Вадим

VADIM KROKHMAL
Junior Penetration Tester / Security Analyst
Age: 20 (born 11.09.2006) | Kharkiv, Ukraine | Open to on-site roles abroad and relocation
Telegram: @serege11 | Phone: [open contact info](look above in the "contact info" section)
Email: [open contact info](look above in the "contact info" section)

PROFESSIONAL SUMMARY
3rd-year Cybersecurity student (V. N. Karazin Kharkiv National University) with hands-on experience in web application
security testing, reconnaissance and vulnerability reporting, combined with a current working role in IT systems
administration at Avec Concern. Carried out authorized security audits for a commercial client, an academic project and
my own university, including gaining root access to a production Zabbix monitoring server through an exposed credentials
backup found during manual reconnaissance. Resolved repeated compromises of educational websites at both
application and server level. Completed ~100 vulnerable machines on VulnHub and built a personal SOC lab on the ELK
Stack to study attacker behavior from the defensive side. Combine offensive skills with real administration experience
(RDP infrastructure, access policies, account management, Docker), which helps me understand how systems are actually
built and where they break. English: B1–B2. Seeking a Junior Penetration Tester or SOC Analyst position in an on-site
team abroad.

PROFESSIONAL EXPERIENCE
System Administrator | Avec Concern, Kharkiv 06/2026 – Present
• Support ~150 users: create and configure accounts and workstations in Active Directory (including mailboxes), reset
passwords, restore access to network drives and handle other user requests, currently routed through the head of IT
and moving to direct handling.
• Provision and support remote desktop (RDP) environments; during the migration to a new RDP server, configured
thin clients and remote access for employees and troubleshot connection and session problems.
• Work with Windows Server infrastructure, including the RDP server, network file storage and database servers.
• Configure server policies to maximize performance and minimize the risk of resource exhaustion, including restricting
internet and browser access on terminal servers.
• Proposed reimaging existing PCs with a thin-client OS as part of the planned replacement of old workstations, and
reflashing network-booted thin clients ahead of the boot server's decommissioning.
• Test web applications in isolated Docker containers before use.
• Use Nmap to discover lost and undocumented servers on the internal network (~3 found), helping keep the
infrastructure inventory accurate.
Internal Security Researcher (Volunteer) | V. N. Karazin Kharkiv National University 07/2026 – 08/2026
• Initiated and carried out a security assessment of the university's external IT infrastructure with the approval of a
lecturer and the faculty dean.
• Manually enumerated and analyzed ~100 subdomains, identifying forgotten assets and internal service panels
unintentionally exposed to the internet.
• Discovered a backup file on a public web page containing SSH credentials for a server on a different subdomain and
IP address; used it to obtain root access to the Zabbix monitoring server, demonstrating a full compromise path from
a single exposed file.
• Documented the attack chain and prepared a technical report with remediation recommendations for the
university's system administrators. Applied responsible disclosure practices throughout the engagement.
• University administration subsequently recommended me as a specialist to the Cyber Police of Ukraine and the
National Anti-Corruption Bureau of Ukraine (NABU).
Web Security Tester | QRNGua project (academic, supervised by a university lecturer) 05/2026 – 07/2026
• Entrusted by a lecturer with security testing of the qrngua.website platform.
• Identified an XSS vulnerability, CSRF, an exposed WordPress administration panel (wp-admin), open critical
directories, server IP disclosure and a denial-of-service vulnerability (known CVE).
• Reported findings to the project owner.
Contract Web Security Tester | Diamond 10/2025 – 01/2026
• Performed security testing of a web application, covering bug hunting and attempts to exploit common
vulnerabilities: SQL injection, XSS and remote code execution vectors.
• Identified server IP disclosure and an outdated version of the FTP protocol.
• Documented all findings in a written report delivered to the client.

Freelance Web Security Specialist | Web development company (education sector) Summer 2025 (2 weeks)
• Engaged by a company building websites for schools and other educational institutions whose sites were repeatedly
compromised and left returning HTTP 500 errors.
• Audited the websites and the hosting server using Nmap, dirb, Gobuster and publicly available exploits.
• Found and eliminated the root causes on both the website (application) side and the server side, fully resolving the
issue within 2 weeks.

KEY PROJECTS & PRACTICE
• Personal SOC Laboratory: designed and deployed a SOC environment on the ELK Stack under Linux. Simulated attacks
against OWASP Juice Shop and DVWA, analyzed the resulting traffic in Kibana and detected attacker activity by
unusual User-Agents, non-standard HTTP requests and scanner signatures.
• VulnHub Write-ups: technical write-ups with SOC-oriented, MITRE ATT&CK-mapped analysis, covering enumeration,
exploitation, privilege escalation and detection (e.g. Jangow 1.0.1).
• ~100 vulnerable machines completed on VulnHub and Vulhub, with focus on post-exploitation, pivoting, database
enumeration and service analysis.
• Scripting and automation: Bash scripts for password brute-force testing; Python scripts for routine pentesting and
data-processing tasks.

TECHNICAL SKILLS
Offensive Security: web application testing (manual and automated), OWASP Top 10, reconnaissance and attack surface
mapping, subdomain enumeration, vulnerability research, Linux privilege escalation, post-exploitation, pivoting,
vulnerability reporting
Tools: Nmap, Metasploit, Gobuster, dirb, WPScan, Burp Suite Community, public exploit frameworks
Defensive Security & Monitoring: ELK Stack (Elasticsearch, Kibana), log analysis, threat detection, Zabbix, MITRE ATT&CK
mapping
Systems Administration: Active Directory user and account management, RDP/terminal server support, access and policy
configuration, thin clients, network drives, network discovery, Docker
Scripting & Programming: Bash, Python, Java, C
Operating Systems: Kali Linux, Debian, Fedora, BlackArch, Windows Server
Currently learning: PortSwigger Web Security Academy (in progress)

EDUCATION
Bachelor of Science in Cybersecurity, 3rd year | V. N. Karazin Kharkiv National University 10/2024 – Present
Specialty 125: Security of Information and Communication Systems