Hello, my name is Ioannis Papadoulis
I'm a Senior Application Security Engineer Web & API Penetration Testing
About me
I'm Ioannis Papadoulis, Senior Application Security Engineer
I'm a Senior Application Security Engineer at SmartRecruiters (an SAP company). I break web apps, APIs, and AI systems, then help engineers fix them properly. Recognized by PortSwigger, the makers of Burp Suite, as a Burp Champion.
I do penetration testing with a production mindset, focused on the bugs that actually hurt: auth, access control, and business logic. I learned to build web apps and Go APIs before I learned to break them, so I do not stop at finding problems. I build the tooling that detects them at scale and automates what would otherwise be manual, expensive, or nonexistent. Bug bounty and threat modeling close the loop, from finding bugs to preventing the next ones.
At SmartRecruiters that extends to the software supply chain and CI/CD: package registries, build pipelines, and secrets in code. I build the automation that pulls code, dependency, and secret scanning into one place and gives every finding an owning team, and I act as security lead for several product groups, reviewing designs before they ship.
A growing part of my work is securing AI-powered features and LLM integrations: prompt injection, model misuse, insecure AI-generated code, and the new attack surface that ships when a company bolts a model onto production.
I hold CompTIA PenTest+, SecAI+, CSCP, CNVP, Security+, and Cloud+, with BSCP and OSCP next on the roadmap. Fluent in English, French, Spanish, Greek, and Polish. Outside of work: lifting, reading, and building tools I probably don't need.
Citizenship: EU
City: Kraków, Poland
Experience
Jul 2026 - Present
SmartRecruiters
Senior Application Security Engineer
- • Lead internal penetration testing of web applications, APIs, and microservices, and manage external pentest engagements end-to-end
- • Build and operate security automation: consolidated code, dependency, and secret scanning with per-team ownership and dashboards, plus reusable CI security workflows (GitHub Actions) rolled out across hundreds of repositories
- • Software supply chain and CI/CD security: assess package registries, build pipelines, and secrets handling, and drive hardening with platform teams
- • Assess security of AI-powered features and LLM integrations, targeting prompt injection, model misuse, and insecure AI-generated code, and prototype AI-assisted vulnerability triage
- • Security lead for multiple product groups: review outcomes, release gates, and risk decisions with engineering leads
- • Threat modeling, security design reviews, and architecture assessments for new and existing services
- • Own the vulnerability lifecycle from triage and prioritization through remediation tracking and verification, including remediation SLAs and risk acceptance backed by reachability analysis
- • Operate the bug bounty program: triage and validate external submissions, coordinate with researchers, and drive fixes with engineering
- • Manual and automated security testing across SAST, DAST, IAST, and SCA, routing findings through issue tracking
- • Assess exposure to newly disclosed vulnerabilities and coordinate the org-wide response, and support customer security assurance: questionnaires, pentest report reviews, and compliance assessments
Jan 2025 - Jun 2026
project44
Offensive AppSec Engineer
- • Ran internal application penetration testing end to end across web applications and APIs, from scoping through execution, reporting, and retest verification
- • Identified and validated vulnerabilities, prioritized by exploitability and business impact rather than scanner severity, and drove remediation with engineering teams
- • Assessed AI-powered features and LLM integrations for prompt injection, model misuse, and adversarial failure modes, before AI security was a defined function
- • Scoped and coordinated third-party penetration tests, managed vendor execution and deliverable quality, and tracked findings to closure
- • Operated SAST and DAST tooling, triaged results, separated true positives from noise, and tracked remediation to completion
- • Delivered threat modeling and security impact assessments for new features and RFCs, converting outcomes into concrete security requirements
- • Acted as primary application security contact across engineering teams and trained engineers on secure development
Mar 2024 - Jan 2025
project44
Sr IT Specialist
- • Investigated and resolved complex customer issues, including root cause analysis, and escalated suspected product defects to engineering with documented repro steps
Jul 2021 - Feb 2024
Karhoo
IT Specialist
- • First and second line technical support and incident management for Marketplace and Connect partners, covering a client portfolio valued at over €5M
- • Contributed to internal engineering projects on Go-based systems
2 yrs 6 mos
HCLTech
IT Specialist
Feb 2021 - Jun 2021Client project, GSK
- • Second line incident handling and escalation point for first-line support, including critical and high-severity incidents
Jul 2020 - Jan 2021
Senior IT Analyst
Client project, GSK
- • Owned backlog and floor support priorities, trained new joiners, and supported EMEA go-live readiness
Jan 2019 - Jun 2020
IT Analyst
Client projects, Servier and Procter and Gamble
- • Service desk support across Windows, Office 365, VPN, and connectivity, tracked in ServiceNow
Oct 2018 - Dec 2018 · 3 mos
IKEA
IT Analyst
- • Triaged and resolved incoming IT support cases within agreed SLAs
Recommendation
I had the pleasure of working closely with Ioannis Papadoulis at project44, where he made a significant impact on our application security program. Ioannis led internal penetration testing efforts across our applications and APIs, consistently identifying meaningful and practical remediation guidance that engineering teams could quickly act on. He has a strong offensive security mindset and a talent for identifying security concerns while maintaining a collaborative approach that helped teams improve rather than simply receive findings.
Beyond penetration testing, Ioannis was instrumental in building security into our engineering culture. He partnered extensively with development teams to help launch and grow our AppSec Champions program, creating strong security advocates throughout the organization. He also embraced emerging AI technologies to automate security workflows, develop internal tools, and streamline processes, increasing the effectiveness and scalability of our security program.
What impressed me most was Ioannis's combination of technical depth, initiative, and professionalism. He continuously looked for ways to improve our security posture, whether through hands-on testing, process innovation, or relationship building across engineering. Any organization looking for a penetration tester or application security professional would be fortunate to have him on their team, and I would gladly work with him again!
Skills
- Application Security
- Penetration Testing
- Web Application Penetration Testing
- API Security
- AI Security
- LLM Security
- Software Supply Chain Security
- CI/CD Security
- Security Automation
- DevSecOps
- Threat Modeling
- Burp Suite
- Bug Bounty
- Static & Dynamic Analysis (SAST/DAST/IAST)
- GitHub Advanced Security
- SSDLC
- Vulnerability Management
- Security Testing
- Vulnerability Assessment
- Penetration Test Reporting
- Vulnerability Scanning
- Active Directory Security
- Network Security
- OSINT
- Identity and Access Management (IAM)
- Risk Assessment
- Compliance and Governance
- Technical Writing
- Stakeholder Management
Certificates
Recognition
Burp Champion
Issued by PortSwigger, Jun 2026. Selected by PortSwigger, the makers of Burp Suite, for its Burp Champion Program.
Certifications
CompTIA Secure Cloud Professional - CSCP
CompTIA Secure Cloud Professional (CSCP) validates hands on skills in securing cloud environments, implementing identity, network, and data protection controls, and applying risk, compliance, and governance practices across real world cloud operations.
CompTIA Cloud+ ce
CompTIA Cloud+ validates hands on skills in deploying, securing, and troubleshooting cloud infrastructure, managing cloud operations and networking, and applying security and risk controls in real world hybrid and multi cloud environments.
CompTIA SecAI+
CompTIA SecAI+ validates hands on skills in securing AI systems, identifying AI specific threats, and applying governance and risk controls in real world environments.
CompTIA Network Vulnerability Assessment Professional - CNVP
CompTIA CNVP validates hands-on skills in network vulnerability assessment, analysis, and risk identification across real-world environments.
CompTIA PenTest+ ce
CompTIA PenTest+ validates hands-on penetration testing and vulnerability assessment skills in real-world environments.
InsightAppSec Certified Specialist
Certified in using InsightAppSec to perform and analyze dynamic application security scans
CompTIA Security+ ce
CompTIA Security+ is a global certification that validates the baseline skills necessary to perform core security functions and pursue an IT security career.
Courses
Application Security - The Complete Guide
Developing security in the Software Development Life Cycle (SDLC)
Modeling Threats: Strategies in Threat Modeling
Securing cybersecurity systems from design to deployment using modern threat modeling techniques
CS50's Introduction to Computer Science
CS50 (aka CS50x through edX), Harvard University's introduction to the intellectual enterprises of computer science and the art of programming.
Writing
I post regularly on LinkedIn: practical lessons from real testing, security news with context, a clear opinion, and occasional dry humor.
Hidden AI bot instructions in WhatsApp's help pages
Redact's researchers found 102 hidden blocks of bot instructions across 80 help pages. My take: it is information disclosure, and the raw response is where you look first. Over 150,000 impressions on LinkedIn.
OWASP Israel 2026, Tel Aviv
Notes from the talks I attended, from agentic AI threats to a root shell inside ChatGPT's sandbox.
Contact Me
Don't hesitate to reach out to me
Open to connecting on application security, offensive security, and AI/LLM security
Based in
Kraków, Poland