Purple Team · Red Team & Incident Response · Toronto

I run the attack, then build what catches it.

Red team and incident response in one job. I run adversarial simulations, then build the detection, playbooks, deception, and tabletop exercises that catch them. I've been incident commander on live incidents, and I lead Canada's largest hacker community.

120+
Validated vulnerabilities
6+
Years in security
20+
Enterprise clients tested
10+
Conference talks
What I Do

I work both sides of the line. I run adversarial simulations and red team engagements end to end, from scope and rules of engagement through to findings, and I care less about the report than about whether the finding turns into detection that actually fires the next time.

On the defensive side I've served as incident commander on live incidents, built detection and response and a full incident response playbook set from scratch, and designed deception into a client's security architecture, honeypots, decoy credentials, and canary tokens wired to real alerts. I've also managed a team of engineers building our own in-house tabletop platform to run breach scenarios instead of just talking about them.

I've reported 120+ validated vulnerabilities through HackerOne, including severe issues on PayPal, and earlier I was the entire security function at a retail chain scaling toward national coverage, where I built the first security program from nothing. I lead DEF CON Toronto (DC416) and speak at SecTor and DEF CON Vancouver.

How I Work
01

Model the design, not just the build

A trust boundary drawn wrong on a whiteboard costs an afternoon. The same mistake in production costs a quarter. I model abuse cases with the engineers who wrote the doc.

02

Tune the tooling, don't just install it

A scanner at default settings buries a team in noise until they stop reading it, which is worse than nothing. I'd rather ship five findings a week that are all real than five hundred that aren't.

03

One bug, or a bug class

Findings get traced to root cause, then checked for the same pattern everywhere else. One IDOR is a bug. The same authorization mistake in nine places is a design problem.

Where I've Worked
White Tuque, Offensive Security Specialist
Toronto · Oct 2024 to Present
Plan and run adversarial simulations and red team engagements across web, API, cloud, and network for 20+ enterprise clients, weighted toward banking and fintech, emulating real threat actors mapped to MITRE ATT&CK. Designed deception into a major insurance client's security architecture, and managed a team building an in-house tabletop platform. Turn findings into detection logic and playbook updates, not one-off reports.
ASEC, Penetration Tester
Toronto · May 2024 to Oct 2024
Application security assessments for fintech and financial services clients across Canada, the US, Australia, and Europe, under Nick Aleks, former Senior Director of Security at Wealthsimple and now Head of Security at Robinhood. 150+ vulnerabilities across web, REST and GraphQL APIs, and cloud infrastructure.
Ofogh Kourosh Chain Stores, Lead Security Architect
Tehran · 2023 to Feb 2024
Built the company's first detection and response capability and its incident response playbooks and CSIRP from the ground up, defining the response procedures the organization ran against. Set the security design and standards new systems shipped against as the chain scaled from roughly 200 to 1,000 stores, building defense-in-depth into the architecture.
Ofogh Kourosh Chain Stores, Security Engineer
Tehran · Sep 2021 to 2023
Ran centralized logging, monitoring, and vulnerability scanning across a growing multi-site estate, and wrote detection and automation tooling in Python and Bash. Built network segmentation, hardening baselines, and identity and access management at scale, and introduced security checks into the software delivery process.
Ofogh Kourosh Chain Stores, Security Analyst
Tehran · Jun 2020 to Sep 2021
As the primary security resource, served as incident commander on live incidents across corporate and store infrastructure, from detection and triage through containment and lessons learned. Investigated and responded to malware, phishing, and account compromise, with remediation tracked to closure.
DEF CON Toronto (DC416), Lead Organizer
Toronto · 2025 to Present
Lead Canada's largest hacker community: monthly meetups, speaker programming, sponsorships, and events including the AI Fight Club workshop hosted at Palo Alto Networks. Also on the organizing committee for TASK, Toronto's longest-running security community.
HackerOne, Security Researcher
Remote · Feb 2022 to Present
120+ validated vulnerabilities across Fortune 500 disclosure programs. Focus on authentication and authorization bypass, privilege escalation, and multi-step business logic chains across web and API surfaces.
Projects & Research

Eidolon

Open source (MIT) security workspace orchestrator I build and maintain in Python. Per-engagement isolation, scope tokens, a hash-chained audit log, and three-tier command gating.  github.com/amir-hosseinpour/eidolon →

Ecovacs Deebot teardown

Hardware and firmware security research under the vendor's bug bounty program. UART console access, firmware extraction, then up through the cloud API and mobile app.

Offensive tooling

Burp Suite extension for automated OAuth2.0 and OIDC authorization-bypass detection, and a Nuclei template library for API and application vulnerability discovery.

Get in touch

Happy to talk whenever works for you.

amir.m.hosseinpour@gmail.com HackerOne profile GitHub