AI Security
LLM Security Audit Framework
An automated framework for identifying prompt injection and data exfiltration vulnerabilities in Large Language Models.
PythonOpenAI APIPytestDocker
Available for strategic security leadership & consulting
Mirza Asad
Ahmed Baig
Senior Manager — Cybersecurity & AI Security
7+ years bridging offensive security, enterprise risk governance, and the frontier of AI security research — protecting the organisations and systems that matter.
GRC · ISMSPenetration TestingLLM SecurityAI Risk
Scroll
01About
A leader forged in operational reality.
I am a Senior Cybersecurity Manager with over 7 years of experience spanning offensive security, enterprise risk governance, and cutting-edge AI security research.
My career began hunting threats in the SOC, advanced through complex penetration testing engagements, and evolved into executive leadership — orchestrating comprehensive security postures across enterprise environments and regulated industries.
Today, my core research focus is AI Security — identifying prompt injection vectors in production LLMs, quantifying risks in AI supply chains, and building secure integration frameworks for the next generation of enterprise AI systems.
7+
Years Experience
50+
Security Audits
3
Languages
MA
Professional Portrait02Experience
Career Trajectory.
Senior Manager – Cyber Security
Level 3 BOS
Leading cyber security operations, GRC implementation, and AI security research initiatives.
Senior Penetration Tester
Risk Associates
Conducted advanced penetration testing for web, mobile, API, and network environments.
AI Security Researcher
Independent / Stealth
Researched LLM vulnerabilities, prompt injection attacks, and AI integration security.
Cyber Security Engineer
The Horizon Tech
Implemented DevSecOps pipelines and automated security testing.
SOC Analyst
Intellectsols
Monitored SIEM alerts, incident response, and threat hunting.
03Projects
Impact Portfolio.
Offensive security tooling, GRC automation, and AI vulnerability research — built to solve real enterprise challenges.
Cloud
Enterprise GRC Dashboard
A centralized dashboard for tracking ISO 27001, SOC2, and PCI DSS compliance across multi-cloud environments.
Next.jsTypeScriptAWSPrisma
DevSecOps
Automated DevSecOps Pipeline
A CI/CD pipeline template that integrates SAST, DAST, and SCA scanning natively into GitHub Actions.
GitHub ActionsSonarQubeTrivyBash
04Research
Thought Leadership.
Contributing to the global cybersecurity community through research, vulnerability disclosures, and published insights.
05Skills
Core Competencies.
Governance & Compliance
- ISO 27001
- GRC
- NIST
- HIPAA
- GDPR
- PCI DSS
Offensive Security
- Web Pentesting
- Mobile Pentesting
- API Security
- Network Pentesting
- LLM Pentesting
Cloud
- AWS
- Azure
- Google Cloud
Security Operations
- SIEM
- Wazuh
- Splunk
- LogRhythm
- SentinelOne
Automation
- DevSecOps
- CI/CD
- AI Automation
Technical Proficiency
Security95%
Cloud90%
AI85%
DevSecOps88%
Programming80%
Networking92%
Operating Systems95%
06Credentials
Certifications & Education.
Professional Certifications
CAP
ISC2
APISEC
APIsec University
SSCP
ISC2
RHCSA
Red Hat
AWS Security Specialty
AWS
CSSLP
ISC2
ISO 27001 Lead Auditor
BSI
Google Cybersecurity Professional
LogRhythm LESA
LogRhythm
Education
Bachelor of Software Engineering
Hamdard University
Professional Diploma
Aptech
07Impact
Metrics & Impact.
0+
Years Experience
0+
Reported Vulnerabilities
0+
Security Assessments
0+
Penetration Tests
0+
Security Trainings
Languages
Urdu
Native
English
Professional
Polish
Conversational
08Self-Defense
This site defends itself.
The portfolio runs its own deception stack — every probe below is a live mechanism answering hostile traffic right now.
Scanner Decoys
Fake admin, CMS and config paths answer with indistinguishable 404s. Each attacker gets a deterministic fingerprint, defeating scanner diffing.
Bot Tarpits
Known offensive tooling (sqlmap, Nikto, Burp, Nmap…) is served silent soft-404s on sensitive routes — it never reaches real application surface.
Behavioral Detection
Sliding-window rules score connection floods, sequential probing and auth abuse; findings are risk-ranked LOW → HIGH in real time.
Adaptive Response Budget
Deception replies are CSPRNG-selected and budget-capped per attacker. Once spent, the engine goes dark — log-only, zero signal leakage.
Hardened Auth & Sessions
Two-step admin login, scrypt password hashing, DB-backed revocable sessions, CSRF tokens, origin checks and constant-time comparisons.
Per-Request CSP Nonces
The edge proxy rotates a fresh nonce into the Content-Security-Policy of every response; inline scripts are stamped, violations are reported.
Live Threat Telemetry
ARMED561
Events recorded
559
Last 24 hours
561
Last 7 days
25m ago
Last contact
Top probed paths
/admin/skills61/admin/progress-skills52/admin/certifications50/admin/publications50/admin/achievements45
Tooling observed
- No tooling signatures captured.
Anonymized aggregates only — source addresses are never published.
08Connect
Start a Conversation.
Open to strategic security leadership, AI security consulting, and meaningful research collaborations.
Contact
Prefer email for initial outreach — typically responded within 48 hours.
Phone
Location
Global · Remote