CyberKareemLinkedIn Contact
Menu

Penetration Tester · Security Researcher

I test applications, APIs, cloud, and identity systems, then explain the attack path and the fix.

I'm Abdullah Kareem. 47 assigned CVEs in software such as vLLM, Jackson Databind and Parse Server, backed by CISSP, OSWE, OSEP and OSCP.

Read the research Read the writing
Current role
Penetration Tester
In IT & security since 2014
Public research
47 assigned CVEs
26 rated High or Critical
Core credentials
CISSP · OSWE · OSEP · OSCP · eMAPT · PMP
OffSec · ISC² · PMI

Recent research

Vulnerabilities found and reported in real-world software, like:

vLLM · Jackson Databind · Parse Server · OpenProject · Grav · Infracost · Uyuni · Bazarr · Frigate

See the full ledger

Experience

Offensive security backed by enterprise systems experience.

My background spans infrastructure operations, security engineering, and authorized penetration testing.

See selected work
  1. Now

    Penetration Tester

    Ejabi InfoSec

    Apr 2026 to present

    Authorized application, mobile, and adversary-simulation assessments with peer review and remediation-focused reporting.

  2. Recent

    Cybersecurity Specialist

    Smart Oasis Company

    Feb to Apr 2026

    Network and identity testing, vulnerability management, monitoring, and security-by-design review.

  3. Foundation

    IT & Telecommunications Specialist

    United Nations

    Dec 2017 to Dec 2025

    Enterprise infrastructure, identity modernization, network operations, security response, and staff awareness.

About

Penetration tester, security researcher, and engineer.

I'm Abdullah Kareem, known as CyberKareem. I test applications, APIs, mobile systems, infrastructure, identity, and defined cloud environments. My engineering and operations background helps me explain both the attack path and a practical fix. The part I care about most is the handoff: a finding a team can reproduce and a fix they can ship.

  • Application security

    Web, API, and mobile-backed systems, with emphasis on access control, business logic, source-to-sink review, and reproducible remediation evidence.

  • Adversary simulation

    Attack-path reasoning across identity, internal networks, and applications.

  • Infrastructure and cloud

    Enterprise infrastructure, identity, networks, segmentation, and scoped AWS, Azure, or Google Cloud review where the system and evidence access fit.

  • Security engineering

    Local-first analysis, assessment automation, evidence packaging, and vulnerability-research workflows with explicit operating limits.

Education

Engineering and information security.

  • MSc candidate · Information Security & Digital Forensics

    University of East London

    Sep 2025 to Dec 2026

  • MSc Information Technology · Cybersecurity focus

    University of the People

    Apr 2024 to Aug 2025

  • BSc Electrical & Electronics Engineering

    University of Anbar

    2011 to 2015

Credentials

Selected certifications.

Provider-issued records are linked directly. Current, earlier, and specialist-training records are separated below.

Smart-contract readiness

Assessed Solidity, EVM, and DeFi security training supports bounded readiness reviews. It is not presented as production protocol-audit history.

Verify training opens in a new tab
Complete credential record22 dated records with verification links

Current certifications

12 current or non-expiring professional certification records.

Assessed specialist training

Provider-verified final assessment and hands-on labs supporting bounded Solidity/EVM readiness reviews. This is not presented as production protocol-audit history.

  • Issuer recordCompleted · final assessment 87/100

    SCH

    Smart Contract Hacking (Solidity/EVM)

    Blockchain Security Academy
    Issued
    Validity
    No expiry stated

    Completed both parts of JohnnyTime's assessed curriculum: 33 hours and 50 hands-on exercises across Solidity/EVM security, exploit proof-of-concept development, and DeFi attack paths.

    • Solidity/EVM security testing
    • Foundry/Hardhat lab and PoC workflows
    • Reentrancy and access-control analysis
    • Oracle, flash-loan, and frontrunning analysis
    • DeFi and governance attack analysis
    • Call, delegatecall, and token attack paths

    Credential ID4cabe4baa46be2df98f2b9d3bc644debc4902bef198193d054cef23b3b7ddad5

    Verify SCH credential opens in a new tab

Earlier certifications

9 expired records retained as dated professional history, not presented as current qualifications.

Current certifications, assessed training, and earlier records are shown separately so their status is clear. Some providers issue companion or successor designations, so the total counts public credential records rather than unique examinations.

Public verification

Profiles and issuer records.

Issuer records and public researcher profiles.

Selected evidence

Work you can inspect.

Public source, methodology, and operating limits accompany each entry.

Vulnerability research

kameHunt

An LLM-assisted variant-analysis engine that validates and ranks static-analysis matches into a short list of manually-verifiable leads.

Python · Public MVPView project Recon intelligence

SurfaceLens

A local-first attack-surface workbench for turning common recon output into explainable priorities.

Python · Public MVPView project Security engineering

Building seg-test: A PCI DSS Segmentation Evidence Runner

seg-test runs approved checks from defined source VLANs, preserves raw Nmap output, and packages evidence without making compliance decisions.

12 Jul 2026 · 10 minRead article Security engineering

BitLocker Cryptographic Erase Utility: Design, Limits, and Validation

A reviewed account of a BitLocker-based cryptographic-erase prototype, its operating assumptions, and the validation required before real-world use.

19 May 2025 · 6 minRead article
All projects Search writing

Writing

Latest writing.

Notes on security research, tooling, and the work behind the findings.

All writing

Start a conversation

Discuss a role, a security assessment, or a disclosure.

Email me directly. For assessment or disclosure enquiries, start with high-level context and move sensitive details to an agreed private channel.

Contact Abdullah Security services