Cody Zacharias

Owner and Security Consultant, Xen LLC

Security research, consulting and software products

• Performed penetration tests for clients under NDA, covering web applications and APIs, iOS apps and Solana smart contracts, both independently and in partnership with other security teams.
• Led contractors and delegated work on larger engagements.
• Assisted clients with incident response: patched vulnerabilities quickly after incidents, audited for related classes of issues, and helped identify threat actors and prepare reports for law enforcement.
• Mentored beginners in cybersecurity, from fundamentals to bug bounty hunting, and taught individuals operational security practices for protecting accounts and digital assets from common attacks.
• Built AI-assisted vulnerability analysis tooling, including for smart contract security.
• Built and shipped software products, including LaserSell.

Security Engineer, Hyperproof

Contract position

• Owned application security testing for the company's SaaS platform, deciding what to test and where to focus without direction.
• Performed daily manual penetration testing with Burp Suite and reviewed code and issue tracker activity to find vulnerabilities.
• Filed detailed bug reports and worked with engineers until findings were resolved.
• Reviewed external penetration test reports and acted as the point of contact for a third-party assessment, whose results were cross-checked against internal testing.
• Contributed to internal security documentation.

Owner, SupplyShark

Supply chain security tooling for GitHub organizations

• Built Python software that scans code hosted on GitHub for supply chain security issues.
• Used the tool to find vulnerabilities, reported through bug bounty programs to Coinbase, Snapchat, MetaMask and several crypto companies.
• Built a SaaS platform with Next.js and Supabase so users could run the tool against their own GitHub organization.
• Ran outbound outreach to validate demand, which taught me firsthand how hard security tooling is to sell.

Product Security Analyst, HackerOne

Vulnerability triage and validation for customer bug bounty programs

• Validated incoming vulnerability reports, scored severity with CVSS and wrote impact assessments that customer security teams used to prioritize fixes.
• Led triage for several live hacking events: served as the main point of contact for the customer, delegated work across the triage team and kept the team current on procedures throughout.
• Learned new customer programs ahead of the team, then trained other analysts on how to triage them.
• Built internal tools that streamlined triage for specific programs and contributed to a shared tool that saved the team time.
• Advised customer security engineers on remediation and kept communication between researchers and customers clear.
• Trained new hires and gave internal presentations.

Independent security researcher, Self-directed

• Focused on bug bounty hunting and exploit research, and built open-source security tools for penetration testers, including Twint and subjack.