Looking for a job

solando valhando

@solandovalhando

Web application and network pentester at INSA who found privilege escalation, database access, and OWASP vulnerabilities.

Ethiopia

Message

At Information Network Security Agency (INSA), I conduct web and Android application penetration testing, identifying issues such as insecure authentication, API misconfigurations, and data exposure. I also assist with security assessment reports and remediation recommendations.

As a security researcher at INSA, I assessed web applications and networks for organizations including Ahadu Bank, Customs Commission, Amhara Bank, and Wegagen Bank. I reported findings such as privilege escalation, database access issues, and XSS, with recommendations to improve permissions and access control.

I developed the backend for a Vulnerability Scanner API that automates web security testing using OWASP Top 10 and CVE records, and added caching to improve scanning speed. I also developed a Spring Boot backend for a maintenance mobile application and a MITM attack simulation tool for security research and testing.

Experience

Work history, roles, and key accomplishments

Current

Security Researcher

Current

Information Network Security Agency (INSA)

Jan 2023 - Present (3 years 9 months)

Performed vulnerability assessments on web applications and networks to identify security weaknesses in governmental and private organizations. Discovered critical vulnerabilities including privilege escalation, database access issues, XSS, and other OWASP weaknesses.

Vulnerability Assessment Penetration Testing OWASP OS Privilege Escalation XSS Security Reporting

Current

Web Application & Network Pentester

Current

Information Network Security Agency (INSA)

Jun 2022 - Present (4 years 4 months)

Conducted web and Android application penetration testing, identified vulnerabilities including insecure authentication, API misconfigurations, and data exposure. Assisted in writing security assessment reports and performed secure code reviews and API security testing.

Penetration Testing Web Application Security Android Security API Security Secure Code Review Vulnerability Assessment

Trainer/Instructor

Ghion Hotel

Aug 2025 - Present (1 year 2 months)

Delivered hands-on training sessions on ERP application penetration testing and internal network to technical team. Designed practical exercises and mentored participants in applying ethical hacking principles.

Training ERP Security Penetration Testing Internal Security Ethical Hacking

Backend Developer

Maintenance Mobile Application

Developed the backend for a maintenance mobile application using Spring Boot. Built APIs to manage users, requests, and maintenance-related data.

Spring Boot Backend Development API Development Mobile Backend Development

Backend Developer

Vulnerability Scanner API

Designed and developed a Java backend application that automates web security testing. Built logic to collect information from different sources and detect known vulnerabilities based on OWASP Top 10 and CVE records.

Java Backend Development Security Testing OWASP CVE Caching Performance Optimization

MITM Attacking Tool Developer

INSA Cyber Talent

Developed a tool for simulating Man-in-the-Middle (MITM) attacks for security research and testing purposes. Used the project to study attack techniques and improve defensive security knowledge.

MITM Security Research Attack Simulation Defensive Security

Education

Degrees, certifications, and relevant coursework

Microlink IT College

Bachelor of Science, Computer Science

Pursuing a Bachelor of Science in Computer Science with expected graduation in July 2028. Coursework includes data structures, algorithms, machine learning, and artificial intelligence.

Microlink IT College

National Certificate, Hardware and Networking Service

Graduated in 2024 with a focus on hardware and networking service, including coursework in networking, cryptography basics, database management, and web development.