$ whoami
Lena Marsh
Offensive Security Engineer
I break things so they do not break later.
Offensive security engineer focused on web, network and Active Directory attack paths. I turn messy findings into clear, prioritised fixes a team can actually ship.
All work shown is authorized and sanitized.
Attacker mindset, engineer habits
A quick picture of how I work and where I focus.
I spend my days thinking like an attacker and writing like a defender. Over the last six years I have run assessments across web apps, internal networks and cloud estates, from scoping and recon through exploitation to a report an engineering team can act on without a translator. I care less about the flashiest exploit and more about the path a real adversary would take, and how to close it for good. When I am not on an engagement you will find me building a home lab, chasing retired boxes, or writing up what I learned so the next person moves faster.
Focus areas
- Web application testing
- Active Directory & network
- Cloud attack paths
- Adversary emulation
- Clear, prioritised reporting
Skills & tooling
Grouped by where it matters on an engagement, not a wall of logos.
Web application testing
Manual-first testing of auth, access control, injection and business logic, mapped to real impact.
- Burp Suite Pro
- OWASP ZAP
- sqlmap
- ffuf
- Caido
- Nuclei
Active Directory & network
Internal attack paths from a single foothold to domain-wide impact, and the controls that stop them.
- BloodHound
- Impacket
- CrackMapExec
- Responder
- Nmap
- Mimikatz
Cloud security
Identity, exposure and privilege-escalation review across AWS, Azure and GCP.
- Prowler
- ScoutSuite
- Pacu
- CloudMapper
- trusted-advisor
Forensics & reversing
Triage, memory analysis and static review when something needs taking apart.
- Ghidra
- Volatility
- Wireshark
- radare2
- dnSpy
Scripting & automation
Tooling that turns a repeatable finding into a one-command check.
- Python
- Bash
- PowerShell
- Go
- Docker
Featured engagements
A handful of sanitised assessments: the problem, the approach, the tools and the outcome.
Write-ups
Walkthroughs, research notes and home lab builds. Everything here is on retired or lab targets.
Certifications & achievements
Certifications, platform rankings and a few things I am proud of.
OSCP
EarnedOffensive Security Certified Professional
CRTO
EarnedCertified Red Team Operator
Security+
EarnedCompTIA Security+
eJPT
EarnedeLearnSecurity Junior Penetration Tester
OSEP
In progressOffensive Security Experienced Penetrator
HackTheBox
@nullroute
180+ machines owned
TryHackMe
@nullroute
90+ rooms completed
Top 1% on HackTheBox
RankingRanked in the top 1% of the global HackTheBox leaderboard across 180+ owned machines.
Acknowledged in 3 bug bounty programs
Bug bountyValid reports accepted and fixed across two SaaS vendors and one e-commerce platform.
Speaker, regional security meetup
TalkTalk on practical Active Directory attack paths and the controls that break them.
Open-source tooling
CommunityMaintainer of a small set of assessment helper scripts used by my team.
Experience
Where I have worked and what I shipped.
Senior Penetration Tester
2022 — PresentRedcell Security · Remote
Lead web and internal network assessments for mid-market and enterprise clients, from scoping through retest.
- Lead tester on 40+ engagements across web, network and cloud
- Built the team's Active Directory assessment playbook
- Mentor two junior testers and run internal technique sessions
Security Analyst
2020 — 2022Harbor Technologies · Berlin
Moved from blue-team monitoring into offensive work, running internal assessments and detection tuning.
- Ran internal phishing and assumed-breach exercises
- Tuned SIEM detections for common attack techniques
- Bridged the gap between the SOC and the pentest team
IT Support Engineer
2018 — 2020Northwind Logistics · Berlin
First role in tech. Supported users and infrastructure, which is where the security interest started.
- Hardened endpoint and account configuration
- Introduced a basic patch-management routine
- Self-taught into the first security certifications
Let us talk
Hiring, a contract assessment, a talk, or just comparing notes. My inbox is open.
Prefer to reach out directly? Use any of these. For anything sensitive, encrypt it with my PGP key.
Direct links appear here once added in the CMS. The form on the right works right now.