Available for DFIR consulting & threat intel sharing

Hi, I'm Hung Anh (z3r0w3!)

$ █

Threat Hunter & Incident Responder specializing in Malware Analysis, Digital Forensics, and Threat Intelligence — hunting APTs, leading IR engagements, and strengthening cyber resilience for 15+ years.

Report Incident Download CV (DFIR)

Years in cyber defense

Certifications earned

Incidents responded

scroll

I'm a Threat Hunter & Incident Responder with deep expertise in analyzing complex malware campaigns, conducting digital forensics investigations, and delivering proactive threat intelligence that actually defends networks in the real world.

My work spans SOC operations, DFIR engagements, malware reverse engineering (static & dynamic), and building SIEM detection logic that catches what signature-based tools miss. I'm passionate about adversary emulation — understanding how attackers think to reduce dwell time and exposure.

Holds globally recognized credentials including CHFI v11, HTB CWES, INE eJPT, AWS Certified CloudOps, JNCIA-Junos, and Fortinet — spanning digital forensics, web exploitation, and cloud security. Active contributor to open-source malware IOC feeds and YARA rule sets.

Threat Hunting Incident Response Malware Analysis DFIR Threat Intel Reverse Engineering SIEM / SOC

Cyber Security & DevOps Engineer

Outpost24

Present Jul 2018 — Now Remote

Deployed and operated SaaS security platforms specializing in Security Monitoring, Incident Response, and Threat Hunting.
Conducted Vulnerability Assessment and produced Threat Intelligence Reports for enterprise clients.
Bridged DevOps and cybersecurity practices to ensure continuous security integration in CI/CD pipelines.

Delivering enterprise-grade SaaS security operations across global customer environments since 2018.

Offensive Security Researcher

Government Organization · Vietnam

Present 2018 — Now Full-time

Specializing in Threat Hunting, Incident Response, and Threat Intelligence across government and enterprise environments.
Conducted red team operations and adversary emulation to assess and strengthen national-level security posture.
Produced classified threat intelligence reports aligned with MITRE ATT&CK framework.

Red team operations and adversary emulation at the national level — contributing to strategic cyber resilience.

Cloud & Infrastructure Engineer (AWS)

GoTyme X

Mar 2018 — Sep 2021 Contract

Designed, implemented, and managed secure and scalable network solutions on AWS Cloud.
Ensured high availability, performance, and operational reliability of cloud-hosted financial services.
Collaborated with security teams to enforce IAM policies, VPC segmentation, and encryption standards.

Delivered secure, highly-available AWS infrastructure underpinning financial-grade services.

Deployment Engineer

EI CO., LTD

Oct 2008 — Apr 2018 Full-time

Implemented and maintained NCR ATM systems including hardware deployment and network configuration.
Provided troubleshooting and operational support for banking infrastructure across multiple sites.
Coordinated with banking clients to ensure 99.9% uptime of ATM networks.

Maintained 99.9% uptime across multi-site ATM banking infrastructure for nearly a decade.

Incident Response & Digital Forensics 92%

SIEM Engineering & Detection 90%

Malware Analysis & Reverse Engineering 86%

Threat Intelligence & CTI 85%

AWS Cloud & Infrastructure 84%

DevSecOps & CI/CD Automation 82%

EC-Council CHFI v11

Computer Hacking Forensic Investigator

HTB CWES

Certified Web Exploitation Specialist

INE eJPT

Junior Penetration Tester

AWS Certified CloudOps Engineer

Cloud concepts & security

JNCIA-Junos

Juniper Networks Certified Associate

Fortinet Certified Associate

Cybersecurity & network security

Ransomware IR Simulation

Full lifecycle response: containment, forensic acquisition, decryption analysis, and root-cause mapping to MITRE ATT&CK.

Ghidra / RE KAPE Velociraptor

Threat Intelligence Feed

Enriched IOC feed from OSINT + MISP, correlated with SIEM to detect APT infrastructure with <20 min TTD.

Python MISP ThreatQ

Malware Analysis Sandbox

Automated dynamic analysis (CAPE/Cuckoo) + static unpacking. Produced YARA rules for in-the-wild samples.

YARA CAPE IDA Pro

APT Campaign Attribution

Attributed a multi-month intrusion campaign to a known threat actor through TTP correlation and infrastructure pivoting.

MITRE ATT&CK Maltego OSINT

Memory Forensics Toolkit

Volatility-based workflow for rapid identification of injected shellcode, rootkits, and credential dumping artefacts.

Volatility 3 Python Redline

SIEM Detection Engineering

Designed 60+ Sigma / Splunk SPL detection rules mapped to ATT&CK with tuned false-positive suppression playbooks.

Sigma Splunk SPL KQL