Shaheer Khalid

MethodGrey box Client Financial · grey box · 2M+ end users Scale2M+ end users

• Discovered amount manipulation and authentication bypass enabling unauthorised fund transfers CVSS 8.1
• Bypassed SSL pinning, root detection and runtime integrity checks using custom Frida scripts
• Led the remediation workshop with the client's DevSecOps team

MethodOWASP Top 10 & MASVS L2 Client Healthcare · OWASP Top 10 & MASVS L2

• Uncovered 4 high-severity findings, including stored XSS and broken access control
• Mobile assessment identified insecure data storage and weak crypto implementations

MethodBlack & grey box · web, mobile and core infrastructure

• Uncovered critical Remote Code Execution and business logic flaws
• Partnered with engineering to deploy compensating controls within 7 days

MethodInfrastructure, SAST and DAST across globally distributed facilities

• Assessed 100+ network devices and servers
• Delivered a unified remediation roadmap consumed by globally distributed engineering teams

MethodWeb & API Client E-commerce · web & API

• Identified IDOR and account takeover, bypassing WAF and bot protection
• Developer-focused remediation guidance reduced recurrence on subsequent retests

OrganisationMalcrove EMEA Technology L.L.C., Dubai, UAE

• Scope and lead 15+ engagements per quarter across web, mobile, network and Active Directory for enterprise clients in the GCC
• Manage vulnerability assessment and remediation tracking for 2,000+ assets; built a prioritisation methodology ranking findings by asset criticality, public exposure and severity
• Chain low-severity findings into full attack paths, producing CVSS 8.0+ disclosures across multiple engagements
• Build internal tooling automating reconnaissance, reporting and vulnerability correlation
• Contribute TTPs to the internal methodology library; authored scripts adopted firm-wide
• Participate in Red vs Blue exercises to uplift detection engineering and ATT&CK coverage
• Mentor junior consultants and deliver C-suite and engineering briefings

OrganisationB&S World Supply, Dubai, UAE

• Conducted 100+ assessments across systems, networks and applications, reducing critical exposure 60% year-over-year
• Developed policies aligned to NIST CSF, PCI DSS and ISO 27001; led the organisation through 2 external audits with zero major findings
• Reported 200+ vulnerabilities with prioritised guidance, achieving 70% mean-time-to-remediation improvement
• Delivered awareness sessions to 100+ employees; phishing simulations cut click-rate 30%

OrganisationNational Petroleum Construction Company (NPCC), Abu Dhabi, UAE

• Tested 20+ web applications, mobile apps and thick clients across a critical-infrastructure oil & gas estate
• Organisation-level OSINT and attack surface mapping identified 20 externally exposed assets and credentials
• Embedded security into the SDLC with development teams, reducing post-deployment incidents
• Produced 15+ detailed assessment reports for IT leadership and engineering

OrganisationVaporVM, Lahore, Pakistan

• Host, network, web and mobile testing across 30+ client engagements, benchmarked to OWASP Top 10 and MASVS
• Risk assessments validating compliance with international standards and contractual obligations
• Built custom tooling and lab scenarios, accelerating delivery 10%
• Represented the firm in Capture The Flag competitions

InstitutionCOMSATS University, Pakistan

• Coursework: network security, cryptography, database systems, software architecture
• Final year project: integrated B2C e-commerce and eLearning platform — React, Node.js, MySQL