A small consultancy practice. I take on a limited number of engagements at a time so each one gets senior attention end-to-end — no junior handoffs, no scope drift, no surprises.
Each one tailored to scope, but built on the same disciplined process and the same single point of contact: me.
Hourly rate depends on the testing surface. Every engagement includes the full set of inclusions listed below — there are no surprise add-ons.
> Every engagement is scoped and quoted in hours upfront. Fixed-price quotes available for well-defined scopes.
Eleven steps from first email to remediation sign-off. The same pipeline every time, scoped to fit.
> Scroll horizontally on smaller screens · the same 11 steps run for every engagement type
From single-app spot-checks to multi-week, multi-surface enterprise assessments. Every test runs through the 11-step pipeline above.
I treat pentesting as a craft, not a checklist. The automated tools run, but they're a small part of the work — the real value is in the manual hours spent abusing business logic, chaining low-severity issues into critical impact, and validating every finding before it lands in your report.
For companies that need senior security leadership without a full-time hire. Typically a monthly retainer with a defined set of deliverables and standing meetings.
I plug in alongside your eng leadership, take ownership of the security function, and drive the work from policy to posture to people. The goal is always to leave you better-defended — and to make the role redundant when you're ready to hire in-house.
Bring me in for a focused engagement — architecture review, program design, hiring panel, conference prep, or just a few hours of "is this idea sound?" time.
Sometimes you don't need a vCISO and you don't need a pentest — you need an expert pair of eyes on a specific decision. Advisory engagements are billed hourly or fixed-price for a defined deliverable, and start at a few hours.
Personal, recurring mentorship for testers, bug bounty hunters and AppSec engineers serious about levelling up. Limited slots, application-based.
I work with a small number of mentees at any given time. Sessions are typically bi-weekly, focused on whatever moves the needle for you — technical depth on a specific surface, career direction, certification prep, real-world bug review, interview practice, or building your own consultancy.
I'll meet you where you already are. No new tools to learn, no portals to log into, no friction.
A decade in the industry with 700+ pentests delivered. Working expertise across triage, security engineering, consultancy, mentorship and security advisory — the full lifecycle of the work, not just the testing half.
Previously: Synack Red Team, Cobalt Core (Lead Pentester), independent bug bounty hunter (Bugcrowd MVP, top-150 all-time), security consultant.
I respond inside 24 hours. Initial scoping calls are free & non-obligatory.
hbothra22@gmail.com →