Bohdan Lukin

EPAM Systems · Bratislava, Slovakia (Hybrid)

• Lead enterprise-scale Red Team operations, simulating advanced adversaries to assess detection & response for global technology, financial and healthcare clients.
• Design and execute cloud attack chains across AWS, GCP and Azure — uncovering IAM misconfigurations, privilege-escalation paths and data-exposure risks.
• Direct web, API and mobile testing against OWASP Top 10, OWASP API Security Top 10 and MASVS.
• Advance adversary-simulation tradecraft: post-exploitation, persistence and AV/EDR evasion.
• Mentor security engineers and deliver executive-ready reports translating findings into business risk.

EPAM Systems · Bratislava, Slovakia

• Coordinated Red Team engagements targeting hybrid infrastructures and cloud-native applications.
• Built internal methodologies for privilege escalation, IAM exploitation and service-account abuse in GCP and Azure.
• Ran purple-team exercises with client blue teams to validate detection & response.
• Delivered remediation guidance aligned to MITRE ATT&CK, OWASP and NIST.

UnderDefense · Remote (Part-time)

• Deliver web, mobile and XR/VR application penetration testing for enterprise and product clients.
• Perform cloud and network penetration testing for healthcare/medical customers and SaaS platform providers, in compliance-sensitive (HIPAA / SOC 2) environments.
• Produce risk-based reports with developer-ready remediation aligned to OWASP, OWASP MASVS and NIST.

Sekurno · Remote (Part-time)

• Penetration testing across web apps, APIs (REST, SOAP, GraphQL) and mobile (Android & iOS) — broken auth, insecure storage, authorization bypasses.
• Cloud security reviews for AWS, GCP and Azure: IAM audits, misconfiguration checks, encryption-policy validation.
• Kubernetes hardening (container isolation, network policies, RBAC) and smart-contract audits (Ethereum, BSC).

Leviathan Security Group · Europe

• Penetration testing of web, mobile and infrastructure systems across authentication, access control and API endpoints.
• Applied OWASP methodologies (Top 10, API Security Top 10, MASVS); conducted AWS and GCP cloud assessments.

SoftServe · Lviv, Ukraine

• Delivered web, API and infrastructure security assessments for enterprise-scale applications.
• Specialized in injection flaws, authentication weaknesses and insecure data handling; integrated security into CI/CD.