Muhammad Faqih

Application security · Penetration testing

I have 3+ years of application security experience across web, API and mobile testing. I’ve worked on DAST in banking, validated findings manually, and written reports that help developers reproduce and fix issues.

Experience

Security Analyst

PT Systech Global Informasi (SGI Asia)

Test web applications, APIs and Android/iOS apps for weaknesses in authentication, authorization, input validation and business logic.
Validate findings manually and write up the impact, reproduction steps, proof of concept and recommended fixes.
Built a TCP/SOCKS5 interception relay for desktop application testing where HTTP interception did not work.

Sep 2025 — Present

Application Security Engineer

PT Korelasi Persada Indonesia · Assigned to BRI

Ran DAST scans on web applications and APIs with WebInspect, then manually checked the findings for false positives.
Handled approximately 1,200–1,500 DAST-related tickets per year as an individual contributor.
Integrated DAST into Bamboo CI/CD and coordinated follow-up on findings through Jira and Microsoft Teams.

Aug 2023 — Aug 2025

Technical skills

Security testing: Web applications, REST APIs, Android & iOS, Authentication and authorization, Business logic, Vulnerability assessment, Manual validation

Application security: DAST, Finding triage, Reproduction steps and supporting evidence, Remediation guidance, CI/CD scanning

Tools: Burp Suite, WebInspect, Jira, Bamboo, Nmap, Metasploit, Wireshark, Postman

Systems and development: Windows, Linux, TCP/IP, SOCKS5 proxies, Rust, HTML, CSS, JavaScript

Freelance penetration testing

Independent Penetration Tester

Freelance security assessments

IKD (2026) — Android and iOS penetration testing.
Simplo (2026) — web application and API penetration testing.
Skybooth (2025) — API penetration testing.

2025 — 2026

Technical project

Raw TCP / SOCKS5 Interception Engine (Rust)

Security tooling

Built a TCP relay that forwards bytes unchanged in both directions without interpreting the application protocol. Verified its behavior with integration tests and packet captures.

2026

Teaching and training

Cybersecurity Instructor

DigiTalent Systech · Weekend Warrior Bootcamp

Created training materials and CTF labs, and taught sessions 2–7 of an eight-session program. The final assignment included a CTF, a report and a presentation.

Aug — Sep 2026

Assistant Instructor, API Security & Pentesting

Bank Indonesia

Supported a five-day API security training program, built practical labs and taught the final-day session.

2025

Cybersecurity Instructor

Media Kreasi Muslim

Taught cybersecurity fundamentals, with exercises on phishing, password security, common threats and Linux.

2024