Tel Aviv, Israel

Michael Azoulay

Application Penetration Tester

Specializing in Web, API, Mobile, and Thick Client application security assessments.

Professional Summary

Michael is a penetration tester specializing in application security across Web, API, Mobile, and Thick Client environments. His work includes scoping, threat modeling, hands-on exploitation, proof-of-concept development, remediation guidance, and professional reporting.

His background combines client-facing application assessments with incident response, cyber threat intelligence, Python-based tooling, and security automation. He is currently advancing Red Team and Active Directory offensive capabilities.

Experience

Application Penetration Tester

MADSEC Security LTD - Tel Aviv

Performs application security assessments across Web, API, Mobile, and Thick Client environments, with ownership of the testing lifecycle from scoping and threat modeling through exploitation, POC development, and reporting.

Identifies complex vulnerabilities beyond OWASP Top 10, including business logic flaws and authorization weaknesses, and collaborates directly with developers, DevOps, and product teams on remediation guidance.

Application Penetration Tester and Security Consultant

Freelance

Provides freelance application security consulting, with public CV references to Plonter and R2M Group. Exact engagement scope can be added if public disclosure is approved.

[Insert approved freelance engagement details, scope, and public links if available.]

Cyber Security Specialist

N.E.S.S - Clalit Healthcare - Tel Aviv

Performed proactive threat analysis and incident response for cybersecurity events, working with security, IT, and engineering teams to investigate malware activity, network abnormalities, and breach attempts.

Developed custom tools and dashboards to improve detection accuracy and streamline investigations. Enriched cyber threat intelligence using sources including CERT-IL and NGOs, converting raw indicators into actionable recommendations.

Tier 2 Cyber Security Analyst

Citadel - MSSP - Rehovot

Conducted continuous threat analysis and provided real-time guidance on network configuration, security rules, and attack mitigation for more than 20 clients.

Led incident response investigations, developed Python-based tools and automations, and produced documentation covering threat activity, incident actions, and security recommendations for technical and non-technical stakeholders.

Selected Projects

File Upload Testing

UploadBuster

A utility intended to help test upload restrictions during controlled application security assessments.

Purpose
Support manual review of file upload controls.
Technical angle
File validation, upload restrictions, and bypass-oriented testing workflows.
View repository

OSINT Utility

Monocle

A username search tool for checking usernames across multiple websites.

Purpose
Assist account and username discovery during authorized research.
Technical angle
Public profile discovery, repeatable checks, and reconnaissance support.

Repository URL not listed publicly.

Web Utility

xPathgrabber

A tool for printing text elements from websites.

Purpose
Extract visible text elements for web review and testing workflows.
Technical angle
XPath-oriented page parsing and repeatable content extraction.
View repository

Technical Profiles

Focus Areas

Application Security

  • Web Application Security
  • API Security
  • Mobile Application Security
  • Thick Client Security
  • Authentication and Authorization Testing
  • Business Logic Testing

Assessment Delivery

  • Scoping and Threat Modeling
  • Hands-on Exploitation
  • Proof-of-Concept Development
  • Vulnerability Validation
  • Remediation Guidance
  • Clear Technical Reporting

Supporting Capabilities

  • PortSwigger Burp Suite
  • Python Tooling and Automation
  • Incident Response
  • Cyber Threat Intelligence
  • Security Research
  • Offensive Lab Development

Training

Certified Red Team Professional (CRTP)

Altered Security

Current

Malware Analysis and Triage

TCM Security

2024

Mobile Application Penetration Testing

TCM Security

2023

CEH - Ethical Hacking

HackerU

2019 - 2020

Contact

For application security assessments, consulting, or professional opportunities, use the contact details below.