08/30/2026 updated

**** ******** ****
100 % available

Manual Web & API Pentest | IDOR, Payment Flows | AI Generated Code | Audit-Ready

Bilbao, Spain
Only remote
MSc, Saint Petersburg State University
Bilbao, Spain
Only remote
MSc, Saint Petersburg State University

Profile attachments

Dante.pdf
Hades.pdf
P.O.O.pdf
Mythical.pdf
Puppet.pdf
NEHILO-sample-api-pentest-report-DEMO.pdf

About me

I run an independent security-testing practice. Manual web/API pentesting, AI generated code reviews, second opinions on existing pentests. Evidence-first: every finding with replayable steps and a same-day fix. EU bug bounty: two Mediums in review. If I find nothing worth fixing, you do not pay.

Application Programming Interfaces (APIs)Penetration TestingLinuxDevOpsEthical HackingInformation Security ManagementNetwork SecurityOWASPAnsibleWeb Application SecuritySecurity AdministrationSecurity AnalysisVulnerability AssessmentThreat ModelingSecurity AuditsCyber Threat AnalysisKubernetesTerraformDocker
Manual web and API penetration testing focused on what actually gets products breached: broken access control (IDOR/BOLA), business logic, payment flows, race conditions. OSINT attack-surface reviews and independent second opinions. Every finding ships with replayable reproduction steps, demonstrated impact and a same-day fix. Reports mapped to OWASP WSTG, built for PCI DSS / ISO 27001 / SOC 2 submissions. Retest of every fixed finding. Samples: nehilo.eu/proof
Operational security engineering under real adversary models: compartmentalized egress and identity architecture, attribution-resistant infrastructure with zero cross-engagement reuse, systematic detection of surveillance and tracking, leak-path analysis across traffic patterns, DNS, TLS fingerprints, metadata and document properties, counter-forensic handling of evidence and communications.

Experience

Professional experience10+ years
Freelancer since2006

Languages

EnglishFluentRussianNative speakerSpanishGood

Project history

Founder & Security Researcher

NEHILO

Internet & IT

< 10 team member

Manual web and API penetration tests for SaaS and fintech products: broken access control (IDOR/BOLA), business logic, payment flows, race conditions. OSINT attack-surface reviews before audits (PCI DSS, ISO 27001, SOC 2). Independent second opinions on existing pentest reports. Every finding ships with replayable reproduction steps, demonstrated impact and a same-day fix; free retest after fixes. Public proof samples: nehilo.eu/proof

Chief Executive Officer

PortierPay

Banking & Financial Services

< 10 team member

Chief Executive Officer of a payments company. Owned product direction, client relationships and delivery end to end, with full profit and loss responsibility.

Founder

Antinoon

Internet & IT

< 10 team member

Founder. Built and ran the company end to end: product, client relationships, team and delivery.

Senior DevOps Engineer (freelance)

Freelance

Internet & IT

< 10 team member

Independent infrastructure consultant for web product teams. Migrated legacy fleets to Kubernetes, put every environment under Terraform so staging finally matched production, hardened CI/CD with sane secrets handling and one-click rollback, and shrank cloud bills until they were smaller than the developers they supported. Cleaned up the 3 a.m. incidents that only happen to teams growing faster than their infrastructure, and left runbooks behind so they stayed cleaned up.

DevOps Engineer (freelance)

Freelance

Internet & IT

< 10 team member

Freelance infrastructure work while the industry was still inventing the DevOps job title. Virtualized small server rooms on Xen and VMware, moved the first workloads into AWS, replaced snowflake servers with Ansible and Puppet, and put web projects on early Docker with Jenkins and GitLab CI so deploys stopped being an SSH-and-pray ritual. Zabbix and ELK monitoring that cut incident response from hours to minutes for teams that had never had either.

System Administrator (freelance)

Freelance

Internet & IT

< 10 team member

Freelance systems administrator for small and mid-sized companies. Built and ran complete infrastructures on a budget: Linux and Windows servers, office LANs and site-to-site VPNs, Postfix and Exchange mail, Asterisk PBX, file servers, backups that actually restored, and monitoring that alerted before clients noticed. Office moves, hardware rollouts, disaster recovery after dead RAIDs. Clients stayed for years because their infrastructure quietly never broke.

Certificates

Hack The Box Pro Labs: Dante

Hack The Box

2026

Hack The Box Mini Pro Labs: Hades

Hack The Box

2026

Hack The Box Mini Pro Labs: P.O.O.

Hack The Box

2026

Hack The Box Mini Pro Labs: Mythical

Hack The Box

2026

Hack The Box Mini Pro Labs: Puppet

Hack The Box

2026

Portfolio

Contact form

Log in to get in touch

You need to be logged in to use the contact form.

Sign upLog in