CEH
Certified Ethical Hacker
Demonstrates practical knowledge of attack vectors, exploitation, and mitigation.
Open to opportunities
Hi, I’m Sefat Khan
Ethical Hacker & Cyber Security Specialist
I help teams find and fix vulnerabilities before attackers do. From recon and exploitation to remediation and defense‑in‑depth, I deliver practical security improvements and clear, actionable reports.
Skills
Penetration Testing
Red-team mindset with practical exploitation and crisp remediation reports.
Vulnerability Assessment
Systematic scanning, prioritization, and actionable risk reduction plans.
Web Security
Secure coding, hardened authN/Z, and modern appsec headers & patterns.
Network Security
Hardening, segmentation, IDS/IPS tuning, and incident response drills.
Digital Forensics
Evidence handling, timeline analysis, and clear chain‑of‑custody.
Bug Bounty
Efficient recon, high‑signal findings, and professional disclosure.
Cyber Awareness
Engaging training, phishing simulations, and measurable culture shifts.
Certifications
OSCP
Offensive Security Certified Professional
Hands‑on penetration testing with proctored exam and real‑world exploitation.
Sec+
CompTIA Security+
Foundation in security principles, risk management, and network protection.
Projects & Case Studies
Web App PenTest
SecurityEnd‑to‑end web application penetration test: uncovered auth bypass and stored XSS; delivered fixes, security headers, and regression tests.
Network Hardening
InfraNetwork hardening engagement: segmentation, IDS/IPS tuning, and SIEM alerting to reduce MTTD/MTTR and blast radius.
Bug Bounty Findings
DisclosureCoordinated vulnerability disclosures with reproducible PoCs, severity assessment, and clear impact narratives.
Blog
Hardening Next.js Apps
GuideModern security headers, auth patterns, and CI checks that raise the baseline for Next.js deployments.
From Recon to Report
BountyA repeatable approach for finding meaningful issues and writing clear, actionable reports.
Zero‑Trust for Small Teams
ArchitectureLightweight steps that dramatically reduce blast radius without slowing delivery.
Practical CSP: From None to Strict
GuideHow to iteratively deploy CSP safely, avoid common pitfalls, and actually block XSS.
Testimonials
“Sefat identified a critical auth bypass in days and guided our team to a robust fix without slowing delivery.”
CTO, SaaS Startup
Web App Penetration Test
“Clear, actionable reports. Our MTTD dropped significantly after his SIEM + IDS/IPS tuning recommendations.”
Head of Infra, Fintech
Network Hardening
“Professional, ethical, and thorough. Coordinated disclosure handled flawlessly with reproducible PoCs.”
Security Lead, Marketplace
Responsible Disclosure
About Me
I’m a security‑focused full‑stack developer who loves building fast, accessible experiences—and breaking things (responsibly) to make them stronger. I blend engineering discipline with an attacker mindset to design, test, and ship software that’s delightful to use and difficult to abuse.
Recent work: hardening cloud‑native apps, leading red‑team style reviews, building CI/CD guardrails, and mentoring teams on secure‑by‑default patterns.
0Experience (yrs)
0Projects
0Reports Fixed
TypeScriptNext.jsNode.jsDockerPostgreSQLBurpNmapOWASP
-
Penetration Testing
Web, mobile, and API testing with actionable remediation. -
Secure Engineering
Threat modeling, least‑privilege, and secure‑by‑default design. -
Automation & Tooling
CI checks, SAST/DAST pipelines, and custom scripts. -
Security Culture
Workshops, playbooks, and empathetic collaboration with teams.