Built a self-healing Playwright automation framework for an AI/LLM platform with 900+ automated tests and 400+ BDD scenarios covering complex agent-driven workflows.
Professional Summary
Application Security Engineer, Software Engineer, and Software Engineer in Test with a software and quality engineering background, specializing in Application Security, DevSecOps, Security Automation, and Secure SDLC. Experienced securing AI-driven products, web applications, APIs, desktop applications, cloud infrastructure, and CI/CD pipelines. Proven track record identifying Command Injection, Broken Access Control, XSS, Prompt Injection, business-logic flaws, race conditions, secret exposure, and other OWASP Top 10 risks - backed by strong penetration testing, secure code review, threat modeling, and test automation experience.
Key Achievements
Led the migration of 1,200+ regression scenarios from other frameworks to Playwright on a platform serving 20M+ users, without slowing down releases.
Reduced daily GCP cost from about $600/day to about $100/day by analyzing automated test-run logs and inefficient API, database, and infrastructure usage patterns.
Reduced regression execution time by 40% through test sharding, parallel execution, smarter CI workflows, and trace-based failure diagnostics.
Integrated Semgrep, Trivy, OWASP ZAP, and GitLeaks into GitLab CI and GitHub Actions with automated security gates that block insecure builds before production.
Found 20+ vulnerabilities across 3 AI-driven products - Command Injection, Broken Access Control, Prompt Injection, XSS, race conditions, and authorization and business-logic flaws.
Technical Skills
Application Security
DevSecOps & Security Tools
Automation & Test Design
Programming Languages
CI/CD, Cloud & DevOps
Testing Types
Performance & Observability
Test Management
Professional Experience
Application Security Engineer - ActionModel
UK - RemoteSep 2025 - Present
- Lead application security across three AI-driven products covering web, APIs, desktop applications, and agent workflows.
- Discovered 20+ vulnerabilities including Command Injection, Broken Access Control, Prompt Injection, XSS, and authorization issues.
- Performed secure code reviews using AI-assisted review combined with manual validation, and threat modeling before feature implementation.
- Designed GitLab CI security pipelines integrating Semgrep, Trivy, OWASP ZAP, and GitLeaks, and engineered GitHub Actions security gates that block insecure builds before production.
- Implemented Terraform security controls and GCP Cloud Armor protections.
- Built a self-healing Playwright framework with 900+ automated tests and 400+ Gherkin scenarios for AI/agent-driven journeys, and drove release-gate validation.
- Contributed to reducing GCP infrastructure cost from about $600/day to about $100/day through API, database, and infrastructure optimization.
Application Security & Security Automation Engineer - Okala
Tehran, IranAug 2023 - Sep 2025
- Primary Application Security Engineer for a platform serving 20M+ users and 400+ APIs.
- Performed manual penetration testing and discovered Broken Access Control, DOM XSS, business-logic flaws, race conditions, authorization bypasses, and sensitive data exposure.
- Identified a critical API data exposure vulnerability through parameter manipulation.
- Built an internal security automation framework for continuous API security validation and integrated automated attack-payload testing into CI/CD.
- Designed Grafana dashboards to monitor security metrics, automated test execution, vulnerability trends, and pipeline health.
- Worked with 150+ developers to triage, reproduce, and remediate vulnerabilities.
- Led the migration from Cypress to Playwright across 1,200+ automated regression scenarios.
Application Security & Security Automation Engineer - Qebraq Show
Tehran, IranNov 2022 - Aug 2023
- Performed penetration testing of web applications and APIs using Burp Suite and manual exploitation.
- Identified authentication, authorization, input-validation, and business-logic vulnerabilities.
- Partnered with developers to verify remediation.
- Built Selenium and Appium automation supporting QA and security validation.
Frontend Developer - Asa
Tehran, IranSep 2019 - Nov 2022
- Developed React.js frontend features with JavaScript/TypeScript, reusable components, API integrations, and validation logic.
- Built Cypress unit, component, integration, and UI tests for critical frontend journeys.
- Supported TDD, code reviews, debugging, and release validation with QA and backend teams.
Software Engineer - Pollos
Tehran, IranSep 2017 - Sep 2019
- Built React.js frontend features and Node.js REST API services.
- Implemented unit and integration tests with Jest and Mocha.
- Improved API integrations, debugging, migration quality, and reusable frontend/backend code patterns.
Education, Publications & Community
Education
Master of Information Technology Engineering (GPA A+)
Azad University, 2020-2023
Thesis: Optimizing energy consumption in IoT-based health monitoring using association rules.
Publications
Developing AI-based Framework for Business Model Innovation - Poland, 2023 (Article).
Comparative Analysis of Effective Techniques in Software Automation Testing - 2023 (Book).
Human-Computer Interaction: AI-Driven UI Design - 2024 (Book).
Beyond Vibe Coding: Building Cost-Effective and Secure Software in the Age of AI (Book, in progress).
Community & Interests
Mentored 100+ testing and automation engineers through free community programs.
Volunteer with charitable organizations supporting vulnerable individuals.
Chess player with 1 silver and 2 bronze medals.