Our Security Spotlight series is all about the people behind the scenes, and how they bring cyber security to life in practice. This month, we’re featuring Principal Consultant, Yunus Umsu.
I’m an offensive security professional and penetration tester. I’ve spent around nine years across IT, with more than eight years focused on penetration testing.
I currently lead and deliver security testing across web and mobile applications, internal and external network assessments, and broader offensive security engagements such as red and purple teaming, phishing exercises, wireless assessments, and social engineering where appropriate.
My day-to-day is a mix of hands-on testing, scoping and kick-off discussions with stakeholders, and producing clear reports that work for both technical teams and executive audiences; along with supporting remediation to meaningfully improve security posture.
I’ve always been curious about how systems really work, and security was the natural extension of that curiosity, understanding not only how technology is built, but how it can be misused, bypassed, or broken under real-world pressure. Early on, I was drawn to the adversarial mindset: thinking like an attacker to help organisations defend what matters.
My path into technical leadership came from doing the work consistently; running assessments end-to-end, learning from every engagement, and improving how outcomes are communicated and actioned. Over time, I moved beyond simply “finding issues” to helping clients and internal teams understand risk, prioritise fixes, and build practical security improvements into the way they deliver technology.
A few experiences shaped my approach in a lasting way:
When I started, many organisations were heavily focused on traditional application security, web apps, a smaller number of platforms, and clearer boundaries. Today, the landscape has shifted dramatically.
Organisations are now far more aware of advanced, persistent adversaries and attack chains that blend techniques - identity compromise, cloud misconfigurations, social engineering, and lateral movement. At the same time, modern environments have moved towards cloud and SaaS, and now increasingly AI-enabled platforms, which changes what “attack surface” even means.
I’ve adapted by staying hands-on and continuously learning, expanding depth in mobile and web testing, maintaining capability across internal/external assessments, and applying the same attacker mindset to cloud and modern delivery models. I also lean on a combination of manual testing and proven tooling where it adds value, such as Burp Suite, Nessus, and Netsparker, while keeping the focus on real, exploitable risk rather than tool output alone.
The most rewarding part is seeing the impact of the work, when an engagement results in tangible improvements: reduced risk, better engineering practices, stronger controls, and teams who feel more confident about what they’re shipping.
I’m particularly passionate about high-signal testing and real attacker simulation, work that goes beyond checklists and finds the issues that matter. That includes deep dives into mobile application security, complex web application logic, and realistic scenarios that combine technical vulnerabilities with human and process weaknesses (such as social engineering, where it’s in scope).
I also care a lot about raising the bar through continuous learning and disciplined methodology. I’m an active learner in the offensive security community, and I’ve pursued recognised training and certifications such as OSCP, CRTO and OWASP application security certification, alongside specialist training in red teaming.
My advice is simple and practical:
If you’re transitioning into cyber from another field, your prior experience is not wasted - whether it’s software engineering, IT operations, support, or networking. Security needs people who understand how organisations actually run.