CLASSIFIED // CLEARANCE: HEAD OF CYBER · RED TEAM

Dickson Godwin Massawe

Head of Cybersecurity• Security Researcher• Red Team Operator• Web App Pentester

Head of Cybersecurity at Owntechs Company Limited; offensive security engineer with active responsible disclosure research across open-source projects. Operating across red team adversary simulation, SOC triage, web application penetration testing, and security architecture. Dar es Salaam, Tanzania.

VAPT APT Simulation MITRE ATT&CK SIEM (QRadar) OWASP Top 10 AD Red Team Security Research
// Location
Dar es Salaam, TZ
// Email
// LinkedIn

Capability Matrix

// 6 active capabilities
Web Pentest
SQLi, XSS, CSRF, SSRF, OWASP Top 10, API security.
Red Team / APT
Adversary simulation, lateral movement, C2, persistence.
SOC L1–L3
SIEM triage, correlation rules, threat hunting on QRadar.
Threat Intel
IOC analysis, attribution, MITRE ATT&CK mapping.
Offensive Tooling
Python/Bash/PS automation, C2 agents, fuzzing frameworks.
Security Research
OSS vulnerability discovery, coordinated disclosure, GitHub Security Advisories.

Mission Log

// current & previous engagements
ACTIVE MAR 2025 — PRESENT @ Owntechs Company Limited

Head of Cybersecurity

  • Defining and executing the organization's cybersecurity strategy, policy framework, and risk management posture.
  • Leading vulnerability assessment and penetration testing programmes across web, network, and cloud infrastructure.
  • Directing incident response operations: triage, containment, root-cause analysis, and post-incident review.
  • Designing security architecture and overseeing security controls for new and existing systems.
  • Integrating security practices into the SDLC; conducting developer security awareness training.
  • Producing executive-level risk reports and threat intelligence briefings for senior stakeholders.
ARCHIVED NOV 2023 — MAR 2024 @ CyberGen

Web Penetration Tester · Red Team

  • OWASP-methodology web application penetration testing.
  • Custom scripts & tooling for automated scanning, verification & reporting.
  • Red team exercises simulating APT behavior to validate incident response.
ARCHIVED JUN 2022 — JUL 2023 @ TIRDO

Network Security Specialist

  • Sophos XG firewall deployment & hardening; VPN configuration.
  • Network monitoring, traffic analysis, and security-controls documentation.
ARCHIVED JAN 2020 — JUL 2021 @ Owntechsict

Software Developer

  • Systems programming, requirements analysis & delivery for client platforms.
  • Coordinated system installations and end-user training.

Hall of Fame

// captures & wins
1ST PLACE

CtfZone Marathon

CtfZone · 2026
1ST PLACE

Unique Academy CTF

Unique Academy · 2026
1ST RUNNER UP

Cyber Sanifu League (CPL)

Sanifu Org · 2026
HALL OF FAME

HackTheBox — Tanzania

HTB · 2024
1ST CLASS HONORS

Academic Excellence

Unique Academy · 2024
RED TEAM PROLABS

Dante · RastaLab · Cybernetics

HackTheBox ProLabs
SPECIAL THANKS

Snipe IT — Security Researcher Recognition

ACKNOWLEDGEMENT

Kamra PMS — Security Researcher Acknowledgement

Responsible Disclosure

// coordinated vulnerability disclosure — open-source projects
GHSA-6cr2-jm8f-6jrx Kamra PMS
Cross-property authorization flaw in staff endpoints exposing another property's reservations, folios, guests, and ID documents. Fixed in v2.6.5.
GHSA-mqf7-4vg4-fxj7 · CVSS 8.1 Librarr
Reverse-proxy SSO identity headers trusted from untrusted clients, allowing authentication as any user including administrators. Fixed by restricting trusted headers to configured proxies.
GHSA-wj92-jhwh-85j5 Ride The Lightning (RTL)
Unauthenticated circular rebalance operation affecting Eclair nodes; project added authorization guards for state-changing routes. Fixed in v0.15.12-beta.
GHSA-w6m3-j4cx-8m67 Borg Backup Server
Privately reported security vulnerability addressed in v2.94.1; independently identified by another researcher, credited in the release notes.
REPORTER CREDIT ProjectSend
Microsoft sign-in flow did not sufficiently verify ownership of the presented email address. Fixed in v2.4.1.
REPORTER CREDIT e107 CMS
Member could modify arbitrary columns on their own user record, including admin fields, enabling unauthorized administrative access. Credited in v2.3.12 alongside another researcher.
REPORTER CREDIT Transmute
Publicly credited among a group of researchers for responsible disclosure. Credited in v2.1.0 alongside multiple contributing researchers.

Credentials

// certifications & training

CEH — Certified Ethical Hacker

EC-Council · 2025

CPTS — Certified Penetration Testing Specialist

HackTheBox · 2026

eJPTv2 — Junior Penetration Tester

INE · 2025

AD Red Team Specialist (AD-RTS)

CyberWarfare Labs · 2025

Web Red Team Analyst (WEB-RTA)

CyberWarfare Labs · 2025

Multi-Cloud Blue Team Analyst (MCBTA)

CyberWarfare Labs · 2025

Certified Threat Intelligence Analyst

arcX · 2024

Ethical Hacking Essentials (EHE)

EC-Council · 2023
// EDUCATION

Academic Track

  • BSc Information Security — Unique Academy (2024–2026)
  • Diploma in Information Technology — Unique Academy (2021–2023)
  • Diploma in Ethical Hacking — Alison, Greenwich IE (2024–2025)
// ADDITIONAL TRAINING

Lab / Platform Certs

  • TryHackMe — CompTIA Pentest+, Red Teaming, Jr Penetration Tester
  • HackTheBox ProLabs — Dante, RastaLab, Cybernetics
  • APISEC University — API Penetration Testing
  • CISCO Networking Academy — Intro to Cybersecurity, Ethical Hacking
OPERATOR: DGM-707 │ STATUS: ACTIVE │ LOC: DAR_ES_SALAAM
NET: SECURE v4.7