# Phinehas Narh

Phinehas Narh is a remote worker on Himalayas, Product Security Engineer at Axion Digital Solutions, based in Ghana.

Source: https://himalayas.app/@phinehasnarh

```text
Application security engineer at ACS who found a Critical authenticated RCE and contributed fixes to NVIDIA garak and MLRun.
```

| Detail | Value |
| --- | --- |
| Availability | Looking for a job |
| Location | Ghana |
| Authorized to work in | Ghana |
| Salary expectations | 60k+ USD |
| Job categories | Application Security Engineer, Product Security Engineer, Security Analyst |
| Skills | Application Security, Web Security, API Security, Penetration Testing, Secure Code Review, Vulnerability Research, Threat Modeling, DevSecOps, CI CD Security, SAST, DAST, SCA, Cloud Security, AWS, Azure |

## About

```text
At ACS, I test production web and API applications, review code, and threat-model systems with STRIDE. I integrate security scanning into CI/CD and work with engineering teams to remediate vulnerabilities across staging and production.

My vulnerability research uncovered a Critical authenticated RCE in borg-ui and a DNS-rebinding SSRF in pdf-reader-mcp, both credited in published GitHub advisories. I also contributed merged security fixes to NVIDIA garak and MLRun, and built tools for AppSec findings triage and Linux vulnerability assessment.
```

## Experience

### Product Security Engineer (current)

Axion Digital Solutions. May 2026 - Present

```text
Owns product security for software products built with client partners, from security and risk review at the proposal stage through design, build, and release. Runs penetration tests before release and regular vulnerability assessments of live applications.
```

Skills: Penetration-Testing, Vulnerability-Assessment, Security-Review, Risk-Assessment

### Application Security Engineer (current)

ACS. Sep 2025 - Present

```text
Performed web and API penetration testing and secure code review on production portals, finding auth bypass, broken access control, injection, and data exposure. Conducted STRIDE threat modeling and integrated SAST, DAST, SCA, image, and secret scanning into CI/CD gates.
```

Skills: Penetration-Testing, Secure-Code-Review, Threat-Modeling, STRIDE-Model, SAST, DAST, SCA, SonarQube, Semgrep, Trivy, GitHub-Actions, OWASP-Top-10, CWE, Entra-ID, AWS-IAM, Intune, Microsoft-365-Defender, Linux-Security, Nginx, TLS, Prompt-Injection

### Security Analyst

EITBS. Oct 2022 - Nov 2024

```text
Performed infrastructure and application security assessments supporting consolidation of 10+ high-resource applications onto centralized infrastructure, cutting server costs by 25%. Executed vulnerability assessments and penetration tests across 5+ systems, servers, and endpoints using Nessus and manual techniques, identifying and remediating 7 critical vulnerabilities.
```

Skills: Vulnerability-Assessment, Penetration-Testing, Nessus, Endpoint-Protection, Acronis, Symantec, KnowBe4, Security-Awareness, SOC, Incident-Response, AI-Risk-Assessment

## Education

### Microsoft

Microsoft Certified: Azure Security Engineer Associate (AZ-500), Cloud Security

```text
Earned the Microsoft Certified: Azure Security Engineer Associate (AZ-500) certification in August 2026.
```

### The SecOps Group

Certified AppSec Pentester (CAPen), Application Security

```text
Earned the Certified AppSec Pentester (CAPen) certification in July 2026.
```

### Mastermind

ISO 27001:2022 Lead Auditor, Information Security

```text
Earned the ISO 27001:2022 Lead Auditor certification in February 2026.
```

### Mastermind

ISO/IEC 27701:2025 Lead Auditor, Information Security

```text
Earned the ISO/IEC 27701:2025 Lead Auditor certification in July 2026.
```

### eSecurity Institute

Certified Computer Forensic Analyst, Digital Forensics

```text
Earned the Certified Computer Forensic Analyst certification in June 2026.
```

### Accra Technical University

Bachelor of Technology, Cyber Security. 2022 - 2025. Grade: 4.13/5.0 (First Class)

```text
Pursued a Bachelor of Technology in Cyber Security, achieving a GPA of 4.13/5.0 (First Class).
```

### Amazon Web Services (AWS)

AWS Certified Cloud Practitioner, Cloud Computing

```text
Earned the AWS Certified Cloud Practitioner certification in February 2025.
```

### Cisco

Cyber Ops Associate, Cybersecurity Operations

```text
Earned the Cyber Ops Associate certification in February 2024.
```

### Cisco

CCNA, Networking

```text
Earned the CCNA certification in May 2024.
```

### AXELOS

Information Technology Infrastructure Library (ITIL), IT Service Management

```text
Earned the Information Technology Infrastructure Library (ITIL) certification in April 2024.
```

## Tech stack

- AWS IAM
- SonarQube
- GitHub Actions
- PostgreSQL
- Stride
- Redis
- Terraform
- JavaScript
- Python
- C#
- Go
- Traefik
- AWS CloudTrail
- FastAPI
- GraphQL
- NATS
- OpenSearch
- Docker
- NGINX
- SQL
- AppArmor
- AWS KMS
- Snyk
- Burp Suite
- Nmap
- Metasploit
- Trivy
- Semgrep
- Bash
- Checkov
- Gitleaks
- TruffleHog
- AWS
- Microsoft Entra ID
- Azure

To contact Phinehas, message them from this profile with a Himalayas employer account: [Hire on Himalayas](https://himalayas.app/hire).

## People also viewed

- [John-Peter Samuelis](https://himalayas.app/@johnpetersamuelis): Information Technology Associate, Genser Energy Ghana Limited
- [Rose Agudosi](https://himalayas.app/@roseagudosi): Cybersecurity Analyst, Access Bank PLC
- [Silas Aosige](https://himalayas.app/@silasaosige): Cybersecurity Intern, Hack Secure
- [Sniper User](https://himalayas.app/@sniperuser): Security Engineer, Dynamic Data Solutions
- [Goodenough Boamah Gyamfi](https://himalayas.app/@goodenoughboamahgyam): Freelance Cybersecurity Consultant, Upwork
- [Caleb Cudjoe Mensah User](https://himalayas.app/@calebcudjoemensahuse): Independent Security Research, Responsible Disclosure
- [Leslie Nii-Adjetey](https://himalayas.app/@leslienii-adjetey): Cybersecurity Intern, International Cybersecurity & Digital Forensics Academy
- [JULIUS AMENYAGLO](https://himalayas.app/@kjulius): Independent Security Researcher, Bug Bounty Platforms
- [Enoch Kanabia Ali](https://himalayas.app/@enochkanabiaali): Shipping Officer, Trade Ocean Logistics
- [Ewura Ama Amponsah](https://himalayas.app/@ewuraamaamponsah): CISO / Security Lead, The Digicoast