Skip to content
EIEnes Ismaili
Open for new work in Q4 2026

Find the flaws.Prove the impact.Make the fix hold.

I'm Enes. I test production systems the way an attacker would, then stay until the remediation is verified. Application and API penetration testing, Wazuh SIEM engineering, and cloud hardening.

Start a projectSee services
  • Wazuh Ambassador
  • 2 MITRE CAN requests
  • NDA-friendly
report-0417
illustrative
Findings by severity13 total
  • Critical1
  • High3
  • Medium5
  • Low4

Selected findings

  • F-01BOLA on invoice endpoint/api/v2/invoices/{id}Critical
  • F-04JWT key confusionauth-serviceHigh
  • F-07Public bucket policyassets-cdn (S3)High
Reproduced, scored, retestedverified

An illustrative summary. Client findings are never published.

  • Burp Suite Pro
  • Nuclei
  • Nmap
  • ffuf
  • sqlmap
  • Metasploit
  • WPScan
  • Wazuh
  • Zabbix
  • AWS
  • GCP
  • Azure DevOps
  • Ceph RGW
  • GraphQL
  • OWASP Top 10
  • NIST 800-53
  • HIPAA
  • PCI DSS

2008

First sysadmin role

Infrastructure since

8+

Years offensive security

Web, API, network

2

MITRE CAN requests

Gerobug v2.7 findings

Wazuh

Official Ambassador

Detection engineering

01Services

Test it. Monitor it.
Harden it.

Most engagements are one of these. If your problem spans two, for example a pentest that should feed detection rules, we scope them together instead of pretending they are separate.

All services
01

Application & API testing

Manual, OWASP-aligned testing of your web app and APIs. Authentication, access control, business logic, and the flaws that only appear when someone actually tries to break in.

OWASP Top 10REST & GraphQLAuth flows
View service
02

Cloud & infrastructure

A focused review of the cloud and Linux estate your product sits on. Identity, object storage, network exposure, and the CDN edge in front of it.

AWSGCPS3 / Ceph RGW
View service
03

SIEM & detection

I design, deploy and tune Wazuh so your monitoring actually catches things. Log ingestion, correlation rules, file integrity monitoring and dashboards.

WazuhCorrelation rulesFIM
View service
04

Compliance hardening

I turn NIST SP 800-53, HIPAA and PCI DSS requirements into actual configuration, mapped to what your systems do, with evidence you can hand an auditor.

NIST SP 800-53HIPAAPCI DSS
View service
05

Bug bounty triage

I read every submission, reproduce it, score it fairly and tell you what is worth fixing. Your product team gets a queue they can trust.

HackerOneBugcrowdCVSS
View service
06

WordPress & hosting

Hardening and penetration testing for WordPress sites, plugins and shared hosting, from someone who has also administered the servers.

WordPressPHPWAF
View service
02How I work

Evidence over opinions.

Anyone can run a scanner. The value is in judgement: what is real, what matters to your business, and what actually closes the hole instead of hiding it.

  1. 01

    Scope

    A short call, then a written scope. Targets, rules of engagement, testing windows and anything that is out of bounds.

  2. 02

    Test

    Manual work against the real attack surface, with automated tooling where it helps. Findings are confirmed before they reach the report.

  3. 03

    Prove

    Every issue comes with reproduction steps, a CVSS score and a realistic impact statement. Critical is just a word without evidence.

  4. 04

    Verify

    After remediation I retest each finding and confirm it is closed. Most engagements stop before this step. This is the one that counts.

Manual first

Tools find patterns. People find the logic flaws that actually pay. Automated output is a starting point, never the deliverable.

Evidence you can replay

Requests, responses, payloads and recordings, so your engineers can reproduce the issue without another call.

Ranked by what matters

Exploitability and business impact, not a raw scanner count. Twelve real issues beat four hundred rows.

Honest severity

No inflation to pad the report, and no downplaying to keep an engagement comfortable. If it's low risk, it says low risk.

A report is not the deliverable. A fix is.

03Experience

Built in production, not in slides.

Eighteen years of running the systems and eight of breaking them on purpose. That mix keeps the findings practical, because I have been the person who has to apply the fix.

Jun 2026 to present

SOC Engineer

Cosmic Development

Run Wazuh SIEM monitoring, log analysis and alerting for a high-traffic production platform and its supporting infrastructure.

dedicated to Rumble.com, its CDN, Locals.com and Rumble Cloud

Mar 2026 to Aug 2026

Cyber Security Consultant

Qubitronix

Delivered a HIPAA, PCI DSS and NIST SP 800-53 hardening plan for a GCP-hosted Wazuh deployment: RBAC, GCP IAP-based MFA and network lockdown.

contract, US-based firm, remote

2025 to 2026

SIEM Engineer

DSS

Designed and deployed Wazuh SIEM from the ground up: architecture, data sources and compliance-driven tuning.

New York based managed security service provider

2023 to 2025

Penetration Tester / Security Analyst

Thor IT Solutions

Network and web application penetration tests to OWASP methodology, including manual testing of GraphQL APIs, Swagger/OpenAPI services and .NET applications: introspection abuse, BOLA, mass assignment and injection.

2021 to 2022

Linux Administrator & Web Penetration Tester

MKHOST

Administered Linux servers behind the hosting infrastructure: hardening, service configuration, user permissions and ongoing maintenance of web-hosting environments.

hosting provider

2013 to 2025

Freelance Penetration Tester

Independent

Web application and WordPress penetration tests across industries, with detailed reports.

2008 to 2017

System Administrator & Penetration Tester

Municipality of Cair

Administered Active Directory (GPO, OU structure, RBAC), Windows Server, network configuration and endpoint security for all municipal departments.

Full background

Skopje, CET, remote with US and EU teams

04Research & tooling

Public work that had to survive review.

Advisories, plugin audits and tooling, all public. This is the part of the job where you cannot round up your own severity.

GitHub profile
Advisory

Gerobug v2.7 vulnerability research

I audited the open-source bug bounty platform and confirmed two findings with live proof-of-concept exploits. Two MITRE CVE Numbering Authority reservation requests were filed (CAN-2026-2032157, CAN-2026-2032158) and a security advisory was published on GitHub.

  • 2 confirmed findings
  • 2 CAN requests
  • Public advisory
Research

WordPress plugin security audits

I reviewed widely deployed plugins including WooCommerce, Contact Form 7, WP Meta SEO, Fluent Forms, BackWPup and Post SMTP. The findings went through the Wordfence Bug Bounty program.

  • 6 plugins audited
  • Responsible disclosure
Tooling

Open-source tooling and vulnerable labs

An async rewrite of GCPBucketBrute, a Nuclei template for Swagger/OpenAPI discovery, and four free vulnerable VMs (eNotes, En0wn, WinPriv10, En3t) that people use to practise for certifications. I also wrote a Wazuh FIM guide for WordPress.

  • GCPBucketBrute
  • Nuclei
  • 4 labs
05Questions

The things people ask before signing.

Something not covered? Ask directly. A short answer costs nothing.

enes.ismaili@gmail.com
How does an engagement start?

A 30 minute call to understand what you are protecting and what triggered the request. Then a written scope and a fixed quote. Nothing runs until the scope, rules of engagement and testing windows are agreed in writing.

Do you need production access?

Not necessarily. A staging environment that mirrors production is usually the right place to start. If production testing is needed, we agree on testing windows, rate limits and a contact plan first.

What does a report actually contain?

A prioritized findings list with CVSS scores, reproduction steps, request and response evidence, business impact and remediation guidance. Plus an executive summary for whoever signs off on the budget.

Is retesting included?

Yes. Every project includes one retest window, so fixes are verified instead of assumed. You get a short report covering what closed, what remains and what changed.

Will you sign an NDA?

Yes, gladly. I work under NDA and strict confidentiality, and I can send a standard mutual NDA if you don't have one.

Do you work with teams outside Europe?

Yes. I'm based in Skopje and work regularly with US and EU teams. Written communication is the default, and calls are scheduled in a window that works for both sides.

We have no in-house security team. Is that a problem?

It's the normal case. Part of the work is making sure someone on your team can own the fixes afterwards, which is why every engagement ends with a walkthrough and not just a PDF.

Next step

Have something worth protecting?

Tell me what you are building and what is keeping you up at night. I'll tell you honestly whether I am the right person for the job, and what a sensible scope would look like.

Start a projectEmail directly

Typically replies within one business day. NDA on request.

enes.ismaili@gmail.com