Umar MushtaqSecurity Researcher · Red Team Operator

Security researcher · Red team operator

Umar MushtaqI find the gap
before they do.

I’m Umar Mushtaq, a security researcher and Senior Cybersecurity Specialist turning complex attack paths into clear, actionable security decisions.

Explore my work ↓ Download my résumé
Curiosity is
an attack vector. ↗
assessment.log

01 scope attack surface

02 trace trust boundaries

03 prove real-world impact

04 report what matters

✓ risk made visible_

Stay curious.
Keep exploring.
CurrentSr. Cybersecurity Specialist
FocusVAPT & Red Teaming
ExperienceInternational engagements
Based inAbu Dhabi, UAE
01 whoami

The person behind the terminal

Research mode.
Game mode.
Same curiosity.

I’m Umar. Security researcher, red team operator, and unapologetically crazy about gaming. Give me a challenging system or a great game, and I’m going to explore what’s possible.

At work, I connect attack paths to real impact. Off the clock? Gaming, PC building, and getting lost in a good anime. CTFs and bug hunting keep the puzzle-solving side of my brain busy, too.

Security researcherGamer at heartPC builderAnime fanCTF enthusiast
umar@localhost:~

❯ whoami

PLAYER / RESEARCHER UMAR MUSHTAQ Respawn. Rethink. Repeat.
DAY JOB
Making attack paths visible
SIDE QUESTS
Gaming / PC builds / Anime
BONUS ROUNDS
CTFs / Bug hunting
DEFAULT SETTING
Curiosity: always on
02 Expertise

What I bring to the table

Test deeply.
Communicate clearly.

Choose an attack surface

Explore my approach ↙

Behind the interface.

Trace how identity, input, and business logic interact across the application and its APIs.

Look closer
Authentication, authorisation, session management, and API behaviour.
Make it actionable
Reproducible evidence, clear business impact, and prioritised remediation.
01 / 04
⌁

Penetration Testing

Evidence-led assessment of enterprise networks, web and mobile applications, APIs, and cloud infrastructure.

  • Internal & external VAPT
  • Web, mobile & API
  • Cloud assessment
02 / 04
↯

Red Teaming

Full-scope adversary emulation spanning OSINT, initial access, privilege escalation, lateral movement, and objective execution.

  • Active Directory
  • Adversary emulation
  • Custom payloads
03 / 04
◎

Application Research

Manual analysis beyond automated scans, including secure code review, mobile testing, and reverse engineering.

  • SAST & DAST
  • Malware analysis
  • Reverse engineering
04 / 04
✓

Human & Defensive Risk

Social engineering, phishing, physical security, and Blue Team collaboration to test the full security ecosystem.

  • Social engineering
  • Detection improvement
  • Incident readiness
03 Experience

Career path

A career on the offensive side of security.

Apr 2025 — Present

ValueMentor · Abu Dhabi

Senior Cybersecurity Specialist

Leads enterprise VAPT and full-scope Red Team engagements across networks, web applications, APIs, and cloud infrastructure; partners with Blue Teams to strengthen detection and response.

Oct 2024 — May 2025

SoftTech Consultancy · Abu Dhabi

Senior Security Analyst

Performed manual and automated web and mobile testing, threat modelling, and adversary emulation while shaping tailored security recommendations with cross-functional teams.

Feb 2022 — May 2024

Technolytics · United States · Remote

Lead Penetration Tester

Managed VAPT programs and international engagements across the UAE, Oman, and the U.S., covering web, mobile, APIs, and red-team simulations.

May 2020 — Jan 2022

HorizonTech

Senior Penetration Tester / Red Team Operator

Led specialised penetration testing and Red Team projects, mentored junior team members, and assessed technical and physical security controls.

Jan 2019 — Apr 2020

Independent security research

Bug Bounty Hunter

Researched OWASP Top Ten, authentication and authorisation, privilege escalation, and API flaws, with findings affecting organisations including Rozee.pk and NETSOL Technologies.

04 Credentials

Built through practice

Always learning.
Always levelling up.

The certifications behind the craft. A continuous collection of offensive security, red teaming, and defensive analysis.

THE CREDENTIAL COLLECTION
OS

OffSec

OffSec Certified Professional

OSCP
HTB

Hack The Box

Certified Penetration Testing Specialist

CPTS
HTB

Hack The Box

Certified Bug Bounty Hunter

CBBH
HTB

Hack The Box

Certified Defensive Security Analyst

CDSA
ZP

Zero-Point Security

Certified Red Team Operator

CRTO
ZP

Zero-Point Security

Red Team Lead

CRTO2 (CRTL)
AS

Altered Security

Certified Red Team Expert

CRTE
AS

Altered Security

Certified Red Team Professional

CRTP
TCM

TCM Security

Practical Network Penetration Tester

PNPT
EC

EC-Council

Certified Ethical Hacker Practical

CEH v12 (P)
INE

INE Security

Certified Professional Penetration Tester

eCPPT v2
SO

The SecOps Group

Certified Network Security Practitioner

CNSP
HTB

Hack The Box Pro Labs

Zephyr · Dante · RastaLabs · Cybernetics

PRO LABS
05 Recognition

Hall of Fame · 2024

Recognized by the World Health Organization.

Named to the WHO Ethical Hackers Hall of Fame after responsibly reporting multiple vulnerabilities that were subsequently patched.

24

Have a security challenge?

Let’s make the unknown
visible.

Email me ↗ Download my résumé LinkedIn ↗