I'm a penetration tester focused on FinTech. I spend most of my time inside payment platforms, neobanks, and investment applications, finding the things scanners miss and working with engineering teams to actually fix them. Not just write reports about them.
Most of my work is with financial services companies. Payment processors, neobanks, investment platforms. I do penetration testing, secure code reviews, and threat modeling across their web applications, APIs, and cloud environments.
I also do bug bounty research. I've reported over 110 validated vulnerabilities to companies like PayPal, Sony, AT&T, Airbnb, and Alibaba through HackerOne. The focus is always application security: access control, authentication, API flaws, business logic issues in financial workflows.
What I care about most is making sure the things I find actually get fixed. I work directly with engineering teams to trace root causes, help write patches, build unit tests, and set up regression checks so the same class of bug doesn't come back next quarter.
I lean towards software centric threat modeling. For financial platforms, I need to understand how the application can be abused through its own logic and data flows before I touch anything. The threat model drives the test plan.
I write custom Nuclei templates for patterns specific to each platform and run those alongside manual testing in Burp Suite. Secure code review happens in parallel. Scanners alone miss the things that actually matter in a financial application.
Findings include observed behavior, root cause in the code, reproduction steps, and a specific fix. When I can, I sit with the team and help write the patch and the unit test. Reports that collect dust are a waste of everyone's time.
Testing: Web applications, GraphQL APIs, REST APIs, mobile, network, cloud (AWS)
Languages: Python, Go, Bash, PowerShell
Tools: Burp Suite, Nuclei, httpx, subfinder, Nmap, Wireshark, Metasploit
Frameworks: NIST SP 800 115, OWASP, PCI DSS
Application Stacks: Ruby on Rails, React, GraphQL
If you're looking for someone who breaks financial platforms for a living, I'd like to hear about it.