Asad Ali

Certified cybersecurity professional with expertise in offensive security, red/blue team operations, SIEM, threat intelligence, and GRC. Skilled in penetration testing, vulnerability assessment, incident response, digital forensics, and risk management, leveraging advanced labs, real-world exploit development, and industry certifications to strengthen organizational security posture, detect and mitigate threats, and ensure regulatory compliance and resilience.

Offensive Security (Red Teaming) at Cyberster (2026-06 – Present)

• Conducted comprehensive reconnaissance and attack surface mapping using OSINT, subdomain enumeration, DNS analysis, technology fingerprinting, and infrastructure profiling to identify organizational assets and potential entry points.
• Performed network and web application security assessments, including port and service enumeration, vulnerability assessment, CVE mapping, directory and parameter discovery, and OWASP Top 10 testing (SQL Injection, XSS, IDOR, and Local File Inclusion).
• Executed penetration testing activities in controlled lab environments, including exploitation, Linux and Windows privilege escalation, post-exploitation, persistence, credential harvesting, Active Directory enumeration, Kerberos security assessments, lateral movement, and network pivoting.
• Conducted cloud and modern infrastructure security assessments involving AWS/Azure reconnaissance, IAM analysis, container security evaluation, and security validation against AV/EDR technologies and Windows security controls.
• Prepared professional penetration testing documentation, including technical findings, evidence collection, vulnerability reports, remediation recommendations aligned with CVSS and MITRE ATT&CK, while adhering to ethical hacking and responsible disclosure practices.

Offensive Security/ Pentesting at Black Byt3 (2026-03 – 2026-06)

• Established expertise in penetration testing methodologies, ethical hacking principles, and engagement protocols leveraging MITRE ATT&CK and industry-standard frameworks.
• Executed in-depth passive and active reconnaissance, including DNS analysis, subdomain enumeration, Google/GitHub dorking, and WAF detection to assess attack surfaces.
• Performed web application security testing using Burp Suite, Nmap, ffuf, and Katana for traffic analysis, port scanning, directory fuzzing, and endpoint discovery.
• Designed and managed a dedicated Kali Linux lab with Metasploitable 2 & 3 environments for scanning, service enumeration, OS fingerprinting, and vulnerability assessment.
• Compiled comprehensive penetration testing reports, detailing attack surfaces, enumeration results, and security observations with structured documentation and evidence tracking.

Blue Team (SOC Analyst) at Cyberster (2026-03 – 2026-05)

• Architected and deployed a full SOC lab using VirtualBox and Wazuh SIEM, enabling centralized log aggregation, alerting, and endpoint visibility across Linux and Windows environments.
• Configured Wazuh (FIM, custom rules, active response) and integrated Suricata for network threat detection, creating custom IDS signatures and tuning rules to reduce false positives.
• Implemented perimeter security with pfSense, centralized logs, and leveraged threat intelligence feeds VirusTotal, Abuse.ch, MITRE ATT&CK for proactive IOC-based threat hunting.
• Conducted vulnerability assessments, static/dynamic malware analysis, and executed Red vs Blue attack simulations, including brute-force, privilege escalation, and data exfiltration exercises.
• Developed and executed NIST-aligned incident response plans, performed digital forensics FTK Imager, Autopsy, analyzed Windows artifacts, reconstructed timelines, and produced executive reports and SOC dashboards.

Red Team (Offensive Security) at ITSOLERA Pvt Ltd (2026-01 – 2026-04)

• Developed custom offensive security tools including a reconnaissance automation framework and advanced payload generation system to support attack surface mapping and exploitation workflows
• Conducted vulnerability research and exploitation of real-world CVEs including Apache Struts2 RCE (CVE-2017-5638), Drupalgeddon2 (CVE-2018-7600), Apache Path Traversal (CVE-2021-41773), SMBGhost (CVE-2020-0796), and Sudo Buffer Overflow (CVE-2021-3156) across web, Linux, and Windows environments
• Built and configured isolated lab environments (Docker/VM) to safely replicate vulnerable systems, validate exploitability, and simulate real-world attack scenarios
• Designed and executed proof-of-concept (PoC) exploits using Python/Bash, achieving outcomes such as remote code execution, privilege escalation, reverse shells, and command execution
• Documented end-to-end exploitation lifecycle including root cause analysis, exploit development, payload logic, proof of exploitation, and mitigation strategies aligned with ethical hacking practices

Penetration Testing Intern at National Cyber Emergency Response Team (NCERT) Pakistan (2025-07 – 2025-08)

• Conducted comprehensive reconnaissance, scanning, and vulnerability assessments on Linux and Windows systems, leveraging Nessus to identify and prioritize security risks
• Performed exploitation and privilege escalation using misconfigurations, SUID binaries, and weak service permissions to gain root/administrator access
• Executed client-side attack simulations with crafted payloads targeting Windows 10/11 to evaluate endpoint security gaps and user behavior vulnerabilities
• Developed a custom web vulnerability scanner to automate passive reconnaissance and detect issues including insecure headers, cookies, XSS, and SQL injection
• Documented and reported end-to-end penetration testing findings aligned with OWASP Top 10, including impact analysis and mitigation recommendations

Governance, Risk and Compliance (GRC) Intern at National Cyber Emergency Response Team (NCERT) Pakistan (2025-07 – 2025-08)

• Assisted in implementing an ISMS in line with ISO/IEC 27001 by defining scope, assessing organizational context, and analyzing internal and external risks along with key stakeholders
• Conducted risk assessments, threat modeling, and vulnerability analyses using CIA principles, and formulated risk treatment plans to mitigate identified threats
• Performed gap analysis, drafted security policies, and recommended controls aligned with ISO 27001 Annex A
• Defined security metrics and KPIs, classified controls (preventive, detective, corrective), and supported audit preparation and compliance documentation
• Developed ISMS deliverables including risk matrices, compliance records, and asset inventories, while contributing to security awareness programs, training initiatives, and management review processes

Bachelor of Science in Cyber Security – Iqra University Karachi (2025-12)