×
Alexander Bason

Alexander Bason

Red Team Operator

New York, New York, US, NY 10022
(530) 675-4199

Background


About

About

Highly skilled Red Team Operator and Security Researcher with demonstrated
expertise in advanced persistent threat emulation and critical
vulnerability discovery, backed by close to 20 years of software
engineering experience. Track record of discovering multiple high-impact
CVEs and successfully compromising complex enterprise environments through
custom exploit development, Active Directory attacks, and cloud
infrastructure exploitation. Proven ability to develop offensive tooling,
automate attack frameworks, and deliver technical mentorship to engineering
teams. Combines deep technical knowledge in both offensive security and
software development to identify and exploit vulnerabilities that evade
traditional security controls, while effectively communicating findings and
empowering teams to implement robust security practices.

Work Experience

Work Experience

  • Red Team OperatorBloomberg L.P.

    Sep, 2022 - Present

    As an internal red team operator, I conducted covert and overt adversary
    emulation to identify security risks, report them and work with security
    and engineering groups to remediate the vulnerabilities and improve
    overal security posture of the company.

    • Conducted comprehensive red team engagements, simulating advanced persistent threats (APTs) to assess and improve Bloomberg's infrastructure and application security posture.

    • Achieved critical impact in assessments by exploiting deserialization vulnerabilities, misconfigurations, command injection vulnerabilities, etc., leading to full compromise of high-value assets and network pivoting across isolated segments.

    • Successfully compromised AWS EKS clusters through misconfigured IAM policies, demonstrating advanced cloud security penetration testing skills and improving cloud security practices.

    • Developed custom offensive tooling, including ICMP and RDP proxies, to navigate restrictive network environments and enhance lateral movement capabilities during assessments.

    • Executed advanced Active Directory attacks including Kerberoasting and AD Certificate Services exploitation, achieving domain-level compromise in complex environments.

    • Performed vulnerability research on third-party software and critical infrastructure, discovering high-impact vulnerabilities in email security systems, authentication mechanisms, and proxy services.

    • Led successful phishing and MitM campaigns.

    • Researched, developed, and integrated automation tools to streamline Red Team operations, significantly improving assessment efficiency and reporting processes.

    • Presented technical findings to engineering audiences of over 100, enhancing security awareness and promoting best practices across the organization.

    • Led the initiative to adopt secret detection tools across product teams, strengthening secret management practices and overall security posture.

    • Collaborated with TVM and CSOC teams to address security incidents and implement remediation strategies for identified vulnerabilities.

    • Implemented proof-of-concepts and scanners for critical vulnerabilities in open-source libraries, collaborated with security and engineering teams to promptly remediate the issues.

  • Penetration TesterBloomberg L.P.

    May, 2021 - Sep, 20221 year 4 months

    • Transitioned from an engineering role, quickly adapting to security testing methodologies and demonstrating a keen eye for identifying vulnerabilities.

    • Performed security reviews of internal systems and third-party applications, uncovering critical vulnerabilities.

    • Utilized both black-box and white-box testing techniques, demonstrating proficiency in a variety of assessment methodologies.

    • Developed tools and scripts to automate tasks and gather information.

    • Built tools and set up infrastructure to improve security review efficiency.

    • Shared knowledge of security tools and techniques with teammates, improving team efficiency.

    • Conducted black-box penetration testing of third-party products, quickly identifying a critical pre-authentication vulnerability overlooked in prior assessments, highlighting the need for deeper pre-auth security analysis.

  • Big Data EngineerBloomberg L.P.

    Oct, 2016 - May, 20214 years 6 months

    • Pioneered the use of Spark's Structured Streaming within the company, sharing expertise through internal meetups.

    • Led the evaluation and deployment of a Delta Lake-based backend for a distributed tracing system, improving scalability and adding advanced features.

    • Designed and implemented a watchdog service for 24/7 monitoring of Spark Streaming jobs.

    • Developed an async Python HBase client library and standardized the Continuous Integration pipeline.

    • Onboarded and mentored new team members, significantly improving team efficiency.

  • Penetration Tester, An IoT Company

    May, 2020 - May, 20211 year

    • Conducted black-box penetration testing on web and mobile applications, identifying and reporting critical vulnerabilities, coordinating with development teams to implement effective mitigations for identified issues.

    • Performed in-depth reverse engineering of IoT device firmware and proprietary UDP-based protocols, uncovering attack vectors and enabling the development of security measures against potential exploits.

    • Captured and analyzed Bluetooth traffic to evaluate wireless communication security, discovering and mitigating vulnerabilities in device connectivity.

    • Led monthly security education sessions for employees on diverse information security topics, improving security awareness across the organization.

    • Developed a strategy for a bug bounty program to streamline vulnerability reporting and remediation, enhancing the organization's proactive security measures.

  • Data Scientist/Data EngineerCredit Suisse

    Apr, 2015 - Oct, 20161 year 6 months

    • Developed forecasting models for time-series data and led the creation of an HBase-based graph database.

    • Implemented entity resolution algorithms using Apache Spark GraphX and developed streaming graph visualization web apps.

    • Created R and Python packages to assist data analysts and deployed external data acquisition pipelines.

  • Manager, Decision AnalyticsEXL Service

    Jul, 2014 - Apr, 20158 months

    • Developed complex analytic applications for Return on Advertising Spend using advanced data analytics tools, R, and Tableau.

    • Implemented a report generation framework and performed text-mining on insurance claims data.

  • Advanced Analytics ConsultantTeradata

    Jul, 2011 - Jul, 20143 years

    • Served as a technical presales consultant for Teradata data analytics solutions.

    • Implemented Proof-of-Concept solutions for various customers, including market basket analysis and text mining for credit scoring.

    • Revived and updated Teradata's in-database analytical solution (teradataR).

  • Senior System AnalystAccenture

    Feb, 2007 - Jun, 20114 years 4 months

    • Led a team of five developers in implementing a new banking system for Intesa Sanpaolo, Russia.

    • Optimized system performance through query optimization and database tuning.

    • Designed frameworks to integrate the banking system with WebSphere MQ, improving code base unification.

  • ProgrammerRosbank (Societe Generale Group)

    Nov, 2005 - Jan, 20071 year 2 months

    • Developed C applications for the Mysis Equation core banking system.

Projects Experience

Projects Experience

  • Vulnerability Research

    - Present

    • Identified a dependency on a vulnerable library (CVE-2022-41912) within Grafana, demonstrated an authentication bypass within the product. Reported the finding to the vendor, enabling a critical security update.

    • Identified and reported critical authentication bypass vulnerability in Pomerium access proxy (CVE-2023-33189).

    • Escalated Squid proxy DoS (Denial of Service) vulnerability (CVE-2023-46847) to RCE (Remote Code Execution) during the red team engagement. Contributed to the fix of the vulnerability.

Skills

Skills

  • Offensive Security

    Network Penetration Testing

    Active Directory Exploitation

    Cloud Security Assessment (AWS)

    Web Application Security

    Custom Exploit Development

    Red Team Operations

    Social Engineering

  • Security Tools

    Burp Suite

    PowerShell Empire

    Bloodhound

    Responder

    Nmap

    Wireshark

  • Programming Languages

    Python

    Go

    PowerShell

    Scala

    SQL

    C/C++

  • Infrastructure & Cloud

    AWS

    Docker

    Kubernetes

    CI/CD

  • Data Engineering

    Apache Spark

    Hadoop

    HBase

    Kafka

    Delta Lake

    MongoDB

    Neo4j

Education

Education

  • Electronic Systems, Master of Science, Moscow Power Engineering Institute

    Sep, 2000 - Jun, 2006