Experience
Offensive Cyber Security Consultant
Seclab.id · Jakarta · 07/2024 – Present
- Conduct penetration testing and security assessments across web applications, APIs, mobile applications, internal networks, and cloud environments.
- Identify and validate vulnerabilities involving authentication, authorization, business logic, injection flaws, privilege escalation, and infrastructure misconfiguration.
- Perform manual exploitation and vulnerability research using Burp Suite, Python, and custom tooling.
- Produce technical penetration-testing reports including exploitation evidence, risk assessment, and remediation recommendations.
- Deliver cybersecurity training and hands-on security exercises for technical teams.
Internship & Freelance
- Conducted vulnerability assessments and penetration testing on production and client web applications, validating findings and documenting technical impact and remediation recommendations.
- Conducted security assessments and penetration testing on university applications and internal systems.
- Developed cybersecurity training materials and supported hands-on learning sessions for security-related topics.
Certifications
- OffSec Web Expert (OSWE)
- OffSec Certified Professional+ (OSCP+)
- Burp Suite Certified Practitioner (BSCP)
Achievements
- 1st Place — TCP1P CTF 2024
- 2nd Place — Cyber Jawara International 2024
- 3rd Place — GEMASTIK XV Cyber Security
- 3rd Place — HOLOGY 5.0 CTF
- 2nd Place — Informatics Festival 2022
- 3rd Place — National Cyber Week 2022 CTF
Additional finalist and podium placements across national cybersecurity competitions; actively competed with CSI Team on CTFtime from 2021–2024.
Projects
AI Agentic Offensive Security Framework
Python, Hermes, LLM APIs, Burp Suite, Playwright, MCP
Developing a multi-agent offensive security framework that coordinates reconnaissance, attack-surface mapping, vulnerability analysis, validation, and reporting. Designed specialized agents for web, API, cloud, and expert-validation workflows, with emphasis on reducing false positives and minimizing repetitive manual testing. Source: private repository.
Burp Suite Extensions & Tooling
Java/Jython, Burp Suite Montoya API, Python
Custom Burp Suite extensions and security-testing utilities to automate encrypted API traffic processing, request/response transformation, authentication/session replay, and manual penetration-testing workflows.
- Auto-highlighting of in-scope items in Burp requests.
- Logging of every Intruder and Repeater request for later review or saving to the project file.
- Sensitive entity mapping with regex.
- Notes management that can be pushed to Organizer.
- Extraction of an application's object graph.
- Conversion of a Burp Intruder attack into a one-shot Python 3 script.
Sources: Scope Manager, Intruder Python Script
AREA — Recon Automation
Python, Bash, nmap, dirsearch
A reconnaissance automation pipeline that processes recon scope assets, identifies live targets, fingerprints technologies, performs content discovery, filters noisy results, and generates structured output ready for AI use or manual investigation.
Source: Repo AREA
Skills
- Security
- Web Application Penetration Testing, API Penetration Testing, Mobile Application Security, Internal Network Penetration Testing, Active Directory, Cloud Security, White-box Testing, Source Code Review, Vulnerability Assessment
- Tools
- Burp Suite, Nmap, Metasploit, BloodHound, Impacket, SQLMap, Wireshark, Git
- Programming
- Python, PHP, Bash; strong source code analysis skills with the ability to quickly understand unfamiliar codebases, particularly web applications and frameworks.
- AI & Automation
- AI Agent Development, Agentic Workflows, Multi-Agent Orchestration, LLM Integration, Prompt Engineering, MCP Integration, Security Automation
- Languages
- English, Indonesian