Zain Ali

Cybersecurity Analyst | Penetration Tester

Talent

Lahore, PunjabMember since July 17, 2026

Burp SuiteNmapMetasploitBashPythonOWASP Top 10Network penetration testingSQL injectionXSSSSRFAuthenticationAccess controlDeserializationBusiness logic flawsAPI parameter abuseTech-stack fingerprintingParameter analysisManual exploitationPCI DSS

Hire this person

Send a job offer directly to this candidate

Burp SuiteNmapMetasploitBashPython

About

Hands-on cybersecurity professional focused on web application and network penetration testing, with practical experience gained through structured self-study, PortSwigger Web Security Academy, and active bug bounty testing on Bugcrowd. Delivered a paid freelance ISO 27001 implementation support project on Fiverr. Currently completing an ISO 27001 Lead Implementer course.

Comfortable across the full penetration testing toolchain, with working scripting ability in Bash and Python. Looking to bring a practical, testing-first mindset into a full-time pentesting or security analyst role.

Experience

Freelance Security Consultant — ISO 27001 Implementation Support - Fiverr - Remote

Engaged by a client to support ISO 27001 Information Security Management System (ISMS) implementation as a paid consulting project (contract value: $3,500).
Assisted with ISMS documentation, control mapping, and implementation guidance based on ISO 27001 requirements.
Delivered the completed engagement to the client's satisfaction; project closed out on Fiverr.

Bug Bounty Hunter - Bugcrowd

Actively testing authorized public bug bounty programs, including tech-stack and vulnerability-class testing (e.g. LFI, API parameter abuse) against production targets such as CloudConvert and Monash College.
Apply a structured, hands-on methodology: recon, tech-stack fingerprinting, parameter analysis, and manual exploitation rather than automated-scanner-only testing.
Continue to refine real-world exploitation skills through live-target testing under authorized program scope.

Web Application Security — Self-Directed Training - PortSwigger Web Security Academy

Completed the full set of client-side and server-side vulnerability labs, covering areas such as SQL injection, XSS, SSRF, authentication, access control, deserialization, and business logic flaws.
Built practical, exploit-driven understanding of the OWASP Top 10 through guided, hands-on labs rather than theory alone.