Penetration tester, security engineer, and researcher. Based in Thessaloniki, working with teams on application security and the tools that support it.
I break web applications and AI systems for a living, then build tools that make the work more effective. My focus is manual testing: understanding application behavior, following the evidence, and finding the authentication, authorization, and business-logic flaws that automated checks can miss.
As an independent consultant, I work through the full assessment lifecycle: defining scope, testing, validating findings, reporting, and discussing remediation. Alongside client work, I develop security tooling and conduct independent research.
My experience includes enterprise application portfolios, private vulnerability research programs, and security work involving government and European projects. I keep employer names, client identities, and private assessment details out of this public portfolio.
Having worked in development and infrastructure before specializing in security, I can discuss both the finding and the engineering decisions around fixing it.
Full-cycle assessments for business clients, from scoping and manual testing through technical reports and findings presentations.
Ongoing assessment of enterprise application portfolios, with a focus on authentication, authorization, business logic, and how weaknesses interact.
Research in vetted, private vulnerability programs, investigating high-impact issues in enterprise applications.
Integrating security checks into delivery pipelines and making their output easier for engineering teams to use.
Earlier work in software development, Linux systems, and DevOps established the practical foundation for my security work.
OffSec Certified Professional+
OffSec Web Expert
Certified Web Exploitation Specialist
Certified Red Team Analyst
Postgraduate study in cybersecurity.
University of Macedonia.
Burp Suite, manual web and API testing, Fortify, SAST/SCA triage, network and Active Directory security.
Python, Bash, JavaScript, report processing, custom assessment utilities, and LLM-assisted security tooling.
Linux, Docker, Kubernetes, Helm, Jenkins, Terraform, Ansible, CI/CD security, logging, and monitoring.
Tell me what you’re building and what you need assessed.