Thapanarath Khempetch

About

I've spent six years testing web, mobile, API, and ATM systems for banks and enterprise clients in Thailand. My open-source vulnerability research has produced 14 published CVEs. Every finding I report raises the same question: how do we stop this from shipping again? A SQL injection built with sprintf() is exactly what a static analysis rule catches before release. That question is pulling me toward DevSecOps, closer to where the code gets built. ▪ What I do • Penetration testing: web, mobile (iOS/Android), API, network, ATM, and NDID systems, mostly in the financial sector • Vulnerability research: 14 published CVEs, including an IDOR that led to admin account takeover in Peppermint and an error-based SQL injection patched in CoreShop 4.1.9 • Reporting and remediation: risk-ranked findings, walking developers through fixes, and verifying them on retest ▪ Right now At the Big Data Institute, I manage a vendor-led penetration test from scoping through retest and triage security advisories for impact on our systems. I also built a Python tool using the Claude API that pulls vulnerability data out of PDF advisories into a central tracker, replacing manual entry. ▪ Building toward DevSecOps: static analysis and code review, software composition analysis, GitHub Actions, and AWS IAM security, through hands-on courses and labs on AppSecEngineer and now KodeKloud, alongside my day job. Certifications: OSCP · eWPTX · CRTA · CEH · SecurityX · CySA+ · PenTest+ · Security+ Open to Penetration Testing, DevSecOps, and DevOps roles where security is part of the job. GitHub: github.com/bypazs

Experience

1. Cybersecurity Consultant - Penetration Tester
   SOSECURE Co., Ltd.
   2020-03 — 2023-01

   • Conducted penetration testing on web, mobile, backend, and network/infrastructure systems for enterprise and financial-sector clients. • Discovered and responsibly disclosed vulnerabilities in open-source web applications, each assigned a CVE by MITRE. • Built a hands-on vulnerability lab and co-taught a Road to Cybersecurity training session with it; also ran the hands-on DVIA lab in a clients mobile app security training. • Guided junior consultants on penetration-testing approach and tooling.

2. Senior Associate - Penetration Tester
   MAYASEVEN Co., Ltd.
   2023-02 — 2026-02

   • Ran a year-long penetration testing engagement for a major Thai bank across its web, mobile, and API systems; identified a critical time- based blind SQL injection and documented it with step-by-step reproduction and evidence. • Delivered penetration tests across web and mobile applications (iOS/Android), backend APIs, ATM systems, and the NDID platform for financial-sector clients, each with a risk-ranked report and remediation plan. • Presented findings to client engineering and management teams, walked developers through fixes, and verified remediation through retesting. • Reviewed junior testers penetration-test reports for finding accuracy, severity ratings, and remediation advice before client delivery.

3. Security Engineer
   Big Data Institute (BDI)
   2026-03 — Present

   • Manage a third-party penetration test from scoping through remediation: coordinate with the testing vendor, review findings, and track the system vendors fixes through retest. • Triage security advisories for impact on institute software and hardware; alert the project managers of potentially affected systems, follow up until patches are confirmed, and report closure to management. • Built a Python tool using the Claude API that extracts vulnerability data from PDF security advisories into a central tracker, replacing manual row-by-row entry.

Education

1. Kasetsart University
   Bachelor of Computer Engineering · Computer Engineer
   2011-01 — 2016-01

Skills

Role preferences

Open to roles

devops, devsecops, penetration tester