I'm an offensive security engineer and penetration tester based in the UK, holding CPENT, CEH Master, CHFI, and ISO 27001 Lead Auditor among more than 20 certifications. Most of my work is finding and proving real vulnerabilities in enterprise and cloud systems, and building the tooling to do it: AWS IAM risk analysers, autonomous DDoS detection, and HEAVEN, an autonomous penetration-testing framework that pairs an LLM planner with deterministic verification so it never reports a finding it cannot confirm. I'm doing an MSc in Cyber Security at Birmingham City University, working where penetration testing meets applied machine learning. I placed first at a BCU cybersecurity hackathon for a privilege-escalation detection platform, and I co-authored peer-reviewed research on evasion attacks against phishing detectors, presented at ICETCS. I'm aiming for a penetration tester role where I can keep breaking systems to make them harder to break.
┌──(HEAVEN㉿kali-offensive)-[~]
└─$ sudo cat /root/.profile
╔════════════════════════════════════════════════════════════════════════════╗
║ ║
║ ███╗ ██╗██╗███████╗ █████╗ ██████╗ ██████╗ ║
║ ████╗ ██║██║██╔════╝██╔══██╗██╔══██╗██╔════╝ ║
║ ██╔██╗ ██║██║███████╗███████║██████╔╝██║ ███╗ ║
║ ██║╚██╗██║██║╚════██║██╔══██║██╔══██╗██║ ██║ ║
║ ██║ ╚████║██║███████║██║ ██║██║ ██║╚██████╔╝ ║
║ ╚═╝ ╚═══╝╚═╝╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝ ║
║ ║
║ >> ALIAS : HEAVEN ║
║ >> IDENTITY : Nisarg Chasmawala ║
║ >> ROLE : Offensive Security Engineer | Penetration Tester ║
║ >> LOCATION : England, United Kingdom ║
║ >> EDUCATION : MSc Cyber Security — Birmingham City University ║
║ (Expected Graduation: March 2027) ║
║ ║
║ >> CERTS : CPENT | CEH Master | CEH v13 | CHFI | EHE 96% ║
║ ISO 27001 LA | ISO 27701 LA | CCST ×3 | CCNA (Cisco) ║
║ CRTOM | CTIGA | CCEP | CCPC | CLLMSE | CLLMSP | CHTAP ║
║ CORE (Hackviser) | Log Analysis | TOEFL iBT 91/120 ║
║ ║
║ >> FLAGSHIP : ▶ HEAVEN — Autonomous Pentest & Risk-Scoring Engine ║
║ observe-plan-act AI planner · hybrid ML (R²=0.91) ║
║ MITRE · Lockheed Kill Chain · OWASP · SARIF/Burp XML ║
║ ║
║ ▶ HEAVEN-GeoIntel — Unified OSINT Intelligence Platform ║
║ 7 identifier types · auto-pivot link graph · offline-first║
║ Perceptual-hash fusion · 242+ platforms · STIX 2.1 ║
║ ║
║ >> WEAPONS : Metasploit · Burp Suite · Nessus · Maltego ║
║ Wireshark · Autopsy · FTK Imager · MITRE ATT&CK ║
║ TensorFlow · XGBoost · NetworkX · AWS IAM ║
║ ║
║ >> ML WINS : DDoS Detection — 99.99% Accuracy | 1.0000 Precision ║
║ Malware Engine — 98.47% F1-Score | Near-Perfect AUC ║
║ CVSS Prediction — R² = 0.9988 | MAE = 0.0400 ║
║ IoT Flow Predict — R² = 0.9999 | MAE = 0.0010 ║
║ ║
║ >> HACKATHON : 🥇 1st Place — BCU Cyber Security Society Hackathon ║
║ Project: Aegis-IAM Dashboard | STEAMhouse, UK ║
║ 🏅 Top 5 Finalist — UniHack 2026 | AquaSense AI ║
║ 🥈 Runner-Up — BCU AI Hackathon 2026 | RAG QA ║
║ ║
║ >> MISSION : Uncover vulnerabilities. Secure critical systems. ║
║ Shape international cyberspace policy. ║
║ Build a safer digital world — one exploit at a time. ║
║ ║
║ [STATUS] ████████████████████████████████ ACTIVE — ALWAYS HUNTING ║
╚════════════════════════════════════════════════════════════════════════════╝
[HEAVEN@offensive-sec ~]$ _
CORE LANGUAGES & PLATFORMS
AI & MACHINE LEARNING ARSENAL
OPERATING SYSTEMS
┌──(HEAVEN㉿kali-offensive)-[~/os-arsenal]
└─$ uname -a --all-platforms
[+] macOS ............... Daily Driver
[+] Kali Linux ............... Primary Offensive Platform
[+] Parrot OS ............... Alternate Offensive Platform
[+] Ubuntu / Debian ............... Server & Dev Environments
[+] Windows 10 / 11 ............... Target Simulation & Forensics
[+] iOS / Android ............... Mobile Security ResearchCYBERSECURITY TOOLS MATRIX
| ⚔️ Exploitation | 🔍 Recon & OSINT | 🧪 Digital Forensics | ☁️ Vuln Management |
|---|---|---|---|
Metasploit Advanced |
Nmap / Netcat Advanced |
Autopsy Advanced |
Nessus Advanced |
Burp Suite Advanced |
OSINT Framework Advanced |
FTK Imager Advanced |
OpenVAS Advanced |
SQLmap Advanced |
Maltego Advanced |
Magnet AXIOM Advanced |
AWS IAM Advanced |
Hydra Advanced |
Wireshark Advanced |
Magnet DVR Examiner Advanced |
MITRE ATT&CK Advanced |
John the Ripper Advanced |
Shodan Advanced |
MOBILeadit Advanced |
NetworkX Advanced |
Aircrack-ng Advanced |
Nikto / Acunetix Advanced |
Passware Kit Advanced |
CVSS Scoring Advanced |
Ghidra (RE) Very Good |
Snort Very Good |
Volatility Advanced |
ISO 27001 Audit Certified |
╔─ MISSION BRIEF ──────────────────────────────────────────────────────────────────────────╗
THREAT VECTOR : Automated Vulnerability Discovery, Exploit Simulation & Risk Scoring
TECH STACK : Python · FastAPI · React · ExtraTrees + TF-IDF · PostgreSQL
KEY RESULT : AI Attack-Chain Planner · Hybrid ML Risk Scoring (R²=0.91) · SAST + SCA
EXPORTS : MITRE ATT&CK · Lockheed Kill Chain · OWASP Top 10 · SARIF + Burp XML
╚──────────────────────────────────────────────────────────────────────────────────────────╝
HEAVEN is an autonomous penetration-testing platform built on FastAPI, React, and PostgreSQL, exposing one engagement dataset through a CLI, a web UI, and REST and WebSocket APIs. Its core is a deterministic false-positive suppression loop: an LLM proposes candidate weaknesses, then deterministic detectors confirm each one through active exploitation (sqlmap, RCE canaries, an in-house OAST collaborator), so nothing is reported on an AI's word alone. An observe-plan-act planner drives the attack chain across different LLM providers, including local models, and falls back to a deterministic heuristic so it still runs fully offline with no credentials. Risk scoring pairs an ExtraTreesRegressor with a TF-IDF text model trained on over 315,000 real NVD CVEs (R²=0.91), and EPSS, CISA KEV, and empirical Bayesian priors decide what gets fixed first. Findings map to MITRE ATT&CK, the Lockheed Cyber Kill Chain, and OWASP, and export to SARIF, Burp XML, and standard SAST/SCA formats. The engine runs on an asynchronous, dependency-aware task graph behind JWT RBAC, an AES-256-GCM credential vault, and an HMAC-signed append-only audit log, which keeps large assessments resumable.
╔─ MISSION BRIEF ──────────────────────────────────────────────────────────────────────────╗
THREAT VECTOR : Domain · Crypto Wallet · Username · IP · Deep File Metadata
TECH STACK : Next.js · React · TypeScript · Offline-First · Keyless OSINT APIs
KEY RESULT : Auto-Pivot Link Graph · Perceptual-Hash Fusion · 242+ Platforms
COMPLIANCE : Anti-SSRF · API-Key Isolation · HMAC Case Mgmt · STIX 2.1 / Maltego / PDF
╚──────────────────────────────────────────────────────────────────────────────────────────╝
HEAVEN-GeoIntel is a unified OSINT platform built on Next.js, React, and TypeScript that pulls seven identifier types (domains, crypto wallets, usernames, IP addresses, and others) plus deep file-metadata extraction into one workspace. It runs offline-first: bundled compliance datasets (OFAC sanctions, telecom routing) and keyless OSINT APIs supply target metadata with no paid commercial keys. A cross-identifier auto-pivot engine turns each lead into a node on an interactive link-analysis graph and keeps confirmed relationships separate from unverified candidates, so provenance stays clear. To hold accuracy across broad username enumeration, a custom server-side perceptual-hashing routine checks avatars across 242+ platforms and drops false matches. Attack-surface discovery runs through certificate transparency, passive DNS, and Shodan, with threat scoring that keeps abuse risk separate from exposure. The deployment is fully test-covered and hardened with server-side API-key isolation, deterministic anti-SSRF validation, and an HMAC-sealed case-management system that exports evidence to STIX 2.1, Maltego, and PDF.
╔─ MISSION BRIEF ────────────────────────────────────────────────────────────────────╗
THREAT VECTOR : AWS Cloud IAM Over-Privilege & Privilege Escalation
TECH STACK : Python · Flask · NetworkX · MITRE ATT&CK · AWS JSON · OWASP
KEY RESULT : 57 IAM verbs × 10 enterprise tactics · 38 E2E security tests
COMPLIANCE : XSS · CSRF · JSON depth-bomb protections · SoD conflict detection
╚────────────────────────────────────────────────────────────────────────────────────╝
Aegis-IAM is a stateless IAM risk analyser built on Python and Flask that reads AWS JSON exports and flags over-privileged identities and separation-of-duties conflicts. A NetworkX graph-traversal engine maps multi-tier IAM relationships and scores privilege-escalation paths by severity. It maps 57 dangerous IAM verbs across 10 enterprise tactics to MITRE ATT&CK, shown as a live heatmap with a deterministic posture score. The app passes 38 end-to-end security tests (XSS, CSRF, JSON depth-bomb), and a CLI patch pipeline turns each finding into a ready-to-run fix command.
╔─ MISSION BRIEF ─────────────────────────────────────────────────────────────────────╗
THREAT VECTOR : Wastewater Regulatory Breach Prediction & Tamper-Evident Auditing
TECH STACK : Node.js · React · Authenticated WebSockets · Edge Inference
KEY RESULT : 96.2% Precision · <200ms Statutory Alerts · 40+ E2E Tests Passed
COMPLIANCE : OWASP Top 10 (zero-dependency) · HMAC-SHA256 · Dual SHA-256 Chains
╚─────────────────────────────────────────────────────────────────────────────────────╝
AquaSense AI is a real-time IoT compliance platform on Node.js and React that reads live sensor telemetry over authenticated WebSockets and reacts to abnormal wastewater readings on its own. An edge-inference detector runs four independent models (linear regression, Z-score, Mahalanobis distance, IQR isolation) and flags likely regulatory breaches at 96.2% precision. It builds Section 82 compliance reports, tracks multiple sites, and pushes tamper-evident alerts to statutory bodies in under 200ms. The stack mitigates the OWASP Top 10 with no external dependencies, passes 40+ end-to-end tests, and protects data integrity with HMAC-SHA256 signing and dual SHA-256 hash chains.
╔─ MISSION BRIEF ──────────────────────────────────────────────────────────────╗
THREAT VECTOR : Android APK Permissions & API Call Static Analysis
TECH STACK : Python · Scikit-Learn · XGBoost · Drebin (15,000+ records)
KEY RESULT : 98.47% F1-Score · Near-perfect ROC-AUC
INNOVATION : Behaviour-based detection replacing signature scanning
╚──────────────────────────────────────────────────────────────────────────────╝
An Android malware classifier built with Python and Scikit-Learn that runs static analysis on app permissions and API calls. It compares L1 regularisation, Chi-Square selection, and Random Forest importance on the Drebin dataset (15,000+ samples), then trains XGBoost, Random Forest, Logistic Regression, and KNN to move from signature matching to behaviour-based detection. The tuned XGBoost model reaches a 98.47% F1-score with near-perfect ROC-AUC.
╔─ MISSION BRIEF ──────────────────────────────────────────────────────────────╗
THREAT VECTOR : Volumetric DDoS Network Intrusion Classification
TECH STACK : Python · TensorFlow · XGBoost · CIC-DDoS2019 (225K+ rows)
KEY RESULT : 1.0000 Precision · 99.99% Accuracy · ZERO false positives
MODELS TESTED : 1D-CNNs · MLPs · XGBoost · Random Forest
╚──────────────────────────────────────────────────────────────────────────────╝
An AI network intrusion detector built with Python, TensorFlow, and Scikit-Learn for volumetric DDoS traffic. Preprocessing on the CIC-DDoS2019 set (225,000+ rows) handles severe class imbalance before training 1D-CNNs, MLPs, and tree ensembles. The tuned XGBoost model reaches 1.0000 precision at 99.99% accuracy, so analysts see no false-positive alerts while recall on active attacks stays near perfect.
╔─ MISSION BRIEF ──────────────────────────────────────────────────────────────────╗
THREAT VECTOR : Automated NVD Severity Assessment via ML & Deep Learning
TECH STACK : Python · Scikit-Learn · Extra Trees · LSTM · GRU · NVD Dataset
DATASET : 337,705 historical CVE records (National Vuln. Database)
KEY RESULT : R² = 0.9988 · MAE = 0.0400 · CV R² = 0.9990 (Extra Trees)
FEATURE SELECT : Lasso · ElasticNet · Mutual Information · 13 optimal predictors
╚──────────────────────────────────────────────────────────────────────────────────╝
A supervised ML and deep-learning pipeline that predicts CVSS base scores (0.0 to 10.0) from vulnerability metadata, trained on 337,705 NVD CVE records. Feature selection with Lasso, ElasticNet, and mutual information narrows the set to 13 predictors. It trains tree ensembles (Extra Trees, Gradient Boosting) and recurrent networks (LSTM, GRU) on the non-linear metadata. The Extra Trees model reaches R² = 0.9988 and MAE = 0.0400, and holds a cross-validated R² = 0.9990, which makes it stable enough for patch prioritisation.
╔─ MISSION BRIEF ─────────────────────────────────────────────────────────────────────────╗
THREAT VECTOR : IoT Network Flow Lifetime Forecasting & Anomaly Detection
TECH STACK : Python · TensorFlow · Scikit-Learn · RT-IoT2022 Dataset
DATASET : 117,000+ unique records · 50 raw features → optimal subsets
KEY RESULT : R² = 0.9999 · MAE = 0.0010 (Gradient Boosting, 39 features)
MODELS TESTED : Gradient Boosting · Extra Trees · AdaBoost · Huber · GRU · Transformer
╚─────────────────────────────────────────────────────────────────────────────────────────╝
A regression model built with Python, TensorFlow, and Scikit-Learn that forecasts how long IoT network flows stay alive, for telemetry and anomaly work. Preprocessing on the RT-IoT2022 set (117,000+ records) uses variance filtering, correlation pruning, and gradient-boosting importance to cut down 50 raw features, with log1p to tame heavy right-skew. Across 24 configurations spanning tree ensembles (Gradient Boosting, Extra Trees, AdaBoost), a Huber linear model, GRUs, and Transformer encoders, Gradient Boosting reaches R² = 0.9999 and MAE = 0.0010 on 39 features, and Extra Trees holds R² = 0.9996 after an 87% cut in feature count.
╔─ MISSION BRIEF ────────────────────────────────────────────────────────────╗
THREAT VECTOR : Dynamic CVSS Replacement — Context-Aware Risk Scoring
TECH STACK : Python · Scikit-Learn · XGBoost · Feature Engineering
KEY RESULT : Real-time 0–10 context risk scores · MSE/RMSE/MAE/R² val.
INNOVATION : TCP flags · port categories · protocol features as inputs
╚────────────────────────────────────────────────────────────────────────────╝
An adaptive ML framework in Python and Scikit-Learn that reproduces and extends the Lim & Muhammad (2024) work, moving vulnerability scoring from static CVSS to real-time, context-aware scores. It turns raw network-traffic features (TCP flags, port categories, protocols) into normalised 0-to-10 risk scores with one-hot encoding and feature engineering. XGBoost, Random Forest, Decision Tree, and KNN are trained and validated on MSE, RMSE, MAE, and R² for enterprise threat prioritisation.
Peer-Reviewed · Presented at ICETCS · Lead Co-Authors: Nisarg Chasmawala & Jatin Kumar
A peer-reviewed study on how well six machine-learning phishing detectors (XGBoost, LightGBM, and a 1D-CNN among them) hold up against problem-space evasion attacks. We split up to 111 features into attacker-controlled and infrastructure-fixed groups so the generated attacks stay realistic and valid. Running PGD transfer and hard-label L2 boundary attacks over 67,000+ instances dropped clean accuracy from 98.5% to 66.3%. A feature-reliance metric showed the weakest detectors drew 76.6% of their decision weight from mutable features, which points straight at where adversarial-training defences fall short.
The framework write-up behind the flagship project: an observe-plan-act loop with deterministic verification that removes LLM hallucination during live engagements. The risk model trains on 315,648+ NVD CVEs, using ExtraTrees (R²=0.91) for scored metrics and TF-IDF Ridge regression (99% severity-band accuracy) for unscored findings, behind an authorization gate, an AES-256-GCM vault, HMAC-signed audit logging, and LLM prompt redaction. It served as the technical instrument in a formal MSc assessment of a UK social-housing provider, surfacing 167 verified findings across web, internal, and cloud scopes.
The platform write-up for HEAVEN-GeoIntel: an offline-first OSINT system covering seven identifier types and deep file-metadata extraction, driven by a cross-identifier auto-pivot engine that maps leads into a link-analysis graph. A custom server-side perceptual-hashing method verifies identities across 242+ platforms and clears false positives. Attack-surface discovery runs through certificate transparency, passive DNS, and Shodan, with a threat score that keeps abuse risk separate from exposure. The Next.js/React deployment is 100% test-covered, with server-side API-key isolation, anti-SSRF validation, and an HMAC-sealed case-management system.
A research review of AI-driven autonomous penetration testing across deep reinforcement learning, GANs, LLMs, multi-agent systems, and neurosymbolic AI. A structured gap analysis names six barriers to enterprise deployment, chiefly the Sim2Real transfer gap, LLM hallucination, and over-reliance on Capture-the-Flag benchmarks. It then proposes six concrete fixes, including the ENTERPRISE-BENCH evaluation framework, RAG-LLM validation pipelines, and inverse RL for reward-function inference.
| 🏅 | Certification | Issuer | Date | Score / Credential | 🔗 Verify |
|---|---|---|---|---|---|
| CPENT · Certified Penetration Tester Professional | EC-Council | 2024-11 |
ECC6970842153 |
 |
|
| CEH Master · Certified Ethical Hacker Master | EC-Council | 2024-04 |
ECC1382059467 |
|
|
| CEH Practical | EC-Council | 2024-04 |
180/200 · ECC7804965321 |
|
|
| CEH v13 · Certified Ethical Hacker | EC-Council | 2025-12 |
ID 776964 |
|
|
| CEH · Certified Ethical Hacker | EC-Council | 2024-01 |
91.2% · ECC5081642397 |
|
|
| CHFI · Computer Hacking Forensic Investigator | EC-Council | 2023-12 |
90.7% · ECC4925367081 |
|
|
 |
ISO/IEC 27001:2022 Lead Auditor | Mastermind | 2026-01 |
ttuf1fci7e |
|
|
ISO/IEC 27701:2025 Lead Auditor | Mastermind | 2026-06 |
e0b15gpw6t |
|
| CCST Cybersecurity · Cisco Certified Support Technician | Cisco | 2026-06 |
wETwJ-48cp |
|
|
| CCST Networking · Cisco Certified Support Technician | Cisco | 2026-06 |
PrUY-u8wz |
|
|
| CCST IT Support · Cisco Certified Support Technician | Cisco | 2026-06 |
hvhp-4w67 |
|
|
| CRTOM · Certified Red Team Operations Management | Red Team Leaders | 2026-01 |
— | |
|
| CLLMSE · Certified LLM Security Expert | Red Team Leaders | 2026-07 |
— | |
|
| CLLMSP · Certified LLM Security Professional | Red Team Leaders | 2026-06 |
— | |
|
| CTIGA · Threat Intelligence & Governance Analyst | Red Team Leaders | 2026-01 |
— | |
|
| CCEP · Certified Cybersecurity Educator Professional | Red Team Leaders | 2026-01 |
— | |
|
| Foundations of Log Analysis for Cyber Defense | Red Team Leaders | 2026-01 |
— | |
|
| EHE · Ethical Hacker Essentials | EC-Council | 2026-01 |
96% · ECC8416329075 |
|
|
| CCPC · Certified C++ Practitioner | Red Team Leaders | 2026-01 |
— | |
|
| CORE · Certified Cybersecurity Foundations | Hackviser | 2026-07 |
HV-CORE-13I8JBOO |
|
|
| CCNA Security · Trained (Cisco curriculum) | Sysap Technologies | 2023-07 |
Trained |
|
|
| CHTAP · Certified Human Trafficking Awareness Professional | Red Team Leaders | 2026-06 |
— | |
|
| TOEFL iBT | ETS | 2024-07 |
91 / 120 |
|
╔════════════════════════════════════════════════════════════════════════╗
║ TIMELINE ║
╠════════════════════════════════════════════════════════════════════════╣
║ ║
║ [2025-05 → 2026-09] LEAD SECURITY CONSULTANT (MSc PROJECT) ║
║ NEHEMIAH HOUSING ASSOCIATION, Birmingham, UK ║
║ ▸ Security posture + v3.3 gap analysis · £9.1M ║
║ ▸ Ran HEAVEN framework · 1,800+ safe checks ║
║ ▸ Triaged 167 findings incl. critical SQLi ║
║ ▸ NIST SP 800-115 · board remediation roadmap ║
║ ▸ 11-part IASME Cyber Essentials toolkit ║
║ ║
║ [2025-03 → 2025-09] IT HARDWARE SUPPORT ENGINEER · FULL-TIME ║
║ NIVA TECHNO TRANSITION, Surat, India ║
║ ▸ Enterprise system installation & maintenance ║
║ ▸ Hardware, software & network diagnostics ║
║ ▸ LAN/Wi-Fi & peripheral management ║
║ ▸ Regular security checks & offsite support ║
║ ║
║ [2024-02 → 2025-02] VULNERABILITY ASSESSMENT & PENETRATION TESTER ║
║ SYSAP TECHNOLOGIES, Pune, India (Remote · P/T) ║
║ ▸ Full-scope enterprise penetration tests ║
║ ▸ Executive + technical risk report delivery ║
║ ▸ Vulnerability remediation & hardening ║
║ ▸ Maintained currency with emerging threats ║
║ ║
║ [2023-07 → 2024-01] VULNERABILITY SCANNING & PEN TEST INTERN ║
║ SYSAP TECHNOLOGIES, Pune, India ║
║ ▸ Security & vulnerability scanning ║
║ ▸ Exploitation, threat intel & compliance docs ║
║ ▸ Security research & record keeping ║
║ ║
║ [2023-01 → 2023-04] NETWORK SPECIALIST INTERN ║
║ AIRLINK COMMUNICATION PVT. LTD, Surat ║
║ ▸ Network troubleshooting & monitoring ║
║ ▸ Network configuration & documentation ║
║ ║
║ [2022-06 → 2022-07] NETWORK ENGINEER INTERN ║
║ NIVA TECHNO TRANSITION, Surat ║
║ ▸ Network infrastructure & structured cabling ║
║ ▸ Documentation, reporting & customer support ║
║ ║
╚════════════════════════════════════════════════════════════════════════╝
🔴 [CLASSIFIED] Consolidated Pentesting & RCE Assessment
Conducted end-to-end penetration testing across Redis, Openfire, and Gitea environments. Achieved system-level access via Redis replication abuse, Openfire admin console exploitation, and Git Hooks weaponization. CVSS scores up to 10.0 Critical.
Nmap · Metasploit · Redis Exploit · Git Hooks · Reverse Shells · CVSS
🔵 [CLASSIFIED] Digital Forensic Strategy · Missing Person Investigation
Designed an ISO-aligned forensic investigation plan covering corporate systems, mobile devices, IoT, cloud platforms & CCTV. Applied ISO 27037/27035/27042/27043/17025 with full UK GDPR, NPCC & FSR compliance and chain-of-custody management.
FTK Imager · Magnet AXIOM · Magnet DVR Examiner · MOBILeadit · Autopsy · Passware Kit
🟡 [CLASSIFIED] Strategic Security Audit · Cyberzone AI Ltd.
Led ISO/IEC 27001:2023 audit of AI-driven healthcare & fintech systems. Identified identity gaps, patching weaknesses & source code exposure. Evaluated compliance with UK GDPR, Data Protection Act 2018, and US HIPAA. Proposed FIDO2 MFA, immutable backups, automated patching & Purple Team exercises. Delivered full risk-scored audit report + phased mitigation roadmap.
🟣 [CLASSIFIED] AI & Autonomous Pentesting Frameworks · Research
Systematic literature review evaluating Deep Reinforcement Learning & LLMs for autonomous offensive cybersecurity. Synthesized quantitative performance metrics assessing architectural evolution from single-agent LLMs to collaborative Multi-Agent Systems (MAS). Identified the "Sim2Real" transfer gap, algorithmic hallucination risks and dual-use ethical concerns. Formulated a Neuro-Symbolic AI + HITL architecture for EU AI Act & GDPR compliance.
DRL · LLMs · Multi-Agent Systems · Neuro-Symbolic AI · EU AI Act · GDPR
🟢 [CLASSIFIED] IT Project Management: Autonomous AI-Driven Pentesting
Orchestrated a 7-week Hybrid Agile-PRINCE2 project for an autonomous AI cybersecurity system using Monday.com as the Work OS. Managed a 5-phase WBS, sprint execution, capacity planning & automated approvals. Led EU AI Act compliance deliverables under crisis resource reallocation with HITL + Neuro-Symbolic safety guardrails.
Monday.com · Agile-PRINCE2 · WBS · Risk Management · Regulatory Compliance
╔════════════════════════════════════════════════════════════════════════╗
║ ║
║ 🥇 1ST PLACE — CYBER SECURITY SOCIETY HACKATHON ║
║ Birmingham City University · STEAMhouse, UK ║
║ ║
║ PROJECT : Aegis-IAM Dashboard ║
║ Privilege Escalation & Risk Analysis Platform ║
║ ║
║ ▸ Rapidly prototyped a working MVP of an enterprise-grade IAM ║
║ risk analysis platform under strict time constraints. ║
║ ▸ Engineered a graph-based detection engine to model access ║
║ relationships, automating discovery of complex privilege ║
║ escalation chains and "toxic" role combinations. ║
║ ▸ Developed a real-time risk dashboard mapping over-privileged ║
║ cloud identities to MITRE ATT&CK, with automated remediation ║
║ playbooks and actionable posture scoring. ║
║ ║
╚════════════════════════════════════════════════════════════════════════╝
╔════════════════════════════════════════════════════════════════════════╗
║ ║
║ 🏅 TOP 5 FINALIST — UNIHACK 2026 ║
║ Birmingham City University, UK ║
║ ║
║ PROJECT : AquaSense AI ║
║ Proactive Wastewater Compliance & ║
║ Cryptographic Auditing Platform ║
║ ║
║ ▸ Co-authored a proactive environmental compliance ║
║ platform shifting from manual, reactive testing to ║
║ an autonomous, predictive compliance model. ║
║ ▸ Edge-inference layer with four stacked analytics ║
║ models (linear-regression, Mahalanobis, Z-score, IQR) ║
║ predicting compliance breaches at 96.2% precision. ║
║ ▸ Zero-dependency security: OWASP Top 10 mitigated via ║
║ WebSockets, HMAC-SHA256 response-signing, and dual ║
║ SHA-256 hash-chained logs. ║
║ ║
╚════════════════════════════════════════════════════════════════════════╝
╔════════════════════════════════════════════════════════════════════════╗
║ ║
║ 🥈 RUNNER-UP — BCU AI HACKATHON 2026 ║
║ AI @ BCU Day, Birmingham City University, UK ║
║ ║
║ PROJECT : Retrieval-Augmented Question-Answering ║
║ & Fact-Verification Pipeline (RAG) ║
║ ║
║ ▸ Architected a localized RAG pipeline under a strict ║
║ 8B-parameter cap — 100% success (100/100 answered, ║
║ zero blanks) on a long-tail fact dataset. ║
║ ▸ Built data-extraction + ranking via MediaWiki API, ║
║ DuckDuckGo fallback, and a bge-reranker-v2-m3 cross- ║
║ encoder over ~130-word chunks; local Qwen2.5-7B on macOS. ║
║ ▸ Multi-layer verification: noun-coverage disambiguation, ║
║ option-shuffled self-consistency (5× @ T=0.7), and ║
║ contradiction checking to kill positional bias + hallucination. ║
║ ║
╚════════════════════════════════════════════════════════════════════════╝
| 🏢 Organisation | 🎯 Operation | 🔑 Skills Demonstrated |
|---|---|---|
| Deloitte | Cyber Job Simulation | Threat Analysis · Incident Reports · Mitigation |
| MasterCard | Cybersecurity Job Simulation | Payment Security · Fraud Detection · Risk Response |
| Commonwealth Bank | Intro to Cybersecurity | Risk Management · Access Control · Data Protection |
| Telstra | Cybersecurity Job Simulation | Network Security · Vulnerability Identification |
| Datacom | Cyber Security Operations | SOC · Log Analysis · Anomaly Detection |
| TATA | Cybersecurity Analyst Simulation | System Scanning · Vuln Prioritisation |
| AIG | Shields Up: Cybersecurity | Cyber Defence · Attack Scenarios · Safeguards |
| 🎓 Degree | 🏛️ Institution | 📅 | 📊 | 🔗 |
|---|---|---|---|---|
| MSc Cyber Security | Birmingham City University, UK | Exp. 2027 |
— | — |
| BE · Computer Science & Engineering | SN Patel Institute of Technology (GTU), India | 2024 |
7.86 CGPA |  |
| Diploma · Computer Engineering | N.G. Patel Polytechnic College (GTU), India | 2021 |
7.80 CGPA | |
| Class 10 · SSC (CBSE) | Kendriya Vidyalaya No.1, Surat | 2017 |
— | |
┌──(HEAVEN㉿kali-offensive)-[~/hobbies]
└─$ cat interests.txt
[+] CTF CHALLENGES ............... Ethical Hacking Research & Capture-the-Flag
[+] APPLE ECOSYSTEM ............... Hardware/Software Troubleshooting & Emerging Tech
[+] MOBILE SECURITY ............... iOS & Android Security Research
[+] CULINARY HACKS ............... Experimenting with Varied Cuisines & Cooking
#!/usr/bin/env python3
# CLASSIFICATION: TOP SECRET — CAREER INTELLIGENCE BRIEF
class NisargChasmawala_MissionPlan:
short_term_objectives = [
"Earn OSEP, CISSP — push elite certification stack further",
"Build AI-augmented security pipelines for enterprise defence",
"Deepen red team operations experience with real engagements",
]
mid_term_objectives = [
"Publish peer-reviewed research at intersection of AI + Cyber",
"Lead offensive security teams & mentor the next generation",
"Pioneer autonomous penetration testing methodologies",
]
long_term_objectives = [
"Become a globally recognised cybersecurity adviser",
"Lead development of next-generation security tools & frameworks",
"Shape international cyberspace policy & best practices",
]
ultimate_mission: str = """
Uncover every vulnerability. Secure every critical system.
Build a demonstrably safer digital world — for everyone.
"""
def execute(self) -> None:
while True:
hunt(); learn(); build(); secure(); repeat()
SELECT * FROM elite_security_engineers
WHERE alias = 'HEAVEN'
AND name = 'Nisarg Chasmawala'
AND certs IN ('CPENT','CEH_Master','CHFI','ISO_27001','ISO_27701','CEH_v13','CCST','CLLMSE','CLLMSP')
AND location = 'Birmingham, England, United Kingdom'
AND status = 'ACTIVE'
AND mission = 'MAKING_DIGITAL_WORLD_SAFER';
-- 1 row returned. Target identified. ☠
[ ALL SYSTEMS SECURED — CONNECTION TERMINATED — ☠ ]