~$ whoami
Security Engineer at Mesiniaga Berhad, focused on VAPT & penetration testing, endpoint security (EDR/EDLP) and security automation. Previously a SIEM Engineer intern at Bank Negara Malaysia. CEH · CompTIA Security+ · (ISC)² CC.
I'm a Security Engineer at Mesiniaga Berhad. My work centres on VAPT and penetration testing of internal web applications and company products, endpoint security across EDR and Endpoint DLP, and building security automation — including an AI-assisted phishing simulation platform that won 1st place in the company's innovation competition.
Earlier I interned as a SIEM Engineer at Bank Negara Malaysia, working on log-source onboarding, detection rules and threat-intelligence automation.
I hold a Bachelor of Computer Science (Hons.) in Information Security and Assurance from USIM (CGPA 3.64) as a JPA Scholarship (PIDN) holder and Dean's List awardee. Outside work I compete in CTFs and run cybersecurity awareness talks and workshops.
2025
Global benchmark for core security skills — network security, threats, cryptography and operations.
2024
EC-Council CEH — offensive security methodology, exploitation techniques and countermeasures.
2023
(ISC)² CC — security principles, incident response, access controls and network security.
Authorized pentest of a payment gateway and EDC API integration for PCI-DSS compliance. Found critical time-based blind SQLi, IDOR, reflected XSS and session weaknesses; delivered technical + executive reports with a full remediation roadmap.
Nessus + OWASP ZAP assessment with manual validation. Confirmed account enumeration via the login endpoint, bypassed an Akamai WAF through direct origin-IP access, and found an email-verification bypass where the token was exposed in the response body.
Authorized physical intrusion and social engineering engagement — bypassed guard checkpoints, tailgated into restricted areas, and ran controlled vishing campaigns. Delivered findings with countermeasures for visitor management and awareness training.
Authorized penetration test on a Malaysian government corporate website's authentication system — including admin privilege escalation — against predefined use cases and a security testing checklist.
An internal platform that automates phishing awareness campaigns end-to-end — orchestration, user interaction tracking and dynamic content generation — using AI to make simulations more realistic. Built to strengthen staff awareness; awarded 1st place in Mesiniaga's innovation competition.
Self-hosted lab on Proxmox with LXC containers running a media server, private cloud and a forensic lab. Exposed securely via Cloudflare Tunnel on a registered domain, with Tailscale VPN for remote access.
Python collectors fetching the latest global and Malaysia-focused Indicators of Compromise — hashes, URLs, domains and IP addresses — visualized in a custom Flask web dashboard.
Python IDS detecting malicious traffic — port scans and DDoS patterns — via packet flag analysis, with real-time alerts pushed to Telegram and email via webhooks.
Talks, community sessions and media coverage where my work has been featured.
Featured for delivering cybersecurity awareness sessions to students at SMA Muhammadiyah and Universitas Gadjah Mada (UGM) under USIM's GISO outreach.
Read featureVolunteer speaker on Web Exploitation CTF for UNITEN's Pro-C club, plus a "ShareWithUs" session on passing the (ISC)² Certified in Cybersecurity exam.
Read featureSchool feature on the USIM visit where I presented on attacks, threats and vulnerabilities — covering malware, phishing and ransomware for the students.
Read featureIndonesian news coverage of the SMA Muhi Yogyakarta session, quoting my talk — "a good system isn't just one that works well, but one that can withstand attacks."
Read article~$ ./connect --via linkedin
I'm open to security engineering roles, VAPT engagements and cybersecurity speaking / training. Have a project, a scope, or just want to talk security? Reach me on LinkedIn.
Connect on LinkedIn