I have sat on both sides of the report.

Cosmic Development, dedicated to Rumble.com, its CDN, Locals.com and Rumble Cloud

• Run Wazuh SIEM monitoring, log analysis and alerting for a high-traffic production platform and its supporting infrastructure.
• Primary validator and triager of the public bug bounty program: reproduce submissions, assign CVSS scores, escalate to engineering and verify fixes.
• Own Zabbix monitoring and triage its alerts, separating real infrastructure issues from test-environment noise.

Qubitronix, contract, US-based firm, remote

• Delivered a HIPAA, PCI DSS and NIST SP 800-53 hardening plan for a GCP-hosted Wazuh deployment: RBAC, GCP IAP-based MFA and network lockdown.
• Produced the report, control checklist and admin walkthrough, and supported secure handling of credentials and client data under strict confidentiality.

DSS, New York based managed security service provider

• Designed and deployed Wazuh SIEM from the ground up: architecture, data sources and compliance-driven tuning.
• Managed log ingestion from endpoints, network devices, cloud services and applications, and wrote and tuned correlation rules and alerts.
• Took part in incident response, built dashboards and reports, and troubleshot ingestion failures, performance issues and false positives.

Thor IT Solutions

• Network and web application penetration tests to OWASP methodology, including manual testing of GraphQL APIs, Swagger/OpenAPI services and .NET applications: introspection abuse, BOLA, mass assignment and injection.
• Integrated security testing into Azure DevOps CI/CD pipelines and delivered reports with CVSS scores, PoC steps and remediation roadmaps for technical and executive audiences.

MKHOST, hosting provider

• Administered Linux servers behind the hosting infrastructure: hardening, service configuration, user permissions and ongoing maintenance of web-hosting environments.
• Pentested company PHP and WordPress applications and client sites on shared hosting: plugin and theme vulnerabilities, authentication bypass, insecure file upload, privilege escalation and misconfiguration.
• Reviewed PHP source code and worked with developers to validate remediation.

Independent

• Web application and WordPress penetration tests across industries, with detailed reports.
• WordPress hardening: plugin and theme audits, file permissions, login protection and WAF configuration.

Municipality of Cair

• Administered Active Directory (GPO, OU structure, RBAC), Windows Server, network configuration and endpoint security for all municipal departments.
• Pentested internal web applications and supported the security of departmental infrastructure.