I’m Marco Bianchi, a cybersecurity consultant originally from Rome and now based in the United Kingdom. I focus on in-depth, manual security testing of web applications, APIs, and mobile platforms. My role is to identify vulnerabilities that matter and support engineering teams in fixing them without disrupting their workflow.

I started my career as a backend developer. I’ve worked with production systems built in Python, Node.js, and TypeScript. I’ve been on release calls, written urgent patch scripts, and reviewed rushed code. That background shaped how I work today. I understand where security issues emerge and how to address them without friction.

Since 2016, I’ve worked with clients across Europe including fintech platforms, health data services, and SaaS providers. My approach is deeply manual and tailored to each target. I focus on authentication, access control, session handling, insecure design, and business logic flaws. I don’t rely on automated tools unless they save time — I test based on how your app works, not just what it’s built with.

Recent examples of my work:

• Security review of a GraphQL-based SaaS platform used by over 500 organisations. I discovered a logic flaw that allowed cross-tenant access to billing records. Delivered exact payloads and supported the team in fixing the resolver-level logic.
• Mobile pentest for a European finance startup. Reverse-engineered a React Native app, identified token leakage and session reuse. Helped the team build a more secure session manager before a compliance audit.
• Threat modelling and architecture review for a healthtech platform preparing for ISO 27001. Focused on IAM, user onboarding risks, and third-party exposure. Worked with their dev lead to implement risk controls with minimal code changes.

I regularly use Burp Suite Pro, Postman, Frida, MobSF, mitmproxy, ZAP, and custom Python scripts. I’ve integrated into CI workflows, written test documentation for engineers, and contributed to hardening sprints before product launches.

I hold the OSCP, OSWE, and AWS Security Specialty certifications. I’ve reported critical bugs to EU SaaS companies, worked under NDAs with regulated platforms, and helped startups prepare for investor due diligence and security reviews.

Clients say I work quietly, move fast, and communicate clearly. I don’t oversell. I don’t deliver noise. I focus on issues that matter, and I stay involved until they’re resolved. If your product is growing and security matters to you, I’d be happy to help you level up before the pressure hits.