A cybersecurity expert who secures your SaaS, fintech or digital platform before an attacker gets in.

Diego Melo — Offensive security researcher and founder of No Vuln.

Offensive security researcher with a track record in international bug bounty programs (U.S. Department of Defense, eToro, Bitso, Hostinger). Founder of No Vuln. Focused on identity vulnerabilities (OAuth, SAML, JWT) and business logic.

Unlike a traditional consultancy, at No Vuln you talk directly to the person who found the bug. There's no account manager layer, and no junior doing the work while the senior only shows up in sales meetings. Every pentest is carried out by a researcher with a name and a face — with peer review and documented quality gates.

See the full profile at /en/about/diego-melo.

“Cybersecurity expert” covers three very different profiles. Knowing which one you need is half the hiring decision:

1. Defensive expert (Blue Team)

• SOC analyst, threat hunter, security engineer
• Focus: detecting and responding to attacks in progress
• Tools: SIEM, EDR, threat intel, log analysis
• When to hire: companies with high transaction volumes that need 24/7 monitoring

2. Offensive expert (Red Team / Pentester)

• Pentester, red team operator, bug bounty hunter, exploit developer
• Focus: finding vulnerabilities before attackers do
• Tools: Burp, custom fuzzers, exploit chains, recon
• When to hire: when a company needs to find out what's wrong before a regulator, the press or an attacker does. This is No Vuln's profile

3. Regulatory expert (GRC)

• GRC analyst, compliance officer, ISO/SOC auditor, compliance-focused CISO
• Focus: structuring policy, compliance and auditability
• Tools: frameworks (ISO, NIST, COBIT), spreadsheets, policies, training
• When to hire: companies preparing for ISO 27001 or SOC 2, or that need a dedicated DPO

In 2026, a serious company has all three — in-house or outsourced. But if you're just getting started, the offensive profile delivers the most immediate ROI. A pentest uncovers real vulnerabilities in hours, with a reproducible PoC. The defensive and regulatory layers are built on top of that assessment.

1. A verifiable public track record — findings in international bug bounty programs (U.S. Department of Defense, eToro, Bitso, Hostinger); CVEs under their name; CTF wins; talks at recognized conferences (DEF CON, Black Hat, H2HC, BSidesSP)
2. The ability to explain their methodology — a real researcher can explain in technical detail how they approach a bug, which tools they use, in what order and why. Someone selling a generic checklist can't get past that
3. Anonymized PoCs from past work — they can't show you the client, but they can show you the shape of the bug, its severity and how it was exploited. A generalist without technical depth has no material like that
4. Direct support, no account manager layer — at an elite firm, you talk to the researcher, not to an account manager. That's a real differentiator
5. Mutual NDA, formal invoicing, a registered company — a serious operation has its own legal entity, not a borrowed one
6. Retest included — in 2026, retesting is a commodity. A serious professional includes it in the price; anyone who charges for it separately is charging twice for the same work

1. First contact — you describe the scope (SaaS, fintech, app, team size, regulations). Mutual NDA sent within 24h
2. Technical call — once the NDA is signed, a 30–60 minute conversation with the researcher to map the attack surface, roles and critical flows
3. Formal proposal — within 3 business days, with a detailed scope, timeline, investment range and contract terms
4. Execution — a pentest with a documented methodology, direct communication with the researcher through a dedicated channel (Slack/Discord), and critical findings flagged in real time
5. Delivery — technical + executive report + live readout + remediation plan. Retest included within 30–90 days