Hi, I’m Rokibul
an Offensive Security Engineer & Cybersecurity Specialist

I came to offensive work from the defensive side, which is a slower route and a better one. It started at TechForing with vulnerability assessments, penetration tests and forensic investigations. At DITECH I ran vulnerability management, SIEM-driven investigations and system hardening, including a set of custom Splunk dashboards that lifted detection accuracy by around 30% — mostly by cutting the noise analysts had learned to click through rather than by adding new rules. I now work independently, delivering full-scope web, API and cloud penetration tests for enterprise clients. Recurring test modules are automated in Python with AI assistance, which takes roughly 25% off reporting time; that time goes back into testing, not into shipping the report sooner. Findings come out CVSS-rated and mapped to MITRE ATT&CK, with the caveat that a base score deliberately encodes nothing about your business, so severity and urgency stay separate columns.

The work runs end to end: reconnaissance, reverse engineering, exploitation, and the post-exploitation validation most reports skip — proving what an initial foothold actually reaches, rather than stopping at the foothold. The toolchain is unremarkable on purpose: Ghidra, Burp Suite, OWASP ZAP, Nmap, Metasploit, and Python and Bash where nothing off the shelf fits, with assessments aligned to OWASP and the CIS benchmarks. Having sat on the blue side first changes the output. Every finding gets a note on what it would have looked like in the logs, and whether your existing tooling would have caught it — because a vulnerability nobody can detect is a different problem from one nobody has patched. Open to offensive security roles internationally and to remote freelance engagements.