Ayman is available for hire
Hire AymanAyman Abdul kareem
Verified Expert in Engineering
Security Architect and Developer
Dubai, United Arab Emirates
Toptal member since November 27, 2025
Bio
Ayman is a security architect, senior product security expert, and senior penetration tester with 8.5 years of experience securing applications and infrastructure. He currently drives initiatives in AI security, DevSecOps, cloud security, and security architecture. Ayman consistently bridges the gap between engineering and risk management to build resilient systems.
Portfolio
Emirates NBD
Security Architecture, AI Security, Product Security, Infrastructure Security...
KPMG
Penetration Testing, Security Architecture, DevSecOps, Cloud Security, VAPT...
Lucideus Technologies
Penetration Testing, Red Teaming, Application Security, VAPT, Secure Containers...
Experience
- VAPT - 9 years
- Penetration Testing - 9 years
- Infrastructure Security - 9 years
- Application Security - 9 years
- Secure Containers - 5 years
- Threat Modeling - 5 years
- Cloud Security - 4 years
Preferred Environment
Security Architecture, Threat Modeling, Product Security, Application Security, Penetration Testing, Infrastructure Security, Cloud Security, Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), Source Code Review
The most amazing...
...project I've worked on included security architecture, threat modeling, penetration testing, and cloud security for a major UAE bank, which enhanced resilience.
Work Experience
Security Architect, Senior Product Security Expert
2021 - PRESENT
Emirates NBD
- Led security implementation and reviews for genAI and cloud based use cases within the bank, ensuring robust protection against emerging threats.
- Worked closely with DevOps, development, and IT teams to integrate security practices into CI/CD pipelines, ensuring security was embedded throughout the development process without compromising speed or agility.
- Directed vulnerability management initiatives, prioritizing remediation efforts based on risk assessments, and collaborated with development teams to close security gaps efficiently.
- Ensured core applications adhered to relevant regulatory frameworks, conducted regular compliance assessments, and aligned security strategies with regulatory requirements.
- Executed thorough security reviews of back-end applications deployed in Azure infrastructure, leveraging components such as API Management, AppServices, Azure Cosmos DB, and OpenAI.
- Spearheaded threat modeling initiatives for a prominent US restaurant chain, analyzing and mitigating risks within their AWS cloud infrastructure to safeguard critical assets and customer data.
- Presented security initiatives as a primary security champion for multiple Agile squads, ensuring adherence to industry best practices.
- Conducted security reviews for the bank's core integration platform, conducting risk identification, impact analysis, and tracking to closure.
- Provided tailored patch support for identified risks, employing customized solutions scalable across diverse environments.
- Worked closely with product and engineering teams to prioritize and implement security features and controls, ensuring mitigation of identified risks.
Technologies: Security Architecture, AI Security, Product Security, Infrastructure Security, Cloud Security, Azure, DevSecOps, Threat Modeling, Penetration Testing, Application Security, Security Automation, Kubernetes Security, IT Security, Security, CI/CD Pipelines, Amazon Web Services (AWS), Wiz Cloud Security Platform, PCI, Node.js, Infrastructure as Code (IaC), Google Cloud Platform (GCP), SOC 2, Next.js, AWS IAM, Cybersecurity, AWS Secrets Manager, Web App Security, Network Segmentation, AI Trust, Risk and Security Management (AI TRiSM), Kubernetes, Data Encryption, OWASP, Identity & Access Management (IAM), JavaScript, React, SecOps, Risk Management, GitHub Actions, Vulnerability Triage, Web Application Security (Web AppSec), Web Security, Security Audits, White-hat Hacking, White-hat Security, Cloud Infrastructure, Large Language Models (LLMs), Fintech, Azure Active Directory, Azure IaaS, Azure PaaS, Microsoft Azure, Microsoft Entra ID, Azure Key Vault, Cloud Platforms, Role-based Access Control (RBAC), Access Control, PostgreSQL, Relational Database Services (RDS), SOC Compliance, Security Engineering, Network Security, AWS Cloud Architecture, Apache Kafka, FastAPI, Vulnerability Management, Ethical Hacking
Security Consultant
2020 - 2021
KPMG
- Reviewed and baselined network configurations, ensuring compliance with enterprise security policies, including ISO 27001 and NIST frameworks.
- Supervised user permissions across organizational systems, ensuring compliance with the principle of least privilege.
- Established continuous monitoring practices to detect and respond to emerging threats in cloud and on-premises environments.
- Crafted a comprehensive application security framework tailored to various software development lifecycle models, ensuring robust protection throughout the development process.
- Developed organizational policies, procedures, and guidelines, ensuring adherence to policy management frameworks, document control procedures, and version control systems.
- Implemented customized secure coding guidelines aligned with the organization's technology stack, enhancing resilience against emerging threats.
- Conducted engaging secure coding training sessions for developers, focusing on OWASP Top 10, SANS Top 25, and critical business logic vulnerabilities to promote a security-first mindset.
- Performed phishing simulations and social engineering awareness exercises, providing targeted training to enhance employee resilience against cyber threats.
- Led vulnerability assessment and penetration testing initiatives across diverse environments, covering servers, network devices, endpoints, web applications, and thick client applications using both automated and manual approaches.
- Supported the procurement team by evaluating proposals and identifying suitable vendors for network security solutions, including key management systems (KMS) and network access control (NAC), to strengthen overall infrastructure security.
Technologies: Penetration Testing, Security Architecture, DevSecOps, Cloud Security, VAPT, GRC, IT Security, Security, Amazon Web Services (AWS), SOC 2, NMap, Next.js, OpenVAS, Wordfence Security, AWS IAM, Cybersecurity, AWS Secrets Manager, Web App Security, Data Encryption, OWASP, Identity & Access Management (IAM), JavaScript, SecOps, GitHub Actions, Vulnerability Triage, Web Application Security (Web AppSec), Web Security, Security Audits, White-hat Hacking, White-hat Security, Cloud Infrastructure, Java, Fintech, Cloud Platforms, Role-based Access Control (RBAC), Access Control, Relational Database Services (RDS), Security Engineering, Network Security, AWS Cloud Architecture, Vulnerability Management, Ethical Hacking
Senior Security Analyst
2019 - 2020
Lucideus Technologies
- Conducted vulnerability assessment and penetration testing for a wide range of systems, including servers, network devices, and endpoints, employing both automated and manual methodologies.
- Specialized in Active Directory (AD) penetration testing, executing advanced test cases to uncover vulnerabilities leading to domain admin access, EDR bypass, and lateral traversal across systems.
- Led vulnerability assessment and penetration testing efforts for over 100 web applications and thick client applications, focusing on industry standards like OWASP Top 10 and SANS Top 25.
- Conducted security assessments for REST endpoints and SOAP web services, ensuring the integrity and resilience of critical APIs.
- Spearheaded Red Teaming assignments for prestigious clients in banking, financial institutions, and pharmaceuticals, simulating real-world attack scenarios to enhance defensive capabilities.
- Conducted wireless network penetration testing assessments, uncovering vulnerabilities in guest network implementations that could lead to unauthorized access to enterprise networks.
- Executed social engineering and physical security assessments within the financial sector, identifying weaknesses and recommending remediation strategies.
- Collaborated closely with clients to implement specific patches and remediation measures following security assessments, ensuring timely mitigation of identified vulnerabilities.
- Provided consulting services to companies across diverse sectors, offering tailored security solutions to meet their unique needs.
- Developed automation solutions for penetration testing controls, data exfiltration, and client-specific report generation, streamlining security processes and enhancing efficiency.
Technologies: Penetration Testing, Red Teaming, Application Security, VAPT, Secure Containers, Network Security, Social Engineering, IT Security, Security, Amazon Web Services (AWS), NMap, OpenVAS, Cybersecurity, AWS Secrets Manager, Web App Security, Data Encryption, OWASP, JavaScript, Vulnerability Triage, Web Application Security (Web AppSec), Web Security, Mobile Security, Security Audits, White-hat Hacking, White-hat Security, Role-based Access Control (RBAC), Reporting, Reports, Vulnerability Management, Ethical Hacking
Security Consultant
2017 - 2019
Synopsys
- Conducted comprehensive vulnerability assessment and penetration testing across diverse platforms, including web applications, web services, web sockets, mobile applications (iOS and Android), and thick client applications.
- Led source code reviews for Java and JavaScript-based applications for a leading German multinational automotive corporation, ensuring code integrity and resilience against cyber threats.
- Spearheaded professional services assessments and managed technical projects for a prominent French multinational investment bank, focusing on web applications and thick client applications to enhance overall security posture.
- Developed Python scripts to automate manual processes during penetration testing and streamlined reporting, improving efficiency and the accuracy of assessments.
Technologies: Penetration Testing, Application Security, Python, Secure Code Best Practices, Security Automation, IT Security, Security, NIST, NMap, OWASP Zed Attack Proxy (ZAP), Cybersecurity, Web App Security, Data Encryption, OWASP, JavaScript, React, GraphQL, Vulnerability Triage, Web Application Security (Web AppSec), Web Security, Mobile Security, Security Audits, White-hat Hacking, White-hat Security, Certified Ethical Hacker (CEH), TypeScript, Reporting, Reports, Vulnerability Management, Ethical Hacking
Experience
End-to-end Cloud Security Architecture and Threat Modeling Across AWS, APIs, and Applications
This project involved conducting an end-to-end security architecture and threat-modeling assessment for a major US restaurant chain operating a complex AWS environment. The engagement included a detailed analysis of AWS console configurations, API gateways, back-end microservices, and both web and mobile applications. The assessment spanned authentication/authorization flows, IAM design, logging and observability, network segmentation, data security controls, and overall cloud hardening. I delivered a prioritized threat model and actionable improvements to enhance resilience across the entire ecosystem.
Application Security Framework, Secure Coding Guidelines, and Developer Training Program
I designed and implemented a comprehensive application security framework tailored to multiple SDLC models, ensuring security coverage across every development stage. I also developed customized secure coding guidelines aligned with the organization's technology stack to strengthen resilience against modern threats. Additionally, this engagement involved delivering an interactive secure coding training program for developers, covering OWASP Top 10, SANS Top 25, and critical business logic vulnerabilities. My efforts successfully embedded a security-first culture across development teams.
Red Team Assessment for a Leading Bank in India
I led an enterprise-wide Red Team assessment for a leading bank in India to evaluate its resilience against advanced, multi-vector threats. The engagement combined OSINT, social engineering, technical penetration testing, and controlled internal exploitation to simulate realistic attack scenarios. Physical security testing exposed on-premises vulnerabilities that enabled monitored access to employee endpoints and internal data pathways. The project provided leadership with a clear, prioritized roadmap to strengthen security controls, improve detection capabilities, and reduce overall organizational risk.
Comprehensive Offensive Security Assessment
I led a comprehensive penetration testing engagement that covered the organization's entire technology stack. The assessment included in-depth testing of web applications, mobile apps, and back-end APIs, alongside internal and external network penetration testing.
The project involved performing secure code reviews to identify logic flaws, insecure patterns, and high-risk vulnerabilities early in the SDLC. Additionally, I conducted a comprehensive cloud configuration review to detect misconfigurations, privilege issues, and security gaps across IAM, networking, logging, and storage. The project delivered a complete vulnerability landscape and an actionable remediation roadmap.
The project involved performing secure code reviews to identify logic flaws, insecure patterns, and high-risk vulnerabilities early in the SDLC. Additionally, I conducted a comprehensive cloud configuration review to detect misconfigurations, privilege issues, and security gaps across IAM, networking, logging, and storage. The project delivered a complete vulnerability landscape and an actionable remediation roadmap.
Education
2013 - 2017
Bachelor's Degree in Computer Science
Visvesvaraya Technological University - India
Certifications
MARCH 2025 - PRESENT
Certificate of Cloud Security Knowledge
Cloud Security Alliance
JANUARY 2024 - PRESENT
Oracle Cloud Infrastructure (OCI) Generative AI Certified Professional
Oracle
JANUARY 2021 - PRESENT
Microsoft Azure Security Engineer Associate (AZ- 500)
Microsoft
FEBRUARY 2020 - PRESENT
Offensive Security Certified Professional (OSCP)
Offensive Security
Skills
Libraries/APIs
Node.js, React
Tools
NMap, AWS IAM, OWASP Zed Attack Proxy (ZAP), Azure Key Vault
Paradigms
Penetration Testing, DevSecOps, Role-based Access Control (RBAC), Secure Code Best Practices
Platforms
Amazon Web Services (AWS), Azure, Google Cloud Platform (GCP), Kubernetes, AWS Lambda, Amazon EC2, Azure IaaS, Azure PaaS, Apache Kafka
Industry Expertise
Cybersecurity
Languages
Python, JavaScript, C, C++, GraphQL, Java, TypeScript
Frameworks
Next.js, OpenVAS
Storage
PostgreSQL, Database Management, Azure Active Directory, Microsoft Entra ID
Other
Product Security, Application Security, Infrastructure Security, Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), Source Code Review, VAPT, Security Architecture, IT Security, Security, AWS Secrets Manager, Web App Security, Network Segmentation, OWASP, Vulnerability Triage, Web Application Security (Web AppSec), Web Security, Mobile Security, Security Audits, White-hat Hacking, White-hat Security, Certified Ethical Hacker (CEH), OSCP, Security Engineering, AWS Cloud Architecture, Vulnerability Management, Ethical Hacking, Threat Modeling, Cloud Security, Secure Containers, Network Security, AI Security, Infrastructure as Code (IaC), Wordfence Security, AI Trust, Risk and Security Management (AI TRiSM), Data Encryption, SecOps, Cloud Infrastructure, Fintech, Microsoft Azure, Cloud Platforms, Access Control, Relational Database Services (RDS), SOC Compliance, Reporting, Reports, Software Engineering, Machine Learning, Data Structures, Security Automation, Red Teaming, Social Engineering, GRC, Azure Cloud Security, Artificial Intelligence (AI), Retrieval-augmented Generation (RAG), Generative Artificial Intelligence (GenAI), Training & Training Content Development, Kubernetes Security, CI/CD Pipelines, Wiz Cloud Security Platform, PCI, NIST, SOC 2, Identity & Access Management (IAM), Risk Management, GitHub Actions, Large Language Models (LLMs), FastAPI
Collaboration That Works
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
1
Share your needs
Discuss your requirements and refine your scope in a call with a Toptal domain expert.
2
Choose your talent
Get a short list of expertly matched talent within 24 hours to review, interview, and choose from.
3
Start your risk-free talent trial
Work with your chosen talent on a trial basis for up to two weeks. Pay only if you decide to hire them.
Top talent is in high demand.
Start hiring