Gerbert Leytner

Security researcher and penetration tester with hands-on experience assessing web, network, cloud, and API attack surfaces, and a development background that strengthens vulnerability analysis and exploit understanding. Skilled in Python and JavaScript for building security automation, with working familiarity in AI/agentic tooling (function calling, tool-use pipelines) applied to security triage and workflow optimization. Track record of responsibly disclosing high-impact vulnerabilities — XSS, SSRF, broken authentication, open redirects, and API security flaws — through structured engagements and independent bug bounty research.

CompTIA Security+ and Network+ certified; HackTheBox Certified Web Exploitation Specialist (CWES).

Associate Penetration Tester - Missouri Cybersecurity Center of Excellence (MCCOE)

(2025-10)

• Conduct real-world offensive security engagements spanning web, network, cloud, and social engineering assessments — directly assessing security vulnerabilities across diverse client environments
• Perform web and network application assessments using Nmap, Burp Suite, and OWASP ZAP to identify, validate, and document security weaknesses, applying systematic investigation methods consistent with known vulnerability classes and exploit techniques
• Execute cloud penetration testing engagements, assessing IAM misconfigurations and exposed attack surfaces, and analyze network traffic/log data to detect anomalies and support incident response
• Produce structured technical reports detailing vulnerabilities, risk severity, and remediation guidance for cross-functional stakeholders — strengthening communication across technical teams

Independent Security Researcher - Bug Bounty Platforms — HackerOne, Bugcrowd, YesWeHack, Intigriti - Remote

• Conduct manual web application security testing across multiple bug bounty programs, focused on authentication systems, APIs, and client-side logic — domains directly relevant to securing iOS, macOS, watchOS, and tvOS platforms
• Discovered and responsibly disclosed vulnerabilities including XSS, SSRF, open redirect chains, and API security flaws across production applications, developing proof-of-concept exploits and detailed reports per industry-standard disclosure practices
• Continuously advance offensive security skills through HackTheBox labs and CTF competitions, maintaining current knowledge of emerging attack techniques

Freelance Web Developer - Self-Employed - Remote

(2023)

• Design and build responsive, performance-optimized websites and web applications, applying secure development practices to mitigate injection vulnerabilities, broken authentication, and security misconfigurations
• Apply application architecture knowledge to identify logic flaws and security weaknesses from a developer's perspective; build and integrate lightweight automation and AI-assisted tooling, including agentic and function-calling based features

General Contractor - Self-Employed - Various Locations

(2015 - 2019)

• Managed residential and commercial projects end-to-end — scope, scheduling, budgeting, and delivery — building project management and communication skills transferable to coordinating security engagements across teams

High School Diploma - Benjamin Franklin High School