AI Security / Offensive Security
Kuala Lumpur / MY
I break systems, engineer agentic workflows, and build safer intelligent systems. Offensive security meets AI security and precise engineering.
AI Security / OffSec / Build01 / Profile
I like systems most when I can understand their assumptions, stress them, and engineer better ones.
I’m Mahir, a cybersecurity and AI security engineer focused on offensive security, web and API testing, security automation, cloud security, and vulnerability research. I have hands-on client assessment experience and I care about how real assessments are scoped, executed, verified, and documented.
My engineering work extends into agentic AI and ML security: Xekute explores bounded AI-assisted security assessment workflows, while VULNERA applies code-focused machine learning to function-level vulnerability risk estimation. I care about deterministic verification, evidence-first systems, and turning research ideas into usable software.
02 / Selected work
A local-first AI-assisted workspace for authorized security assessment that connects scope, intercepted traffic, evidence, findings, security tooling, advanced VAPT search, and governed agent workflows. It combines authority and scope controls, verification-oriented workflows, delegated agents, and a SQLite/FTS5 assessment intelligence engine. Xekute is an active Windows alpha.
A function-level vulnerability triage system for C/C++ code. The research pipeline uses GraphCodeBERT window embeddings, a supervised tree ensemble, calibrated aggregation, signature corroboration, and explainable attribution—then exposes the analysis through FastAPI and React.
A voice-first visual AI tutor where GPT-5.6 plans focused teaching turns, ten deterministic board tools construct and verify the visual state, and a realtime voice layer performs the validated explanation. Built around strict script validation, prepared turns, state verification, and reliable multimodal orchestration.
A production multilingual AI lead-capture platform for Bangladeshi SMBs, supporting Bangla, Banglish, and English while integrating Meta messaging channels, Gemini, Supabase, Resend, and Cloudflare-based serverless infrastructure.
A local-first job application workspace that stores structured career data and job postings, then runs reviewable LLM stages to generate tailored résumés and cover letters. A React interface, Python backend, visual templates, and local HTML/PDF export keep the workflow auditable and portable.
A local Windows voice assistant using wake-word detection, faster-whisper speech recognition, layered intent routing, deterministic tool execution, and a local LLM fallback for ambiguous commands so common actions stay fast and predictable.
A studio for websites, custom software, and web development with a full VAPT included in every package. Honest pricing, short delivery loops, and security treated as part of the build rather than a separate engagement.
03 / Capabilities
Web / API testing · reconnaissance · validation · cloud review · VAPT reporting
Tool boundaries · authority models · scope controls · agent permissions · human-in-the-loop design
Agent harnesses · deterministic execution · verification · recovery · evidence pipelines
GraphCodeBERT · PyTorch · dataset pipelines · model adaptation · calibrated risk estimation
AWS · Azure review · Linux · networking · Bash · serverless architecture
Python · TypeScript · React · Electron · FastAPI · APIs · software delivery
04 / Experience
FSeC @ APU / APIIT
SYNK · Remote
Research / Open-source / Product work
05 / Credentials
Offensive security · agent systems · ML security · engineering
View selected work →LetsDefend / January 2025
INE Security / March 2026
INE Security / 12 September 2026
Amazon Web Services / 2026
Amazon Web Services / 2026
Amazon Web Services / 2026
Red Hat / January 2025
Red Hat / December 2025
Red Hat / 2026
06 / Start a conversation