Résumé

Open to security opportunities · Istanbul, Türkiye

Security work.
Measurable impact.

I'm Sam Kheiri, a CPTS-certified penetration tester focused on web applications, networks, and Active Directory. I turn exploitable findings into clear fixes teams can ship.

Download résumé Discuss a role
LinkedIn ↗GitHub ↗Selected work ↗

01 / Snapshot

The short version.

Evidence first. Details one scroll away.

40+

security assessments

Web applications & vulnerability scans
100+

vulnerabilities identified

65+ in-role and 35+ verified bug bounty findings
25+

pentest reports

Technical evidence and executive summaries
200+

users in AD scope

Least-privilege review and configuration hardening

02 / Experience

Hands-on, end to end.

From finding an issue to helping a team close it.

Oct 2023 — Jun 2024Entekhab Man

Penetration Tester

  • Executed 40+ assessments and identified 65+ vulnerabilities across web applications.
  • Reviewed Active Directory for 200+ users, remediating 30+ misconfigurations through least-privilege controls.
  • Authored 25+ technical reports with stakeholder-ready summaries and remediation tracking.
Mar 2022 — Sep 2023HackerOne · Bugcrowd · Independent

Bug Bounty Security Researcher

  • Reported 35+ verified findings across 20+ programs, with a 75% acceptance rate.
  • Investigated XSS, IDOR, SQL injection, authentication, and business-logic flaws.
  • Built Python and Bash reconnaissance automation to reduce repetitive testing effort.

03 / Proof of work

Selected engagements.

Representative examples. Technical detail is one click away.

01 / Web & network penetration test

Haft Sang

Assessed 15+ endpoints and 8 web services. Delivered a 35-page, CVSS-prioritized remediation report.

9 critical findings02 / Active Directory security

Shen

Reviewed an environment of 150 users, mapped attack paths, and recommended privilege and policy hardening.

12+ security gaps03 / Internal application security

Steel Structure Pardis

Tested six internal applications, including authentication, session management, and access controls.

18 vulnerabilities04 / Web application security

Tire

Identified blind SQL injection and stored XSS, then provided proof of concept and remediation guidance.

Critical SQL injection

04 / Toolkit

The tools behind the findings.

Web & network

Burp Suite · Nmap · SQLMap · Metasploit · Nessus · Wireshark

Active Directory

BloodHound · Mimikatz · PowerView · attack-path analysis

Code & communication

Python · Bash · JavaScript · PHP · technical reporting

Languages

English · Turkish · Persian

05 / Foundation

Credentials & education.

Certified · Jan 2025

Hack The Box CPTS

Certified Penetration Testing Specialist

2022 — 2026

Computer Engineering

Studies at Istanbul Aydın University

Coursework complete

OSCP preparation

Coursework completed; certification exam pending.

Next step

Let's make security
actionable.

For penetration testing, application security, or vulnerability research opportunities.

Email Sam Contact page