Anas Bin Izhar
Verified Expert in Engineering
Information Security Engineer and Developer
Lahore, Punjab, Pakistan
Toptal member since August 18, 2022
Anas is a security engineer with 8+ years of experience helping organizations secure their SaaS platforms from threat actors. He is an expert in application security, cloud security, penetration testing, and information system compliance, including ISO 27001 and SOC 2. With keen attention to detail and the ability to adapt to a fast-paced environment, Anas outperforms clients' expectations and provides agile and secure solutions to meet their business needs.
Portfolio
Experience
- Penetration Testing - 7 years
- Cloud Security - 5 years
- Vulnerability Management - 5 years
- Incident Response - 4 years
- Application Security - 4 years
- ISO 27001 - 4 years
- Python 3 - 3 years
- DevSecOps - 1 year
Preferred Environment
Python 3, Bash, Burp Suite, Kali Linux, Amazon Web Services (AWS), Linux, MacOS, Windows, Docker
The most amazing...
...thing I've done is secure 100+ applications for various clients, such as AT&T, the Government of Barbados, and Silo.
Work Experience
Senior Cybersecurity Consultant for Risk Assessment Innovation
Alia Omar
- Designed and implemented an enterprise risk management system aligned with the NIST Risk Management Framework (RMF), ensuring comprehensive asset identification, risk categorization, and control alignment across the organization.
- Developed and maintained a centralized risk register to improve enterprise-wide visibility, accountability, and structured risk tracking.
- Established standardized risk scoring criteria using a likelihood-impact matrix to enable consistent and defensible risk-based decision-making.
IT Security Engineer
Distributed Coders Inc.
- Conducted a penetration test on their infrastructure and assets.
- Documented all the findings along with proof of concepts to help them understand the risks.
- Helped the team patch the issues and conducted retesting to make sure the patches are applied effectively and cannot be bypassed.
Security Auditor
Forecasted Finance LLC
- Conducted a security assessment of their infrastructure and application, resulting in multiple critical severity findings.
- Tracked and worked with the team to apply appropriate fixes to mitigate these vulnerabilities.
- Mentored the team to implement security controls like SCA, SAST, and DAST to ensure that the code going into production is secure.
Application Security Developer
Thinking LSAT LLC
- Conducted a full security assessment of AWS infrastructure and web application.
- Strengthened their AWS infrastructure as per best practices to enhance their security.
- Enabled security monitoring in AWS via GuardDuty, CloudWatch, and CloudTrail to make sure it detects any security threats.
- Developed playbooks for the security alerts to make sure the team can respond promptly to the security incidents.
- Guided them to implement SAST and SCA tools to make sure they are developing applications securely.
AWS and Mobile Security Expert
EX3 Labs
- Conducted a penetration test and security audit on the Carent web, mobile, and cloud infrastructure.
- Provided support in remedying the identified issues in the application and cloud.
- Implemented static application security scanning via Snyk in the application build process to remediate vulnerabilities in the earlier phase of the software development lifecycle (SDLC).
- Provided general consultancy for secure SDLC during the product development process of Carent.
Senior PHP and AWS Developer
Shared Flight
- Conducted compromise assessment to detect the root cause of a security incident.
- Performed a penetration test (pentest) on the application and AWS cloud infrastructure.
- Assisted the team in applying mitigation to ensure flaws were patched successfully.
Information Security Specialist
Silo
- Conducted black-box penetration tests on two of Silo's production web applications.
- Provided all the test cases performed during penetration testing per OWASP recommended controls.
- Produced a professional report, including all the vulnerabilities and remediation steps.
- Consulted and provided feedback on multiple issues reported by the community.
Information Security Consultant
Freelance
- Performed penetration testing services for multiple clients, including government organizations and a SaaS startup.
- Provided cybersecurity mentoring services to one of the leading educational platforms.
- Wrote 10+ cybersecurity articles for a client in this niche.
Security Engineer L2
Sendoso
- Led the penetration testing of the Sendoso SaaS platform.
- Developed an information security management system (ISMS) for Sendoso to assist in the ISO 27001 audit.
- Investigated multiple security incidents and created playbooks for the incident response process.
Information Security Analyst
ibex
- Developed an application security testing process and completed penetration testing of 40+ applications carried out by their patching activities.
- Led quarterly vulnerability and patch management exercises for all sites in the United States, including workstations and servers.
- Assisted in multiple information security audits, including ISO 27001, PCI DSS, and SOC 2.
- Enhanced information security log monitoring and incident response processes.
- Managed and optimized the LogRhythm SIEM platform for security monitoring, incident detection, and response.
- Integrated diverse log sources (cloud services, endpoints, and network devices) to enhance threat detection and visibility.
- Created and fine-tuned correlation rules, dashboards, and alarms to minimize false positives and improve alert accuracy.
Experience
Third-party Supplier Audit Automation
The tool detected the following vulnerabilities:
• Weak passwords
• Insecure connections
• Vulnerable software
• Compliance checks
Creation of Application Security Exercises
https://www.hackerrank.comCybersecurity Mentoring
https://www.thinkful.com/Pentest of Silo's Web Application
https://www.silo.financeEducation
Bachelor's Degree in Electrical Engineering
National University of Sciences and Technology - Islamabad, Pakistan
Certifications
Certified Cloud-Native Security Expert
Practical DevSecOps
Certified DevSecOps Professional (CDP)
Practical DevSecOps
Offensive Security Certified Professional (OSCP)
Offensive Security
Skills
Libraries/APIs
Node.js, React, REST APIs
Tools
Git, Apache, ELK (Elastic Stack), Logging, CircleCI, SonarQube, AWS CloudFormation, Ansible, GitLab CI/CD
Languages
Python 3, Bash, Python, JavaScript, TypeScript, SQL, GraphQL, PHP
Paradigms
Penetration Testing, DevSecOps, Web Architecture, DevOps, DDoS, Security Orchestration, Automation, and Response (SOAR), Anomaly Detection, Object-oriented Programming (OOP), HIPAA Compliance, Continuous Deployment, Role-based Access Control (RBAC), Microservices
Platforms
Kali Linux, Burp Suite, Amazon Web Services (AWS), Linux, WordPress, Amazon EC2, Ubuntu, Docker, Kubernetes, AWS IoT, MacOS, Windows
Industry Expertise
Cybersecurity
Storage
Amazon S3 (AWS S3), Database Security, MySQL, Amazon DynamoDB, Inspec
Frameworks
Laravel, React Native, Symfony, Twig
Other
Information Security Management Systems (ISMS), Information Security, ISO 27001, Security Operations Centers (SOC), Cloud Security, Incident Response, Vulnerability Assessment, Web Security, Application Security, Computer Networking, Scripting, Security Audits, Security, Vulnerability Management, OWASP Top 10, OWASP, Website Audits, APIs, Source Code Review, Task Analysis, IT Security, OSCP, Certified Ethical Hacker (CEH), Risk Management, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Security Management, Vulnerability Identification, Architecture, Data Protection, Data-level Security, General Data Protection Regulation (GDPR), Data Security, NIST, Security Analysis, Threat Modeling, SIEM, System-on-a-Chip (SoC), Ethical Hacking, Hacking, AWS Marketplace, Cloud Services, SecOps, Security Policies & Procedures, Endpoint Security, Monitoring, Intrusion Detection Systems (IDS), Disaster Recovery Plans (DRP), Cloudflare, ISO 27002, Single Sign-on (SSO), Threat Intelligence, GRC, Documentation, Business Continuity Planning (BCP), Code Auditing, Communication, Web App Security, Security Information and Event Management (SIEM), Vulnerability Scanning, IDS/IPS, CISSP, Incident Handling, Artificial Intelligence (AI), Data Encryption, SOC 2, PCI DSS, Incident Management, Mobile Security, Compliance, SOC Compliance, CI/CD Pipelines, Interviewing, Technical Hiring, IoT Security, Risk Assessment, Security Testing, Certified Information Systems Security Professional, Identity & Access Management (IAM), Okta, System Administration, Infrastructure as Code (IaC), Internet of Things (IoT), Algorithms, Cryptography, Infrastructure, Networking, HIPAA Electronic Data Interchange (EDI), Amazon DocumentDB, DocumentDB, Strapi, Compliance as Code (CaC), Containers, Software Architecture, Industrial Control Systems (ICS)
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
Share your needs
Choose your talent
Start your risk-free talent trial
Top talent is in high demand.
Start hiring