Afaq Amjad

AA

Looking for a job

Afaq Amjad

@afaqamjad

Offensive security researcher at Faseel Infosec who built EvilGum, an MCP gateway that blocks AI agent hijacking.

At Faseel Infosec, I architected EvilGum, an open-core Layer 7 security gateway for MCP that brokers traffic between AI agents and tool servers. It uses identity and access controls, information-flow tracking, and inline DLP to defend against tool poisoning, data exfiltration, and prompt-injection-driven hijacking.

Through Faseel Infosec and independent research on HackerOne and huntr, I’ve responsibly disclosed 50+ vulnerabilities, including critical authentication bypass and remote code execution findings. I also built Komply to automate ISO 27001 and UK Cyber Essentials audit readiness, and scored 1000 points in a global Black Hat CTF.

Experience

Work history, roles, and key accomplishments

FI

Current

Founder & Lead Security Researcher

Current

Faseel Infosec

Nov 2025 - Present (11 months)

Founded and leads an offensive security practice delivering penetration testing, vulnerability research, and red team engagements. Architected EvilGum, an open-core MCP security gateway, and Komply, a GRC platform for ISO 27001 and UK Cyber Essentials.

HB

Current

Security Researcher

Current

HackerOne / huntr / Independent Bug Bounty

Jan 2024 - Present (2 years 9 months)

Reported 50+ valid vulnerabilities across public and private bug bounty programs, specializing in IDOR/BOLA, OAuth and CORS flaws, SDK secret leakage, subdomain takeover, and race conditions. Conducted AI security research and coordinated responsible disclosure with major vendors.

Bug Bounty IDOR BOLA OAuth CORS CSRF Subdomain Takeover Race Conditions SDK Code Review AI Security Prompt Injection Responsible Disclosure

Education

Degrees, certifications, and relevant coursework

UP

University of Engineering & Technology (UET), Peshawar

Bachelor of Computer Systems Engineering, Computer Systems Engineering

Graduated with a Bachelor of Computer Systems Engineering, focusing on Network Security and System Architecture.

HA

HTB Academy

Certified Penetration Testing Specialist (CPTS), Penetration Testing

Completed the Certified Penetration Testing Specialist (CPTS) path, compromising 20+ machines across the syllabus.

PA

PortSwigger Academy

Practitioner/Expert Rank, Web Security

Achieved Practitioner/Expert rank with 100% completion of Client- and Server-Side labs covering SQLi, XSS, SSRF, XXE, Access Control, and OAuth.

PE

PentesterLab

Essential, Unix, PCAP, and White Badges, Penetration Testing

Completed 200+ exercises and earned Essential, Unix, PCAP, and White badges.

EL

eLearnSecurity

Penetration Testing Student (PTS), Penetration Testing

Completed Penetration Testing Student (PTS) prerequisites for eJPT.

Tech stack

Software and tools used professionally

Docker Compose

PostgreSQL

Redis

JavaScript

Python

C++

C

FastAPI

Prometheus

Wireshark

Ubuntu

Windows

Kali Linux

JSON-RPC

Docker

NGINX

SQL

sqlmap

Nmap

Metasploit

Aptos

Bash

Nuclei

Availability

Looking for a job

Location

Pakistan

Authorized to work in

Salary expectations

30k+ USD

Social media

Job categories

Offensive Security Researcher Penetration Tester Security Engineer

Skills

Offensive Security Web Application Penetration Testing (WAPT)API Security OWASP API Security Top 10 Vulnerability Research Bug Bounty Red Team Operations AI LLM Security LLM Red Teaming MCP Security Prompt Injection OAuth CORS CSRF SDK Code Review

Interested in hiring Afaq?

You can contact Afaq and 90k+ other talented remote workers on Himalayas.

People also viewed

View all talent

Get matched with your dream remote job

Sign up now and join over 250,000+ remote workers who receive personalized job alerts, curated job matches, and more for free!