marslan.soc // booting
SOC dashboard loading

Waking up the SIEM...

Bribing the logs with coffee.

▶ init portfolio --mode recruiter-friendly
# Please wait. Jira is being told to stay quiet.
Estimated wait: 5 seconds. Emotional damage: low.
Application Security · GRC · DevSecOps

Muhammad
Arslan

AppSec & GRC Specialist · ISO/IEC 27001:2022 Lead Auditor · Certified Ethical Hacker v12

5+ years securing enterprise applications through DevSecOps pipelines, vulnerability management, and compliance frameworks. Currently based in Doha, Qatar — helping organizations close the gap between code and compliance.

Get in touch View resume View experience Me on Darkweb
5+ Years in Security
10+ Active Certifications
15+ Frameworks Mastered
15+ Security Awareness Trainings Delivered
30+ Critical Vulns Found
35+ Certification Body audit faced
70+ Internal Audits Conducted
100+ ISMS Risk Assessments Conducted
Muhammad Arslan portrait
ISO 27001 LA
AppSec · GRC
Work History

Experience

Information Security Specialist
Aug 2025 → Present
Confidential · Doha, Qatar
  • Advising organizations on ISO 27001:2022, QCSF, and NIA v2.1 frameworks
  • Leading gap assessments and internal audits to prepare clients for certification
  • Developing tailored information security policies and governance documentation
  • Conducting risk assessments and maintaining risk registers aligned to business goals
  • Delivering security awareness training across stakeholder groups
Application Security Engineer
Jan 2025 → Aug 2025
Eon 1byte · Lahore, Pakistan
  • Discovered and reported 5+ critical vulnerabilities (IDOR, XSS, privilege escalation, PHI/PII exposure)
  • Led ISO 27001:2022 compliance through audits, gap analyses, and STRIDE threat modeling
  • Integrated SAST, DAST, and SCA tools into CI/CD; managed SonarQube Quality Gates and Dependency Track
  • Supported HIPAA-aligned SOC2 Type 2 certification with control alignment and documentation
  • Performed mobile app security testing with MobSF using OWASP WSTG, ASVS, and OSSTMM.3
Information Security Engineer
Jul 2023 → Dec 2024
Programmer Force · Lahore, Pakistan
  • Identified and reported 30+ critical vulnerabilities (IDOR, BOLA, CSRF, SQLi, XSS) across production
  • Led SOC2 Type 2, PCI DSS 4.0, Cyber Essentials and Cyber Essentials Plus certification initiatives
  • Integrated SAST, DAST, SCA tools into CI/CD; maintained dashboards in Defect Dojo and Dependency Track
  • Conducted internal phishing campaigns, identifying 30+ compromised users to strengthen awareness
  • Reverse engineered vulnerabilities using GDB and Ghidra; integrated real-time SIEM alerting scripts
Jr. Penetration Tester
Aug 2022 → Jan 2023
Cyber Evangelists · Lahore, Pakistan
  • Performed web application penetration testing as part of a 2-member security team
  • Trained under experienced cybersecurity professionals through mentorship sessions
Jr. Penetration Tester
Apr 2022 → Jun 2022
Martix Qube · Lahore, Pakistan
  • Conducted comprehensive network penetration testing in simulated environments
  • Participated in red team exercises simulating real-world attacks on organizational infrastructure
Technical Expertise

Skills

Application Security
SAST DAST SCA OWASP Top 10 OWASP ASVS API Pentesting Mobile Security Threat Modeling
GRC & Compliance
ISO 27001:2022 PCI-DSS 4.0 HIPAA GDPR NIST SOC2 Type 2 QCSF NIA v2.1 Cyber Essentials
DevSecOps & Tools
SonarQube Dependency Track Defect Dojo Burp Suite MobSF CI/CD Security Qualys
Penetration Testing
Nmap Metasploit Wireshark Ghidra GDB Web App Pentesting Network Pentesting
Languages & Platforms
Python JavaScript STRIDE Secure SDLC Docker Security SIEM
Soft Skills
Security Awareness Training Risk Assessment Cross-team Collaboration Report Writing
Application Security
SAST DAST SCA OWASP Top 10 OWASP ASVS API Pentesting Mobile Security Threat Modeling
GRC & Compliance
ISO 27001:2022 PCI-DSS 4.0 HIPAA GDPR NIST SOC2 Type 2 QCSF NIA v2.1 Cyber Essentials
DevSecOps & Tools
SonarQube Dependency Track Defect Dojo Burp Suite MobSF CI/CD Security Qualys
Penetration Testing
Nmap Metasploit Wireshark Ghidra GDB Web App Pentesting Network Pentesting
Languages & Platforms
Python JavaScript STRIDE Secure SDLC Docker Security SIEM
Soft Skills
Security Awareness Training Risk Assessment Cross-team Collaboration Report Writing
Verified Credentials

Certifications

CQI IRCA
ISO/IEC 27001:2022 Lead Auditor
Valid · Dec 2025 - Dec 2029
Mastermind
Certified ISO/IEC 27001 Lead Auditor
Completed
EC-Council
Certified Ethical Hacker v12
Oct 2024 - Nov 2025
ISC2
Certified in Cyber Security (CC)
Dec 2024 - Dec 2025
arcX
Threat Intelligence Analyst
Completed
SkillFront
ISO/IEC 27001 Information Security Associate
Completed
TheSecOps Group
Certified Network Security Practitioner
Completed
TCM Security
Practical Web Application Security & Testing
Completed
Microsoft
Professional Program in Artificial Intelligence
Completed
Education
BS Cyber Security - Superior University Lahore
Graduated 2023 · Grade A
CQI IRCA
ISO/IEC 27001:2022 Lead Auditor
Valid · Dec 2025 - Dec 2029
Mastermind
Certified ISO/IEC 27001 Lead Auditor
Completed
EC-Council
Certified Ethical Hacker v12
Oct 2024 - Nov 2025
ISC2
Certified in Cyber Security (CC)
Dec 2024 - Dec 2025
arcX
Threat Intelligence Analyst
Completed
SkillFront
ISO/IEC 27001 Information Security Associate
Completed
TheSecOps Group
Certified Network Security Practitioner
Completed
TCM Security
Practical Web Application Security & Testing
Completed
Microsoft
Professional Program in Artificial Intelligence
Completed
Education
BS Cyber Security - Superior University Lahore
Graduated 2023 · Grade A
Let's Connect

Contact

✉ marslan.cyber@gmail.com ☎ (+974) 71383129 in linkedin.com/in/marslan-infosec 📍 Doha, Qatar
marslan ~ whoami
▶ cat profile.json
{
  "name": "Muhammad Arslan",
  "role": "AppSec & GRC Specialist",
  "location": "Doha, Qatar 🇶🇦",
  "clearance": "Qatari Work Permit",
  "expertise": [
    "ISO 27001 Lead Auditor",
    "DevSecOps",
    "Vulnerability Management"
  ],
  "status": "open_to_work"
}
▶ # reach out 👋