// 05 — Reach out
Open channels
Email is the best inbound channel — usually answered within 48 hours. LinkedIn for professional context, intros, and ongoing authorized red-team work.
01 / Direct channels
Pick the line that matches the urgency.
// Direct
- Email engrashfaqulhaq@gmail.com
- LinkedIn /ashfaqul-haq
- Location Dhaka-1212 · BD
- Working hours Sun–Thu · GMT+6
- Languages Bangla · English · Hindi
// At a glance
- Role Off. Sec. Engineer
- Employer Shorborno · GP MSSP
- Experience 5+ Years
- Focus Red / Web / Mobile
- Top certs CRTO · eWPTX · CRTA
02 / Engagement formats
Four ways the work gets structured.
Pick the format that matches the shape of the problem — the technical surface area is the same either way.
Project pentest
Fixed-scope engagement against a defined target — web, Android, network, Active Directory, embedded systems. Kick-off → testing → debrief → final report.
Retainer / advisory
Monthly or quarterly recurring access. Useful when you need a security voice in design reviews, threat-model discussions, or pre-release sign-off without the overhead of a full project.
Bug-bounty & CVE
Coordinated vulnerability disclosure on your product, joint research on third-party software you depend on, or stewardship of an existing program with structural advice.
Training & workshops
Internal sessions on offensive tradecraft, secure coding, threat modeling, or incident response. Tailored to your engineering team's stack.
03 / Surface area & the first email
What I cover, and how to start the conversation.
// What I work on
- Web app pentest
- Android pentest
- Red Team simulation
- APT emulation
- EDR / AV evasion
- DLP bypass
- IoT / Embedded
- Access-control hw.
- Biometric data
- CVE coordination
// What to send
- 01 ScopeWhat you're testing, what's in / out.
- 02 TargetWeb · mobile · network · AD · IoT.
- 03 AuthWritten confirmation of testing rights.
- 04 TimingEngagement window & reporting deadlines.
Engagements without explicit written authorization aren't accepted.
Confidentiality / NDA arrangements available before the first email.
// Best inbound