Cloud & Infrastructure Security Review
Most breaches don't start with a clever exploit. They start with a permissive IAM role, a bucket policy that drifted, or a service exposed to the internet that nobody remembers deploying. I map what is actually reachable from outside, trace the paths that lead inward, and give you a short list of changes that close them.
- Typical timeline
- 1 to 2 weeks
- Engagement
- Fixed scope, fixed fee
- Deliverable
- Report, PoC evidence and retest
What the work covers.
Identity & permissions
AWS IAM policies and role trust chains, GCP service accounts and IAP, Azure DevOps access. I look for privilege escalation and lateral movement paths.
Object storage
S3, GCS and Ceph RGW bucket policies, public exposure, ACL drift, pre-signed URL behaviour and cross-tenant access.
Network & edge
External attack surface, CDN and origin exposure, origin bypass, TLS configuration, and how well public and internal services are separated.
Linux & Windows hardening
Service configuration, file permissions, sudo and local privilege paths, Active Directory structure, GPO and endpoint baseline.
Secrets & CI/CD
Credential handling across pipelines and hosts, build-system trust boundaries, and deployment identities with more reach than they need.
Attack-path mapping
Not a checklist. A graph of what an attacker could chain together, and the one or two changes that break the most paths.
How the engagement runs.
No engagement starts without a written scope and agreed rules of engagement. Testing windows, contacts and escalation paths are fixed before anything is touched.
What I need from you
- Scope: URLs, apps, IP ranges or accounts in scope
- One technical contact and one escalation contact
- A testing window, or written approval to test 24/7
- Credentials for the roles that should be tested
- 01
Scope
A short call, then a written scope. Targets, rules of engagement, testing windows and anything that is out of bounds.
- 02
Test
Manual work against the real attack surface, with automated tooling where it helps. Findings are confirmed before they reach the report.
- 03
Prove
Every issue comes with reproduction steps, a CVSS score and a realistic impact statement. Critical is just a word without evidence.
- 04
Verify
After remediation I retest each finding and confirm it is closed. Most engagements stop before this step. This is the one that counts.
Often paired with
Application & API Penetration Testing
Manual, OWASP-aligned testing of your web app and APIs. Authentication, access control, business logic, and the flaws that only appear when someone actually tries to break in.
SIEM Engineering & Detection
I design, deploy and tune Wazuh so your monitoring actually catches things. Log ingestion, correlation rules, file integrity monitoring and dashboards.
Ready to scope this work?
Send a short description of the environment and what you need to know. You will get an honest read on scope, timeline and whether this is the right engagement.
Typically replies within one business day. NDA on request.
enes.ismaili@gmail.com