kokn3t

Ko Ko Naing (Ko 9)

Offensive Security Engineer / Penetration Tester

Read my journey Get in touch
7+years in security
10certifications
4companies
2countries

About

I'm a Senior Offensive Security Engineer at Ascend Money. I lead penetration testing across web, API, mobile, infrastructure and cloud, and I care most about application security.

My career has taken me from Myanmar's banks to a new country and a very different working culture. Each move meant learning something I hadn't done before. I like that part: find the gap, learn it, prove it, then share it with the team.

Outside work you'll usually find me doing weight training at the gym.

Learning journey

Every role taught me something I didn't know on day one: new skills, a new culture and new ways of working.

  1. 2014 – 2019Magway, Myanmar

    Capture the Flag

    University of Computer Studies, Magway · B.C.Sc.

    It started with CTF challenges. I didn't know anything about penetration testing, so I solved one flag at a time and got hooked on how systems break.

    LearnedHacker mindset · Linux · Web fundamentals
  2. Nov 2019 – Nov 2021Yangon, Myanmar

    AYA Bank · Innovation Labs

    Security Analyst

    My first security role. I learned web application and API pentesting hands-on against real banking systems, and also handled log monitoring in ELK, incident analysis and vendor management.

    LearnedWeb app & API pentest · ELK · Incident response
    eCPPTv2eWPTXv2OSCP
  3. Dec 2021 – Aug 2022Yangon, Myanmar

    Yoma Bank

    Application Security Engineer

    I went past the application layer into infrastructure pentesting and DevSecOps: secure design, code scanning, and recommendations that made sense to both engineers and the business.

    LearnedInfrastructure pentest · DevSecOps · Secure design
  4. Sep 2022 – Apr 2023Nonthaburi, Thailand

    SECUREiNFO

    Cyber Security Specialist

    A new country, a new language and a very different working environment. I took care of vulnerability assessment, SAST/SCA/DAST scanning, and customer support and consulting.

    Adapting to a new culture turned out to be as important as any technical skill.
    LearnedAdaptability · VA scanning · SAST/SCA/DAST · Customer support
  5. May 2023 – PresentBangkok, Thailand

    Ascend Money

    Senior Offensive Security Engineer

    I became a pentest lead. I took ownership of pentest projects and started creating the project-management documents and deliverables myself. Then I kept going into areas I hadn't explored deeply before.

    ★ The best chapter so far
    1. 01

      Leading pentest projects

      Scoping, planning, deliverables and reporting, working with international teams.

    2. 02

      Mobile client-side security

      New ground for me. I learned it, spoke at BSides Myanmar 2024, then got certified.

    3. 03

      Active Directory & WiFi

      AD attack paths and wireless security, both backed by certifications.

    4. 04

      AI & AWS Cloud

      I built custom tools and scripts for the team with agentic AI coding, drawing on my own field experience.

    LearnedCREST CRTCPSACRTPOSWPINE MobileAWS AIAWS CCP

Peak projects

Custom tools I designed and built for authorized security testing.

  1. Mobile & Biometrics · 2025

    AWS Rekognition Liveness Bypass & Custom Injection Tool

    Research into how robust face liveness checks built on AWS Rekognition are, with a custom tool I built for the assessment.

    AWSFaceLivenessMobile
  2. Mobile & Biometrics · 2026

    Jumio Liveness Detection Bypass & Custom Injection Tool

    The same research approach applied to Jumio identity verification, again with purpose-built tooling.

    JumioeKYCMobile
  3. AI & Automation

    AI-Powered ASM

    Attack surface management powered by agentic AI. It discovers, maps and prioritises external assets and exposures so the team spends less time on manual recon.

    AgenticAIAttackSurfaceAutomation

Conference talk

BSides Myanmar · 15 Dec 2024

Vulnerability Research on Face Recognition Android SDKs

How face recognition SDKs on Android behave under the hood, where their weaknesses lie, and a structured way to test and secure them in real apps.

Watch on YouTube ↗

Experience

  1. May 2023 – Present · Bangkok

    Senior Offensive Security Engineer

    Ascend Money
    • Collaborate with international teams and manage pentest projects
    • Application security engineering and consulting
    • Pentest web, mobile apps, APIs and networks, aligned with a standard pentest framework
    • Present findings in high-level and low-level slide decks
    • Prepare recommendations with engineering and business teams
    • Improve team processes, solve problems and run vulnerability assessments
  2. Sep 2022 – Apr 2023 · Nonthaburi

    Cyber Security Specialist

    SECUREiNFO
    • VA scanning
    • Source code scanning (SCA, SAST) and automated application scanning (DAST)
    • Review security assessment tools and solve problems with them
    • Security consulting
  3. Dec 2021 – Aug 2022 · Yangon

    Application Security Engineer

    Yoma Bank
    • Implement secure applications and secure design
    • Web, mobile, API and infrastructure pentesting and reporting
    • Security code scanning with tools
    • Recommendations from both technical and business points of view
  4. Nov 2019 – Nov 2021 · Yangon

    Security Analyst

    AYA Bank · Innovation Labs
    • Web, mobile, API and infrastructure pentesting and reporting
    • Monitoring logs and traffic in ELK
    • Analysis, response and reporting
    • Mitigations, recommendations and vendor management

Certifications