Syed Jan Muhammad Zaidi

I supported incident response and led technical security testing following a cyber incident affecting a major automotive manufacturer in Pakistan.

I conducted rapid risk assessments across web applications and internal networks to identify potential entry points, privilege escalation paths, and data exposure risks. I also coordinated testing efforts with stakeholders to validate vulnerabilities, assess blast radius, and prioritize remediation actions aligned with business impact. I delivered structured findings and risk treatment recommendations to support containment, recovery, and longer-term security improvements.

This engagement strengthened incident response coordination, improved visibility into attack surface risks, and helped the organization implement more resilient security controls and monitoring practices.

I was awarded the Guardian of the Digital Realm for my outstanding performance on the project.

I identified and responsibly disclosed a critical remote code execution vulnerability in a widely used open-source application. I performed vulnerability analysis, developed a working POC exploit, and coordinated disclosure with maintainers. The issue was assigned a public CVE and remediated by the development team. This work demonstrated strong vulnerability research capability and reinforced secure coding practices within the affected project ecosystem.

I directed a comprehensive security assessment covering web, API, cloud infrastructure, and identity controls for a multi-tenant SaaS platform. I identified critical attack paths, including those involving privilege escalation and data exposure. I also delivered a risk-prioritized remediation roadmap and worked with engineering teams to validate fixes and improve overall security posture.

I performed an in-depth security review of cloud and identity architecture across AWS and Azure environments for an enterprise client. I assessed IAM configurations, role permissions, exposed services, and logging practices to identify privilege escalation paths and data exposure risks. I also conducted targeted testing to validate real-world exploitability and provided a structured risk treatment plan aligned with business priorities. Finally, I collaborated with engineering teams to implement improved access controls, monitoring, and secure configuration baselines.

The project improved visibility into cloud risks and supported the client's broader security and compliance objectives.

I reviewed CI/CD pipelines, deployment workflows, and access controls for a cloud-hosted application environment. I identified risks related to secret management, build permissions, and insecure pipeline configurations that could allow unauthorized code execution or data access. I also conducted targeted validation testing and provided actionable recommendations to strengthen pipeline security and reduce supply-chain risk. I worked with engineering teams to improve secure configuration practices and integrate security checks into the development lifecycle.

This engagement improved the client's confidence in their release process and reduced exposure to build-pipeline attacks.