Pavlo

PAVLO SVIZINSKYY
Application Security & Backend Engineer — Node.js / TypeScript · AppSec · Offensive
Security
[open contact info](look above in the "contact info" section) · Telegram @an404on · [open contact info](look above in the "contact info" section)
GitHub: github.com/enot3615 · [open contact info](look above in the "contact info" section) · Blog: [open contact info](look above in the "contact info" section) · Ukraine (remote, EU/US
hours)

SUMMARY
Backend engineer and security researcher who builds and breaks. 3+ years shipping production Node.js /
TypeScript systems, combined with hands-on offensive and application security — OWASP Top 10, red-
team / phishing simulation, OSINT, malware and Android reversing. I founded a dev studio that ships client
web apps with a security review before every release, and I co-organize a national youth CTF. I bring a
developer's context to security work: I can find the bug, exploit it, and then write the fix.

CORE SKILLS
Application Security: OWASP Top 10 / API Security Top 10, secure code review, threat modeling, auth &
access control (JWT/RBAC), Burp Suite
Offensive Security: red-team / phishing & social-engineering simulation (evilginx, MITM), OSINT /
reconnaissance, malware analysis, Android reversing (APK / smali), CTF
Backend & APIs: Node.js, Express, TypeScript, JavaScript, REST, WebSockets, Socket.IO, Protobuf,
webhooks, rate limiting
Automation: BullMQ, Puppeteer (browser automation, anti-bot handling), Telegraf (Telegram bots)
AI & Agents: MCP (Model Context Protocol) servers, LLM integration, AI-agent orchestration, prompt
engineering
Data & Infra: PostgreSQL, MySQL, MongoDB, Redis; Linux, Docker, Nginx, Cloudflare, DNS, VPS, Google
Cloud, Git, CI/CD

EXPERIENCE
Founder & Security-focused Developer — Vapan · vapan.org · 2024 – present · Remote
Founded and lead a small studio (developers, designers, security) that designs and ships client web
applications with security built into delivery.
• Run an OWASP-based security review before every client release — finding and fixing web and API
vulnerabilities.
• Lead development on Node.js / Vue / Nuxt; own scoping, delivery and remediation across 20+ client
projects.
Backend Engineer & Security Researcher — Freelance & Contract · 2022 – present · Remote
• Designed and shipped REST / WebSocket APIs on Node.js + TypeScript for production apps with
thousands of users; implemented JWT/RBAC auth and secure third-party / payment integrations.
• Built Telegram bots (Telegraf), BullMQ pipelines and Puppeteer browser automation.
• Offensive & application security: web & API vulnerabilities (OWASP Top 10 / API Security Top 10), red-team
/ phishing & MITM scenarios with evilginx, OSINT and target profiling, malware analysis and Android
reversing (APK / smali), tooling with Burp Suite.

CYBERSECURITY & COMMUNITY
• Co-organizer of CTF Junior League (national youth cybersecurity competition) and active CTF player.
• Run a cybersecurity channel and publish technical write-ups (vapan.org · Instagram @vapan_it).

SELECTED PROJECTS
AiFinPay — payment rails for autonomous AI agents. Node/Express backend, USDC/USDT settlement,
React/Vite SPA, Docker/Nginx — hackathon → published npm package.
aifinpay.io · npm: npmjs.com/package/@aifinpay/agent

Autonomous multi-agent system (MCP) — MCP servers exposing real tools to LLM agents, orchestrated
with Slack as the control interface.
github.com/enot3615

EDUCATION & CERTIFICATIONS
• B.Sc. Cybersecurity — West Ukrainian National University, Ternopil · 2024–2028 (in progress)
• Cisco Networking Academy — Junior Cybersecurity Analyst Career Path
• Cisco — CyberOps Associate

LANGUAGES
Ukrainian — Native · English — Professional working proficiency (read/write technical docs fluently)