John Turay

Conduct in-depth vulnerability assessments on web applications and APIs using SAST/DAST methodologies. Perform API security testing using Burp Suite and OWASP ZAP, combining manual and automated approaches. Deliver comprehensive security reports with prioritized remediation recommendations for development teams. Collaborate with developers to reproduce findings, validate fixes, and promote secure coding practices.

Identify and validate complex security vulnerabilities including SQLi, XSS, IDOR, and CSRF. Write detailed technical reports with proof-of-concept (PoC) exploits for program owners. Collaborate closely with stakeholders to prioritize findings based on business risk.

Developed REST APIs using Java (Spring Boot) and Angular (TypeScript/JavaScript) with security embedded throughout the development lifecycle. Implemented authentication, authorization, and input validation following OWASP guidelines. Collaborated with DevOps to integrate security checks into CI/CD pipelines.

Executed comprehensive penetration tests on web applications using manual and automated tools. Identified injection flaws, session weaknesses, and business logic vulnerabilities.

Conducted black-box and gray-box assessments on production web applications against OWASP Top 10. Performed static code reviews across Java, JavaScript, and PHP codebases.

Designed and developed secure PHP-based e-commerce applications using LAMP stack. Mentored junior developers on secure coding practices and web security fundamentals.

Master in Informatica.

Professionele bachelor in Informatica.