EC-Council · Professional certification
Certified Ethical Hacker (CEH)
Earned 2022
Professional CV
Abdullah Bin Zarshaid
Cybersecurity Manager · Penetration Tester · Corporate Trainer · Researcher
abdullahbinzarshaid@gmail.com
International delivery · 17 October 2026
Cybersecurity Manager and hands-on security practitioner: offensive security, GRC, SOC and incident response, cloud and infrastructure, client advisory, corporate and university training, and applied research.
Cybersecurity practitioner and manager with 10+ years across IT, telecommunications, networking and security. Hands-on work spans authorized web, API, mobile, network, infrastructure and cloud penetration testing; vulnerability assessment; SOC and incident response; GRC and assurance; client advisory; and corporate and university training. Experience includes client work across the Middle East, United States and United Kingdom, including fintech.
Credentials & education
50+vendor & framework credentials
Explore the LinkedIn profile ↗View LinkedIn profile ↗ View LinkedIn profile ↗
Explore the LinkedIn profile ↗
View LinkedIn profile ↗
MSc
FAST-NUCES · Karachi · Master's degree
MSc, Computer Networks and Security
Awarded 2019
BSc
COMSATS University Islamabad · Bachelor's degree
BSc, Telecommunication and Networking
Awarded 2016
Professional experience
- May 2026 to present
Cybersecurity Manager
NKU Technologies LLC, USA
- Lead cybersecurity service delivery spanning authorized penetration testing, vulnerability assessment, GRC, SOC/defensive security, incident response, threat intelligence and client advisory.
- Oversee scope and rules of engagement, client coordination, evidence validation, remediation support, and executive and technical security reporting.
- Support security solution design, pre-sales, RFP/SOW responses, client demonstrations and managed security service growth.
- September 2022 to April 2026
Cybersecurity & Solutions Delivery Manager
Elite IT Team
- Led application and infrastructure assessment delivery, technical review and remediation planning.
- Combined hands-on web/API testing with engineering leadership and coordination of security operations, incident response and compliance work.
- September 2020 to August 2022
Cybersecurity Engineer / Consultant
Elite IT Team
- Tested web applications, APIs and infrastructure using manual HTTP analysis alongside assessment tools.
- Supported identity and MFA reviews, Windows/Linux hardening, Active Directory, network segmentation and monitoring.
- March 2016 to August 2020
Assistant Manager IT, then IT Manager
Cadet College Karachi
- Promoted to IT Manager in April 2018. Managed networks, Windows/Linux services, identity, backups, endpoint protection and infrastructure projects.
Cybersecurity domains & methods
Offensive security & assurance
- Web application and API penetration testing
- Mobile application, network, cloud and internal-infrastructure assessment
- Vulnerability assessment and manual validation
- Scoping, rules of engagement and client coordination
- Evidence review, CVSS analysis, reporting, remediation and retesting
SOC, incident response & threat intelligence
- SOC build-out and security operations
- SIEM, EDR and XDR deployment and workflows
- Incident response coordination and readiness
- Threat hunting, IOC review and log analysis
- OSINT, brand monitoring and exposure review
GRC, risk, compliance & audit
- ISO 27001 and SOC 2 readiness
- NIST and PCI DSS control mapping
- Policies, risk registers and treatment plans
- Audit preparation and evidence management
- Security awareness and compliance-program improvement
Cloud, identity & infrastructure
- Cloud security baselines and architecture review
- Identity, IAM, Active Directory and MFA
- Windows/Linux administration and hardening
- Network design, segmentation and resilience
- Secure infrastructure and modernization
AI, application & emerging-technology security
- AI/ML security and risk review
- LLM and agent security interests
- Application security and business-logic testing
- Authentication, authorization and session lifecycle
- Security automation and reproducible testing
Security management, advisory & business delivery
- Virtual CISO and security-roadmap advisory
- Cybersecurity service delivery and programme improvement
- Client advisory, stakeholder communication and executive reporting
- Pre-sales, RFP/SOW response, solution design and client demonstrations
- Managed security service development and business development
Corporate & university training
- Corporate trainer for cybersecurity awareness and technical capability building
- University cybersecurity, networking and practical lab training
- Banking-sector AI, AI security and cybersecurity awareness
- Seminars, conference sessions, workshops and tabletop exercises
Corporate & university training, banking awareness & speaking
Corporate trainer
Corporate & university training
Deliver practical cybersecurity, networking and computing training for corporate and university audiences, including labs, workshops and capability-building sessions.
University training includes GIK Institute and FAST-NUCES audiences.
Team capability building
Corporate training & awareness
Security awareness and technical capability development for professional audiences, including awareness programmes for large user groups. Corporate and enterprise training is a core service area; sessions are tailored to the audience, operating context and learning outcomes.
Corporate audience experience
Banking-sector AI & security awareness
Delivered AI, AI-security and cybersecurity-awareness training for banking audiences, connecting emerging-technology risks to practical workforce decisions.
ABZSECURE service offering
Security talent & technical hiring
Support security hiring from role definition through practical candidate assessment: evaluate technical reasoning, evidence review, communication and role fit, then help teams make stronger, evidence-based selections.
Available for invitations
Seminars, conferences & panels
Corporate and university audiences: cybersecurity seminars, practical workshops, conference sessions and panel discussions. Topics include application security, AI security, GRC, incident response, networking and workforce capability.
Research
Lifecycle Conditions in CWE-613 Disclosures: A Reproducible, Evidence-Linked Characterisation
The research examines how session-lifecycle conditions are described in vulnerability disclosures and how an explicit follow-up test can distinguish different changes in authority.
I developed SessTrace, a controlled HTTP laboratory with event-driven and time-driven lifecycle cases, vulnerable and fixed variants, and replay controls. The research combines this practical testing perspective with evidence-linked analysis of vulnerability records.
Coauthored with Shahbaz Akhtar Siddiqui. Manuscript submitted to Information on 12 October 2026. Contact me to discuss the method or an approved shareable version.
Selected public work
Open-source security tool
PostureKit
Evidence-led Windows, Active Directory and network posture assessment with read-only collection, hashed evidence batches and transparent rules.
Scope: Posture observations require analyst review; they are not exploitability findings or overall assurance.
Open-source quality gate
EvidenceGate
Offline checks for evidence integrity, supplied CVSS vectors, HTTP capture structure, selected scope conditions and secret patterns.
Scope: A checks-passed state does not prove vulnerability, authorization, authenticity or analyst approval.
Open learning resource
Network Security Assessment Handbook
A 138-page, 19-part handbook connecting authorized network assessment methods to reporting and defensive decisions.
Scope: A learning resource, not authorization to test systems or a replacement for environment-specific procedures.
Authorized cybersecurity lab resource
Ethical Hacking Labs
Nineteen topic guides for authorized university cybersecurity labs with defensive and detection context.
Scope: Exercises belong only in explicitly authorized lab environments; credited student contributions remain attributed in source.
Original practical resources
GRC Working Templates
Six spreadsheet trackers for risk, evidence, remediation, supplier review, policy ownership and assessment scope.
Scope: Working aids, not complete framework checklists, audit opinions or certification evidence.
Public research contribution
CWE proposal: explicit session termination
A proposal concerning improper enforcement of explicit session termination, submitted through the public CWE content-development process.
Scope: Receipt acknowledged and evaluation pending; not an accepted CWE entry.
Selected professional learning
CERTIFICATIONS & PROFESSIONAL LEARNING
A broad security learning and practice ecosystem.
Issuer and framework names reflect professional credentials and selected course records across cybersecurity, networking, cloud, incident response and governance.
IBMFortinetInfoSecISC2, IBM, Fortinet & InfoSec learning records · professional courses and badges
ISC2
Certified in Cybersecurity (CC) course series
Five-course ISC2 curriculum covering security principles, access control, network security, security operations and incident response.
ISC2
CISSP domains and exam-preparation study series
Eight course modules covering CISSP domains and exam preparation.
ISC2
Access Control Concepts; Security Principles; Incident Response; Security Operations
Four ISC2 course completions in access control, security principles, incident response and security operations.
IBM
Cybersecurity Analyst and Cybersecurity Compliance Frameworks
IBM course completions in cybersecurity analysis and compliance frameworks.
IBM
IBM cybersecurity badge transcript: network security, threat intelligence, penetration testing, incident response, forensics, security tools, compliance, operating systems and breach case studies
IBM cybersecurity badges covering network security, threat intelligence, penetration testing, incident response, forensics, security tools, compliance, operating systems and breach case studies.
Fortinet
Introduction to the Threat Landscape 1.0
Fortinet security badge issued June 2023.
IBM and DeepLearning.AI
Introduction to Cloud Computing and AI For Everyone
IBM and DeepLearning.AI course completions.
InfoSec Institute
Cyber Incident Response and Stages of Incident Response
InfoSec Institute course completions in cyber incident response.
Infosec
CISSP exam-preparation specialization (Infosec)
LinkedIn-listed study specialization, issued October 2025.
Infosec
Blockchain Security
LinkedIn-listed credential, issued September 2024.
EC-Council
In the Trenches: Security Operations Center
LinkedIn-listed security operations learning credential, issued April 2024.
Fortinet
FortiGate Administrator
LinkedIn-listed learning credential, issued April 2024.
Red Hat
Fundamentals of Red Hat Enterprise Linux
LinkedIn-listed learning credential, issued March 2026.
Juniper Networks
Security Platforms, IPsec & Troubleshooting; Security Fundamentals specialization
LinkedIn-listed security learning credentials, issued July 2023.
Pohang University of Science and Technology; University of Illinois Urbana-Champaign
Introduction and Programming with IoT Boards; IoT Networking (with Honors)
LinkedIn-listed learning credentials, issued in 2023.
Selected course completions and learning-series records.
A role-specific CV and engagement discussion are available by email.
Discuss an opportunity