Irfanul Montasir
Offensive security engineer, red teamer, and open-source builder. Based in DUBAI, UAE.
I work on the red team at Shorborno Holdings Ltd on the Grameenphone project - Bangladesh's largest telco - focusing on penetration testing, Active Directory exploitation, EDR bypass, and custom tooling in C/C++ and Python. My day-to-day centers on simulating adversaries, stress-testing SOC detection, and running purple-team exercises.
Before Shorborno I was a Security Researcher at PentesterSpace, where I worked across mobile, network, and AD pentesting with BloodHound, CrackMapExec, MobSF, and Burp Suite Pro. I've also spent time in non-security IT leadership - building full-stack systems and leading operations - which shaped how I think about defensive posture from the other side.
Outside work I compete in CTFs, contribute to open-source security tooling, mentor students through the IIUC InfoSec Community I founded, and write about technique and methodology. My research interests span application & AI security, IoT and automotive hacking, ML for threat detection, and agentic AI applied to offensive security.
eCPPT · eJPT
- Conduct penetration testing across mobile, network, and Active Directory environments.
- Build custom APT emulation tools in C/C++ and Python - reflective loaders, indirect-syscall stagers, in-memory execution primitives.
- Bypass industry-leading EDR/XDR via API hook removal, ETW/AMSI patching, and module stomping to stress-test SOC detection.
- Perform source-code review and reverse engineering on production applications; run OSINT-driven threat enumeration.
- Collaborate in purple-team exercises; design pentesting dashboards mapping findings to MITRE ATT&CK and NIST.
- Developed a full-stack inventory system with real-time stock tracking and automated invoicing.
- Led operations and technical strategy to secure and scale financial processes for high-value transactions.
- Performed pentesting across mobile, network, and AD environments using BloodHound, CrackMapExec, MobSF, Burp Suite Pro, and Nmap.
- Deployed IDS/IPS and SIEM tools (Suricata, Wazuh, Splunk, Snort) for proactive threat detection.
- Conducted compliance-driven assessments aligned with GDPR, ISO/IEC 27001, and NIST with detailed technical reporting.
- Thesis: A Novel Approach for Context-Based Searching from Al-Quran using BERTopic Model.
Ongoing mentorship to IIUC students - running cybersecurity bootcamps, guiding research, and supporting practical skill development in ethical hacking, CTFs, and applied security practice. Speak regularly on offensive security topics.