engine

Runtime malware detection engine that analyzes behavior artifacts and raises real-time security alerts.

Dynamic AnalysisMalware DetectionReal-time Alerting

03Proprietary

GNN-based Android Malware Engine

Graph Neural Network models detecting sophisticated malware in Android apps and native SO files.

Machine LearningGraph Neural NetworksReverse Engineering

04Proprietary

ML-Powered Safe Browsing Solution

Real-time inline blocking of phishing and malicious sites via rapid machine-learning inference.

Phishing DetectionInline BlockingNetwork Security

05Open source

Deutsch Karten

German A1 to C2 vocabulary dataset of 5,684 words with a solo Android flashcard app featuring audio, placement, and spaced repetition.

AndroidKotlinJetpack ComposeDatasetSpaced Repetition

// vulnerability archive

350 findings. Zero theater.

An anonymized archive of reported vulnerabilities from real engagements: severity and category distributions only; no client identifiers.

Critical

27

High

58

Medium

113

Low

152

By category

Web228

Network55

Mobile67

Filters

Severity

Technical publications

30+ write-ups · 72k+ reads · 750+ followers, synchronized live from Medium.

All write-ups on Medium

// contact

Let's build something secure

Open to penetration testing and AppSec-DevSecOps engagements, research collaborations, and interesting security problems.

Get in touch

mujahid.hashar@gmail.com

Munich, Germany

DevSecOps · AppSec · Offensive Security

Send email

Elsewhere

Find write-ups, repos, and professional history on my profiles; no phone, just the open channels.

HasharMujahid