Red team operations
Intelligence-driven exercises that follow complete attack chains across identity, endpoints, applications and hybrid infrastructure, then carry the useful lessons into detection and response.
Security engineer · London
Hello, I’m Moaaz.
I’m a senior security engineer specialising in full-scope red team operations, adversary emulation and threat simulation. I trace the routes a determined attacker could use through hybrid environments, then turn that work into practical improvements for defenders.
Offensive security has been my work for more than a decade. Most engagements have to stay private, so this site concentrates on the part that can be checked: public research, earlier roles and professional credentials.
01
The work
Adversary emulation
Objective-led work grounded in APT tradecraft and MITRE ATT&CK, including payload adaptation, EDR-aware execution and routes that do not assume phishing will work.
Offensive engineering
Building and operationalising tooling and infrastructure for repeatable red and purple team work, with clear remediation rather than a pile of findings.
Vulnerability research
Business-logic, access-control and injection findings, with five CVE records and acknowledgements from public security programmes.
02
Selected public work
SolarWinds Web Help Desk · 2021
A trust decision hidden in a referrer header
Web Help Desk used the HTTP referrer as part of an access restriction around its setup flow. Spoofing that value exposed an administrator creation path outside the expected network range. SolarWinds credited the report and fixed the issue in version 12.7.6.
Critical finding recognition
Bugcrowd included me in its Q3 2020 P1 Warriors list. Google’s Bug Hunters programme records a separate acknowledgement.
Research archive
Five public vulnerability records are collected with their vendor, NVD and Exploit-DB references.
03
Background
Earlier roles
2022—24
PwC UK
Manager, Ethical Hacking
2020—22
Synack Red Team
Red Team Member
2022
EY
Senior Consultant, Cyber Security
Selected credentials
GCPN · OSEP · OSCP · OSWP · CREST CRT · CRTO · eWPTX
Certifications are listed under the full credential name “Moaaz Mohamed Ahmed Taha.” Direct badge links will be added as each issuer account is consolidated.