Rafi Riswan

• Spearheaded multiple end-to-end VAPT engagements across client-facing digital assets and proprietary SaaS
platforms, collaborating closely with the CISO to strengthen enterprise security posture.
• Executed rigorous security QA and adversarial penetration testing on OTC crypto trading applications, helping
remediate 95%+ identified vulnerabilities across the DevOps lifecycle in coordination with development teams.
• Enforced 100% adherence to VARA regulatory compliance requirements across application layers, aligning
platforms with Dubais virtual asset governance framework.
• Administered and hardened enterprise endpoint security via Microsoft Entra ID, improving identity-driven Zero
Trust enforcement and reducing unauthorized access risks.
• Architected and audited network perimeter security controls including firewall reviews, ACL hardening, and
network segmentation, while strengthening VPN and ZTNA policies to reduce enterprise attack surface.

• Conducted comprehensive VAPT against SaaS Products using Burp Suite, OWASP ZAP, Nessus, and MobSF,
identifying and reducing high-risk vulnerabilities by over 75%.

• Performed source code reviews (PHP, JavaScript, Node.js, TypeScript), uncovering 30% more issues than black
box testing alone and automated repetitive testing and validation tasks using Python and PowerShell

• Created detailed, developer-friendly VAPT reports with clear risk descriptions and actionable remediation steps,
helping teams resolve vulnerabilities efficiently to achieve overall system hardening by 90%.

• Provided training, security awareness guidelines, and technical support for 20+ developers, improving overall
security hygiene by significant levels.

• Tested software against the OWASP framework and updated functionality statuses in reports; developed Proof of Concept (PoC) for identified vulnerabilities.

• Participated in client sessions and technical training, and conducted physical VAPTs at client locations using tools like Kali Linux, Nessus, Nmap, and Burp Suite.