Curt Hems Email & Phone Number

United Kingdom

My role entails emulating sophisticated threat actors to assess and enhance the security posture of our clients. I lead comprehensive red team operations, utilising both off-the-shelf and custom-developed tools to infiltrate and exploit vulnerabilities within white and black box applications. My efforts have directly contributed to identifying critical security weaknesses and improving the overall resilience of client environments against real-world threats. Additionally, I collaborate closely with other departments to provide actionable insights, helping organisations bolster their defenses against potential attacks.Key Technical Skills:- Advanced knowledge of penetration testing methodologies and frameworks (e.g., Cyber Kill Chain and Mitre Att&ck) - Proficient in utilising a variety of offensive security tools such as Metasploit, Zed Attack Proxy, Burp Suite, and custom scripts.- Expertise in social engineering tactics and physical security assessments.- Strong capability in web app exploitation, privilege escalation, and post-exploitation techniques.- Skilled in creating and deploying advanced evasion techniques to bypass detection systems.As part of my role at ThreatSpike, I also craft compelling content rooted in real-world scenarios and actionable threat detection and response strategies. Through the creation of writeups, whitepapers, and videos, I aim to demonstrate ThreatSpike's proficiency in mitigating cybersecurity threats and effectively communicating our solutions to the broader audience.

United Kingdom

I lead penetration testing engagements encompassing diverse attack surfaces, including web applications and APIs, resulting in the identification and remediation of critical security vulnerabilities. I have developed custom exploit payloads, tools, scripts, and proof-of-concept code to validate and demonstrate the impact of identified vulnerabilities, facilitating informed decision-making and targeted remediation efforts. My understanding of attack models leads to collaboration with cross-functional teams including developers, system administrators, and security analysts to prioritise and address security vulnerabilities.Achievements and responsibilities: Identified and mitigated CSRF vulnerabilities in web applications, preventing unauthorised actions on behalf of authenticated users.Detected and addressed XSS vulnerabilities, preventing execution of arbitrary code within user sessions and safeguarding sensitive data.Uncovered and remediated critical business logic flaws, preventing account takeover, unauthorised data access, and transaction manipulation.Mitigated IDOR vulnerabilities, ensuring proper authorisation and preventing unauthorised access to sensitive resources.Addressed injection vulnerabilities, securing databases and systems against unauthorised access and arbitrary command execution.Identified and resolved security misconfigurations, minimising the attack surface and enhancing overall security posture.Detected and mitigated instances of sensitive data exposure, protecting sensitive information from unauthorised disclosure and exploitation.

Essex, England, United Kingdom

Dynamic digital expert with a robust background as a Senior Digital Executive who built and managed a team, offering a unique blend of strategic thinking and technical proficiency around high level online marketing and security. Demonstrated success in leveraging web skills to enhance secure online marketing channels. Proven ability to analyse and optimise digital environments, translating search engine algorithm insights into effective security measures. Adept at threat intelligence, incident response, and implementing robust security protocols with web asset creation. Experienced in creating unique marketing solutions that ensure a secure framework using JavaScript.Achievements and responsibilities: Applied skills in analysing website performance and user behavior to monitor and detect anomalies in network traffic patterns.Leveraged SEO practices for keyword research, translating into effective threat intelligence strategies to proactively identify potential security threats.Applied link-building strategies to strengthen network architecture, emphasising secure connections and access control.Transferred content optimisation skills to enhance security awareness training, fostering a more informed and secure user base.Adapted to algorithm updates in SEO, demonstrating proficiency in timely patch management to address software vulnerabilities.Applied competitive analysis skills from SEO to identify and mitigate potential cyber threats through effective threat modeling.Balanced security protocols with a positive user experience, ensuring seamless implementation of security measures without compromising usability.Managed data privacy concerns and compliance with regulations (e.g., GDPR) in SEO, translating into a commitment to safeguarding sensitive data in cybersecurity roles.Developed unique solutions for marketing, creating web assets with a secure framework using JavaScript to ensure a resilient online presence.

Essex, England, United Kingdom

A private portfolio of web applications that are maintained and managed to ensure intrusion prevention and vulnerability protection renders all applications to be secure. Implementing scheduled malware scans, backups, and extra layers of security allowed studies of network traffic and usage to duplicate turnkey sites for growth and consistent uptime management through SIEM tools.Achievements and responsibilities: Managed digital assets with a primary focus on cybersecurity measures. Implemented and maintained robust strategies to prevent vulnerabilities, including scheduled malware scans, backups, and additional layers of security. Ensured the duplication of turnkey websites for scalable growth while maintaining a proactive defense against potential threats.Developed a comprehensive training platform to instruct new team members on precise standard operating procedures. This initiative significantly reduced the likelihood of errors, enhancing overall operational efficiency and preventing revenue impact resulting from negligence or security breaches.Spearheaded the cleanup of compromised websites on search engines, successfully removing harmful indexed pages from SERPs. This proactive approach not only mitigated potential security threats but also ensured effective resolution of Google Search Console issues.Generated additional cash flow for the business by strategically buying, selling, and auditing expired domains and breached web applications. These efforts were executed in tandem with main projects, contributing to increased financial stability and profitability.

Essex

Key Achievements and Responsibilities:Directed and orchestrated a dynamic team comprising designers, SEO specialists, and developers to conceive and execute high-performing digital campaigns. Specialised in crafting simple, intuitive websites with a strong emphasis on Cyber Security, UX, CRO, and SEO, consistently surpassing client campaign expectations.Strategically planned website concepts, contributing to the agency's impressive sales closing rate of 80%. Ensured that digital campaigns aligned seamlessly with client objectives while maintaining a keen focus on cyber security.Collaborated with SMEs to identify pressure points in their business and digital security. Applied core tactics to provide secure web assets integral to business operations, enhancing overall resilience to cyber threats.Successfully managed a portfolio of 75+ existing clients, concurrently serving as the account manager for 15 larger clients. Maintained strong client relationships while implementing robust cyber security measures to safeguard their digital assets.

Essex, England, United Kingdom

Key Achievements and Responsibilities:Designed and developed software using stack-based programming languages, Breeze Software, and AutoHotKey scripts. Prioritised design, performance, and usability in crafting equipment GUI to enhance overall user experience.Implemented Hardware Security Modules to prevent poor cryptographic key handling and ensured the prevention of software distribution of cryptographic keys for the company's rental equipment. Applied robust security measures to protect sensitive information.Undertook daily desktop engineer duties, troubleshooting desktops, hardware, software, and end-user-related issues. Successfully set up new desktops, laptops, and peripherals as part of upgrades or replacements, maintaining a focus on cyber security.Integrated secure measures to prevent GDPR breaches, particularly in managing and protecting photography and customer personal information.Orchestrated entertainment for high-profile events, including the Royal Variety Performance after-party entertainment, Universal Music, Island Records, and Ogilvy & Mather.Managed an office team of 6 staff and a pool of 19 event team members through CRM systems that were implemented company-wide. Implemented and maintained cyber security protocols to safeguard sensitive data and streamline operations.