Muzamil Shah

Cyber Security Engineer with 8+ years of experience across Application Security, Penetration Testing, and Governance Risk & Compliance. Specialises in securing web, mobile, and API applications throughout the SDLC — using SAST, DAST, and SCA tooling — while also contributing to compliance programmes (ISO 27001, PCI DSS, NESA, CBUAE) across multi-regional fintech environments. Recognised bug bounty researcher with 100+ vulnerabilities acknowledged by Intel, Sony, Atlassian, and others.

Cyber Security Engineer — Application Security at NymCard (2024-06 – Present)

• Work as part of the Application Security function across 4+ regional environments — reviewing web, mobile, and API applications for vulnerabilities and secure design across the SDLC.
• Helped embed security tooling across the SDLC — IDE-level security plugins in development environments, and repository scanning with Trivy and TruffleHog for vulnerability and secrets detection.
• Supported SAST integration with SonarQube in CI/CD pipelines, and implemented Dependency-Track for SCA and end-of-life tracking of third-party libraries, flagging outdated or vulnerable dependencies ahead of release.
• Ran DAST assessments using Burp Suite and participated in release-cycle security testing, validating builds and coordinating remediation with engineering teams before they shipped to production.
• Supported PCI DSS and PCI-SSF (Payment Software Security Framework) compliance across multiple environments — mapping application-level controls, building evidence packages, and helping close audit findings within agreed timelines.
• Contributed to ISO 27001 compliance efforts — supporting policy development, control implementation, and evidence collection across the ISMS, and assisted with NESA IT Audit and CBUAE audit engagements.
• Administered KnowBe4 phishing simulations and security awareness campaigns, achieving a measurable reduction in susceptibility rates across the organisation.
• Collaborated with Engineering, Product, Legal, and Operations to embed application security into business processes and product roadmaps.

Senior Application Security Engineer at TPS Worldwide (2019-06 – 2024-06)

• Led the application security programme, serving as the subject matter expert for web, mobile, and API security across the organisation.
• Conducted thorough assessments of web and mobile applications and APIs using SAST, DAST, and SCA tools.
• Developed and enforced secure coding practices, integrating security into the SDLC and DevOps processes.
• Facilitated security audits including PA-DSS and PCI SSF, ensuring compliance with regulatory requirements and industry standards.
• Reviewed third-party applications and APIs for security risks; maintained documentation of security policies and procedures.
• Mentored junior team members, participated in security awareness programmes, and collaborated with cross-functional teams.
• Worked closely with the GRC team to align application security practices with organisational policies and support compliance efforts.

Web Application Security Tester at Double Dot Media (2017-03 – 2018-05)

• Identified 15+ critical and high-severity vulnerabilities (XSS, SQLi, Broken Access Control) across the web application portfolio.
• Delivered risk-rated reports with proof-of-concept demonstrations; all findings remediated within agreed SLAs.

Bug Bounty Researcher at HackerOne (2016-04 – Present)

• 100+ valid vulnerabilities reported across 20+ organisations — SSRF, XSS, Broken Access Control, Information Disclosure, Business Logic.
• Acknowledged by Intel, Sony, Atlassian, Teamwork, HackerOne, and Edmodo.

BS in Software Engineering – Bahria University Karachi Campus (2015 – 2019)