Danish User

I'm currently delivering vulnerability assessments and SOC operations for the Federal Board of Revenue through Trillium Information Security Systems. I validate scanner findings across infrastructure, web applications, and network services, prioritise risk with CVSS v3.1, and support remediation through retest.

As an independent security researcher, I've found and responsibly disclosed high- and medium-severity IDOR, XSS, SQL injection, and authentication-bypass vulnerabilities through YesWeHack and Bugcrowd. My manual testing with Burp Suite focuses on broken access control, session flaws, business logic abuse, and input validation weaknesses that automated scanners miss.

I've built Python reconnaissance workflows that combine subdomain enumeration, DNS resolution, port scanning, and HTTP probing to improve asset discovery. My hands-on projects also include a black-box mobile banking assessment, SSL-pinning bypass, and a virtualised Active Directory lab covering Kerberoasting, credential dumping, lateral movement, and privilege escalation.

I write reproducible reports with working PoCs, root-cause analysis, business impact, and prioritised remediation guidance mapped to OWASP and MITRE ATT&CK. I bring LPT, CPENT, eCPPT, CEH, CHFI, and eJPT certifications alongside secure development experience with Laravel, MySQL, and JavaScript.