Offensive security engineer. I run penetration tests and red team engagements across SaaS web apps, APIs and cloud infrastructure, from Kubernetes attack paths and container escape to OAuth flows. I ran the AI Fight Club at Palo Alto Networks, a hands-on workshop for 200+ practitioners on attacking and defending LLM and agent systems. I also co-organize DEFCON Toronto, where I find the researchers and presenters worth hearing.
At White Tuque I run penetration tests and red team engagements for more than 20 enterprise clients, across SaaS web applications, APIs and cloud infrastructure. In AWS and GCP I go down to IAM misconfigurations, Kubernetes attack paths, container escape and exposed Docker APIs, and I design cloud detection and deception systems built on honeytokens, decoy credentials and canary resources.
I built the red team and penetration-testing pipeline for a major Canadian insurer across their on-premises and cloud environments. For a Canadian independent power producer I ran six months of red team engagements, then turned the results into months of working sessions with their IT team and a resilience-checking playbook mapped to their compliance requirements.
Authentication and authorization is where I go deepest: OAuth2.0, OIDC, Zero Trust and the business-logic flaws scanners miss. Before consulting, as security architect at Ofogh Kourosh, I led the company's move to the cloud and built its first detection and response function from scratch.
The bugs that matter are authorization gaps, broken trust boundaries and business logic. No scanner reads intent, so I test by hand and chain what I find.
A working proof of concept, a clear risk rating and remediation an engineer can act on, then a retest to confirm the fix actually closed it.
When I hit the same problem twice, I build something: Eidolon for agent-driven testing, Nuclei regression templates for clients' CI/CD, and a Burp extension for unauthenticated endpoints.
I ran a hands-on workshop for 200+ practitioners on attacking and defending LLM and agent systems, as part of DEFCON Toronto (DC416).
I soldered onto the robot's UART, dumped the firmware, recovered cloud credentials and mapped the MQTT topic tree. The broker trusted whatever device identity a client claimed, and the robot ran incoming commands as root with no signature check, so any account could push a shell to anyone's robot, across a fleet of roughly 10 million devices. Six-bug chain, six CVEs filed with MITRE, disclosed under the vendor's Safe Harbor, and presented at BSides Toronto 2026. Read the write-up Talk page
Burp Suite extension that replays your proxy history with Cookie and Authorization removed and flags the endpoints that still answer. github.com/amir-hosseinpour/api-authentication-checker
Rebuilds and extends a GraphQL schema from scattered .gql files into one SDL file you can load into your testing tools. github.com/amir-hosseinpour/graphql_sdl_generator
Open-source (MIT) workspace that runs offensive security work with an AI agent in the loop, with per-engagement isolation, scope tokens, a hash-chained audit log and command gating. github.com/amir-hosseinpour/eidolon
Canadian permanent resident, based in Toronto. I speak English, Farsi and Mandarin. Happy to talk whenever works for you.