MENU
Products Gosshed WAFER Securebox WAF
About Expertise Securebox WAF Career Journey Credentials Tech Stack Blog Contact

WAHYU PRIMADI

CTO at Lumoshive Cybersecurity Enthusiast Purple Team Virus/Virii/Malware Developer Securebox (WAF) Creator Software Developer Project Manager Blockchain Technology

Building the future through technology & innovation

Download CV PDF · 4.7 MB Let's talk
Checking connection...
Wahyu Primadi
About Wahyu
ABOUT ME

Building Systems.
Breaking Assumptions.
Securing the Future.

I work at the intersection of technology, security, and leadership. My journey started from understanding how systems fail, sometimes by building the failures myself, so I could later design them to stand strong.

As CTO at Lumoshive, I lead teams to build resilient systems, secure platforms, and pragmatic solutions. My background spans offensive and defensive security (Purple Team), software engineering, project leadership, and the creation of Securebox (WAF).

I believe real security is not about paranoia, it's about clarity, discipline, and quiet control over complexity.

24+ Years of Experience
50+ Projects Launched
150+ Engineers Led
OPEN SOURCE

GitHub Contributions

@wprimadi

Loading contributions…

EXPERTISE

What I Bring to the Table

Cybersecurity & Purple Team Ops

Hands-on experience in offensive & defensive security practices, threat modeling, vulnerability assessment, and security architecture design.

Web Application Security

Designing, building, and deploying Web Application Firewall solutions to protect production systems from real-world attacks.

Technology Leadership

Leading engineering teams, defining technical strategy, aligning architecture with business objectives, and driving secure-by-design culture.

Software Development

Designing scalable backends, secure APIs, system integration, and maintainable codebases.

DevSecOps & Infrastructure Security

Integrating security into CI/CD pipelines, environment hardening, and security monitoring across development and production environments.

Project & Delivery Management

Translating business requirements into executable technical plans, managing risks, scope, and delivery timelines.

PRODUCT · WEB APPLICATION FIREWALL

Securebox WAF

Securebox WAF is an enterprise-grade Web Application Firewall I design and build from the ground up: a single self-hosted binary that sits in front of your sites as a reverse proxy, soaks up Layer-7 DDoS, and blocks the OWASP Top 10 before a single malicious request reaches your application. It bundles global threat intelligence, JA4H behavioral fingerprinting, automatic Let's Encrypt certificates, and a real-time monitoring dashboard, so a small team can run production-grade protection without stitching a dozen tools together. Everything stays on your own infrastructure, and every HTML response can be encrypted on the fly, so bots and scrapers never see your markup.

Securebox WAF live-monitor command center: a real-time world map of traffic, an attack-type breakdown (Threat Intelligence, JA4H, SQLi, XSS, RCE, LFI), a live event feed and a queries-per-second chart.
Explore Securebox Watch it in action
$ sudo bash -c "$(curl -fsSLk https://waf.securebox.id/download/securebox-waf-setup.sh)"

One command brings the WAF and its database up in under a minute.

Global threat intelligence

Drops 615M+ known-bad IPs at the edge, before they touch your app or burn server resources.

JA4H immune system

Fingerprints every request, counts strikes across time windows, and auto-bans repeat offenders.

OWASP Core Rule Set

Blocks SQL injection, XSS, and path traversal out of the box, with per-rule exceptions for false positives.

Layer-7 anti-DDoS

Rate-limits per IP and per site, then jails aggressive traffic with a block or JavaScript challenge.

HTML/JS encryption

Bots and scrapers see encrypted garbage; real browsers decrypt every response transparently.

Auto-SSL & routing

Let's Encrypt certificates renew themselves across reverse-proxy, static, PHP, and redirect modes.

SEE IT IN ACTION

Live monitoring dashboard

Real-time world map, attack feed, and queries-per-second, built for a 24/7 command center.

Deploy in under a minute

From zero to a protected site with a single install command.

Put it in front of your own servers.

Securebox runs on your infrastructure, so your traffic never leaves your machines.

Explore Securebox Install docs
CAREER JOURNEY

Where I've Made an Impact

2006 — Present

2006

EDP Staff (Software Developer)

Rosalia Indah

Developed internal desktop and web applications, supported database design, and improved operational workflows across transportation, logistics, and hospitality business units.

2006 — 2007

Software Developer

ZeenRG

Developed desktop applications and implemented ERP solutions for savings and loan cooperatives, contributing to digital transformation initiatives in the financial sector.

2007 — 2008

Co-founder & Lead Developer

Rekamedia Group

Co-founded an IT solutions company serving government and private sector clients. Led solution design, software delivery, and client engagement across multiple regions.

2008

Lecturer — Information Design & Security Concepts

BPSDM, Ministry of Law and Human Rights (Indonesia)

Delivered training on information system design and security concepts for government staff. Facilitated practical sessions and evaluated participants through structured assessments.

2009 — 2011

Software Developer & Web Developer

Datacom Solusindo

Built a web-based billing system from scratch using PHP and contributed to desktop application development using C++/Qt for PBX/PABX billing solutions.

2009 — 2011

Senior Software Developer

Sigma Pro Komunika

Delivered desktop and web-based enterprise applications across the full SDLC. Collaborated with stakeholders, performed code reviews, and built scalable, production-ready systems.

2011 — 2013

Enterprise Application Specialist

TelkomVision

Managed data warehouse operations, built ETL pipelines, developed dashboards for management reporting, and resolved escalated technical issues beyond service desk scope.

2013 — 2015

Lecturer — Advanced OOP & Visual Programming (VB.NET)

LP3i

Delivered hands-on instruction in advanced Object-Oriented Programming and Visual Programming. Mentored students to bridge academic concepts with real-world software development practices.

2013 — 2016

IT Service Desk Team Leader / Assistant Manager

Transvision

Led IT Service Desk operations, improved incident and request handling workflows, and coordinated with management to ensure reliable infrastructure and high service quality.

2016 — 2018

Application Development & IT Service Desk Department Head

Transvision (formerly TelkomVision)

Managed application development and IT service desk operations. Led cross-functional teams to deliver internal applications, improved service delivery processes, and acted as a bridge between technical teams and business stakeholders.

Feb 2018 — Aug 2022

Department Head of IT Development

MNC Vision

Led IT development strategy and engineering teams, aligned technology initiatives with business objectives, enforced IT standards, conducted system audits, and delivered cross-functional projects to improve organizational efficiency and service quality.

2019 — 2023

Data Analyst (Cyber Patrol & Online Threat Intelligence)

Ministry of Communication and Information Technology of the Republic of Indonesia

Conducted continuous cyber patrol operations to identify domains, URLs, and online content associated with terrorism, radicalism, separatism, and other extremist activities. Performed threat analysis and content classification to support takedown and blocking actions.

Sep 2022 — Apr 2023

Department Head of DWAISE

Jatis Mobile

Led the design and implementation of enterprise data warehouse architecture, ETL pipelines, and analytics platforms. Collaborated with developers and business stakeholders to deliver reporting systems and internal applications.

2022 — Present

Head of IT Development

Classified / Top-Secret Unit

Leading a specialized engineering team to design and develop mission-critical systems and internal tools for sensitive operations. Architecting secure mobile-based communication platforms with a strong focus on confidentiality, integrity, and operational resilience.

Dec 2023 — Present

CTO

PT. Lumos Inisiatif Indonesia (Lumoshive)

Leading technology strategy and multiple engineering teams to deliver secure, scalable, and business-aligned digital products. Overseeing software architecture, DevOps, infrastructure, system monitoring, and cybersecurity initiatives. Driving a security-first mindset while aligning engineering execution with business outcomes.

CREDENTIALS

Certified & Verifiable

Each one links to the issuer's own verification page, so you don't have to take my word for it.

The Cyber Ledger Advanced
TCL-CERT-96-5984E14935

Certified Defensive Security Practitioner

Issued

SHA-256 a18a17e649a7d83d…39876b84
Verify credential
The Cyber Ledger Beginner
TCL-CERT-F0-63CBE14E12

Certified Offensive Security Associate

Issued

SHA-256 ff71890b3d1d5abe…7719052d
Verify credential
IBM SkillsBuild Badge
44933ccc-c56e-4c49-836a-c3796f9d6706
IBM SkillsBuild Cybersecurity Fundamentals badge

Cybersecurity Fundamentals

Issued

Credly Open Badge, issuer-hosted
Verify credential

Course completions

8 Udemy courses, 107 hours of coursework
TECH STACK

Tools & Technologies

Languages & Frameworks
  • Golang
  • PHP
  • CodeIgniter
  • C#
  • VB.NET
  • .NET Framework
  • Xojo
  • Gambas
  • Bash
  • HTML
  • CSS
  • JavaScript
  • jQuery / jQuery UI
  • Kendo UI
  • DevExpress
Data, Messaging & BI
  • MySQL
  • PostgreSQL
  • MongoDB
  • Redis
  • ClickHouse
  • Apache ActiveMQ
  • RabbitMQ
  • Pentaho
  • Talend Open Studio
  • Grafana
  • Kibana
Security & Monitoring
  • Suricata
  • Wazuh
  • ModSecurity
  • SafeLine
  • OWASP ZAP
  • Greenbone
  • Metasploit
  • Burp Suite
  • Snort
  • Fail2ban
  • John the Ripper
  • Hydra
  • Nmap
Network, Web & CDN
  • Check Point
  • Sophos XG Firewall
  • pfSense
  • OPNsense
  • Zyxel
  • Apache
  • Nginx
  • Cloudflare
  • Akamai
LATEST WRITINGS

Notes & Thoughts

Inside the Wiretapping Case That Named Indonesia's Former Police Chief as a Suspect
04/11/2026 09:00:19 • Junet

Inside the Wiretapping Case That Named Indonesia's Former Police Chief as a Suspect

The Indonesian National Police named General Listyo Sigit Prabowo, the Chief of Presidential Staff and a former police chief, as a suspect in an investigation into alleged illegal wiretapping of President Prabowo Subianto. Here is what we know, and why the technical details matter....
Read Article
The SMS of Death: How an Eight-Byte Text Message Crashes Android Phones
02/11/2026 04:03:37 • Jawir

The SMS of Death: How an Eight-Byte Text Message Crashes Android Phones

A single invisible eight-byte SMS can crash the telephony stack on Android, drop emergency calls, and, in the researcher's tests, trap some devices in a reboot loop....
Read Article
CVE-2026-98432: A 9.8 Linux TCP Use-After-Free Introduced in Kernel 4.4, and the AI That Found It
31/10/2026 14:51:35 • Jawir

CVE-2026-98432: A 9.8 Linux TCP Use-After-Free Introduced in Kernel 4.4, and the AI That Found It

A use-after-free in the kernel's IPv4 TCP handshake, introduced in Linux 4.4, carries a 9.8 CVSS score. Ubuntu and RHEL still have no patched kernel. Here is what is happening and how to protect your servers....
Read Article
The $6.3 Billion Binance Incident: The Security Problem Beyond Crypto
30/10/2026 13:29:12 • Jawir

The $6.3 Billion Binance Incident: The Security Problem Beyond Crypto

Binance's $6.3 billion security incident points beyond crypto to a familiar weakness: the endpoints and authorization paths that can move value....
Read Article
HTTP2Shell: One Brotli Bug, RCE Across the HTTP Stack
27/10/2026 08:07:49 • Jawir

HTTP2Shell: One Brotli Bug, RCE Across the HTTP Stack

The Brotli decoder bug I covered as a Node.js issue last week has grown into HTTP2Shell, a cross-stack RCE affecting Python, .NET, Bun, Envoy, and more. Here's what actually changed....
Read Article
Nginx Patches Three Critical Memory Bugs, One Present Since 2005
26/10/2026 19:02:08 • Jawir

Nginx Patches Three Critical Memory Bugs, One Present Since 2005

F5 shipped an out-of-band nginx release fixing five flaws, including three critical memory bugs and one present since 2005. Here is what changed and how to scope your exposure....
Read Article
Tailworm: How One Compromised Device Could Lead to Root Access Across a Tailnet
26/10/2026 08:35:44 • Jawir

Tailworm: How One Compromised Device Could Lead to Root Access Across a Tailnet

A lab report says Tailscale SSH can let an attacker who holds a single compromised device reach root on other servers. Here is what the findings show and how to lock down your tailnet....
Read Article
Laravel Fixed a Critical Auth Bypass in August. It Disclosed It in October.
24/10/2026 14:02:29 • Jawir

Laravel Fixed a Critical Auth Bypass in August. It Disclosed It in October.

Laravel quietly fixed a critical TokenGuard authentication bypass on Aug. 25, 2026, then disclosed it on Oct. 21. On MySQL and MariaDB, an unauthenticated attacker can authenticate as an existing user without a valid API token. Here's the root cause and who's actually exposed....
Read Article
Two Critical RCE Bugs in Linux's Built-In SMB Server, Disclosed Before a Fix Existed
23/10/2026 07:33:53 • Jawir

Two Critical RCE Bugs in Linux's Built-In SMB Server, Disclosed Before a Fix Existed

Two remote code execution flaws in Linux's in-kernel SMB server, both scored 9.0, were posted to a public mailing list before any fix landed. Here is what happened, who is exposed, and what to do right now....
Read Article
From the Archive
GET IN TOUCH

Let's Build
Something Great

Whether you need a technical leader, strategic advisor, or a partner to bring your vision to life — I'd love to hear from you.

Email Me LinkedIn Download CV
or send a message