Kareem Samir

Penetration Tester

Kareem Samir

Offensive security professional helping organizations understand their real exposure. I assess web applications, APIs, network infrastructure and Active Directory from an attacker's perspective, and turn findings into clear risk and prioritized remediation that teams can act on.

Experience

Cybersecurity Engineer

May 2024 – Present

SMART Technology Solutions smart.sa

Penetration testing across web applications, APIs, network infrastructure and Active Directory.

  • Deliver end-to-end penetration testing engagements across web applications, APIs, and external and internal network infrastructure, from scoping and reconnaissance through exploitation, post-exploitation and reporting.
  • Assess traditional and API-driven applications following OWASP WSTG and the OWASP API Security Top 10, focusing on the authentication, authorization and business-logic weaknesses that carry the highest impact.
  • Assess external perimeters and internal networks, including Active Directory, by emulating realistic attacker paths from initial access to domain compromise.
  • Translate technical findings into business risk through comprehensive reports and client debriefs, with prioritized, actionable remediation.
  • Service Development: Expanding the cybersecurity service portfolio, including introducing new offerings such as Secure Code Review.
  • Project & Team Leadership: Managing cybersecurity workstreams, coordinating deliverables, assigning tasks based on team capabilities, and optimizing resource utilization.
  • Mentoring & Knowledge Sharing: Guiding interns and junior team members in penetration testing, supporting technical training and knowledge sharing.

Skills

Web application penetration testing
Manual testing of complex, authenticated applications, concentrated where scanners stop: authentication flows, multi-step business logic, and chaining lower-severity findings into real impact.
API penetration testing
APIs tested directly, with depth in object- and function-level authorization, token and session handling, and excessive data exposure.
External network penetration testing
The internet-facing footprint mapped and tested end to end, from asset discovery to exploitation, focused on real paths to initial access.
Internal network and Active Directory
From an initial foothold to domain compromise, including Active Directory attack paths through Kerberos delegation and ACL abuse, and pivoting across segmented networks.

Certifications

  • CRTP Certified Red Team Professional Altered Security Verify
    CRTP certificate issued to Kareem Samir by Altered Security
  • eWPTXv2 Web Application Penetration Tester eXtreme INE Security Verify
    eWPTX certificate issued to Kareem Samir by INE Security
  • eCPPTv2 Certified Professional Penetration Tester INE Security Verify
    eCPPT certificate issued to Kareem Samir by INE Security
  • CRTO Certified Red Team Operator Zero-Point Security In progress

Hack The Box Pro Labs

  • Dante Hack The Box Pro Lab · Completed Verify
    Hack The Box Pro Labs Dante certificate of completion issued to Kareem Samir
  • RastaLabs Hack The Box Pro Lab · Completed Verify
    Hack The Box Pro Labs RastaLabs certificate of completion issued to Kareem Samir

Contact

Email or LinkedIn is the best way to reach me.