I'm Saiful Iqbal (Muhammad Saiful Iqbal Abdul Rani), a full-stack software engineer and cybersecurity developer from Johor, Malaysia. I founded Team ChendAwan Ventures, which delivers production systems for government and corporate clients, and I built VERITAS, a live web vulnerability assessment platform, as my final-year project.
01Selected work
Client platforms I've led, security tooling I've built, and coursework I'm proud of. Client work is marked private where screens and code can't be shared; ask me for a walkthrough of anything marked "demo on request".
Web vulnerability assessment platform · Final-year project · Solo
A multi-tenant workspace where customers prove they own a web application, run an active security assessment, and get findings backed by evidence, confidence levels and remediation guidance. Its rule: AI proposes, evidence validates, rules decide.
HR, attendance & payroll platform · HRSB Holdings Sdn Bhd · Lead developer & project manager
One Laravel platform with 15+ modules for a multi-company corporate group: staff records, biometric attendance, leave, claims, multi-level overtime approvals and a payroll engine that produces Malaysian statutory outputs (EPF, SOCSO, EIS, PCB, zakat).
Statewide STEM education platform · Johor State Education Department (JPNJ) · Lead architect & project manager
A centralised platform for STEM education programmes across Johor, designed for high-concurrency traffic and complex education datasets. I worked directly with government stakeholders, resolved ISP infrastructure bottlenecks to keep it available, and protected it with Cloudflare and SSL/TLS.
Crowdsourced road hazard reporting · Android app + web admin · Team of 4
Drivers report potholes, flooding and debris with photo and GPS, see hazards on a live map, and help confirm or resolve them. A hybrid risk score gives an instant on-device result, then a Cloud Function asks Gemini to review the report and photo in the background.
02Experience
Team ChendAwan Ventures · Johor, Malaysia · SSM 202603212164 (003878769-W)
A registered, student-led software business that designs, builds and delivers production web and mobile systems for government and corporate clients, including HRSB ONE and JohorSTEMHub.com.
Johor State Education Department (JPNJ) · Johor Bahru, Malaysia
03Capabilities
Every capability below points to a project, certification or competition you can check.
| Web application security (OWASP Top 10) | VERITAS, Veritas Payloads, Projek Dengkis |
|---|---|
| Vulnerability assessment | VERITAS scan engine and reporting |
| Authorised penetration testing | Projek Dengkis, CTF competitions, Kali Linux |
| Red team operations | CRTOM certification, CTF competitions |
| Threat intelligence | CTIGA certification |
| LLM security | CLLMSP, CLLMSE; keeping AI out of VERITAS's decision path |
| Authentication & access control | MFA, RBAC, JWT, OAuth in VERITAS and HRSB ONE |
| Data protection | Postgres row-level security, HMAC-signed requests, Cloudflare, SSL/TLS |
| Digital forensics basics | DengkisExiftools (ExifTool, Binwalk, Foremost) |
| Multi-module web platforms | HRSB ONE, VERITAS, JohorSTEMHub |
|---|---|
| Background jobs, queues & schedulers | Celery + Redis in VERITAS; queue workers and split schedulers in HRSB ONE |
| Statutory payroll & HR rules | EPF, SOCSO, EIS, PCB, zakat and Maybank M2E in HRSB ONE |
| Payments & integrations | Stripe, ToyyibPay, Maybank M2E, data.gov.my, WDMS biometric devices |
| Android development | RoadSense, BudiMadani |
| AI with guardrails | Gemini in RoadSense, Groq in VERITAS, server-side keys in SAJATECH |
| Containers & edge | Docker Compose, Nginx, Cloudflare, AWS S3 |
| Networking | VLAN & ACL design in SAJATECH; CCNA: Introduction to Networks |
| Automated testing | PHPUnit in HRSB ONE, pytest in VERITAS |
04Credentials
| Certification | Issuer | Date |
|---|---|---|
| Certified LLM Security Expert CLLMSE | Red Team Leaders | Nov 2026 |
| Certified LLM Security Professional CLLMSP | Red Team Leaders | Jun 2026 |
| Certified Threat Intelligence & Governance Analyst CTIGA | Red Team Leaders | Feb 2026 |
| Certified Red Team Operations Management CRTOM | Red Team Leaders | Feb 2026 |
| Certified C++ Practitioner CCPC | Red Team Leaders | Feb 2026 |
| Certified Cybersecurity Educator Professional CCEP | Red Team Leaders | Jan 2026 |
| CCNA: Introduction to Networks | Cisco Networking Academy | Aug 2025 |
| Introduction to Critical Infrastructure Protection ICIP | OPSWAT Academy | Aug 2025 |
| Ethical Hacker | Cisco Networking Academy | Jul 2025 |
| Web Server Management | Tenang Komuniti | Jun 2024 |
05About
I started building software for real users early, and that shaped how I work. When a client depends on a system for payroll, attendance or a statewide portal, it has to stay available, protect people's data and do exactly what it promises.
Through Team ChendAwan Ventures, I take projects from first conversation to production: gathering requirements, designing the architecture, building the system, deploying it and supporting the client after handover. Along the way I've worked with Malaysian statutory payroll rules, biometric attendance devices, multi-level approval workflows, payment gateways and government stakeholders.
On the security side, I compete in capture-the-flag events, hold certifications in red team operations, threat intelligence and LLM security, and built VERITAS to understand application security from the inside: how inputs are reached, how findings are proven, and how results should be reported so developers can act on them.
I learn quickly, enjoy practical problems and like working closely with the people who will use what I build.
Read my full profile: background, education and how to work with me
Payroll, attendance and approval rules are where systems usually go wrong, so I learn the business process before writing code.
Scope control, least privilege and auditability go into the architecture, not a later patch.
In VERITAS the rule is "AI proposes, evidence validates, rules decide." I apply the same thinking to any system that makes important decisions.
Long-running jobs go to queues, external services can fail, and the system should keep working when they do.
Clients should be able to run, maintain and understand what they've been given.
As lead editor, I was responsible for consistent content, accurate topics and quality of delivery. Published by the Johor State Education Department and used by schools across Johor.
View sample
As lead editor, I made sure Form 5 Mathematics topics were presented clearly and consistently. Published by the Johor State Education Department as a reference for students across the state.
View sample06Contact
I want to build or secure real systems alongside experienced engineers, as a Security Software Engineer, Embedded Systems Engineer, Information Security Analyst, Cybersecurity Consultant or Solutions Architect. I'm based in Johor and open to on-site, hybrid or remote work anywhere in Malaysia, as well as international opportunities.
