Co-founder, CryptoGen Nepal
See your systems the way an attacker does.
I'm Nirmal Dahal, a cybersecurity consultant with 14+ years across offensive security, security operations and GRC. I assess your systems the way attackers do, build the monitoring that catches them, audit against the standards you're held to, and automate the work in between. Available for remote engagements.
- years in security
- 14+years in security
- certifications
- 18certifications
- talks, trainings and panels
- 36talks, trainings and panels
- ethical hackers, EC-Council 2021
- Top 10ethical hackers, EC-Council 2021

About me
14+ years across offence, defence and audit.

Nirmal DahalCo-founder, CryptoGen Nepal
I started in security in 2012, working independently, and in 2016 became a web application penetration tester, testing for banks and payment providers. In 2019 I co-founded CryptoGen Nepal, where I lead the technical work across testing, security operations and audit. I also teach at Softwarica College and help run Pentester Nepal, a security community of more than 6,000 members.
- Co-founder, CryptoGen Nepal · since 2019
- Part-time lecturer, Softwarica College of IT & E-commerce · since 2022
- Community leader, Pentester Nepal · since 2017
Services
Where I can help.
- Penetration testingWeb, API, mobile, network and cloud testing from an attacker's point of view.How it works : Penetration testing
- Security operationsDetection engineering, SIEM, incident handling and malware analysis.How it works : Security operations
- GRC advisoryInformation system audits, ISO/IEC 27001 and security strategy.How it works : GRC advisory
Hacktivities
The moments that stand out.
Plus 36 talks, trainings and panels delivered.
All case notesIn the media
On TV, podcasts and the tech press.
Certifications
Credentials across offence, defence and audit.
- ISONov 2024ISO/IEC 27001:2022 Lead Auditor
- EC-CouncilMar 2021Certified Ethical Hacker (Master)
- APIsec UniversityOct 2025Certified API Security Analyst
- Cyber Warfare LabsApr 2025Certified Multi-Cloud Red Teaming Analyst
- Cyber Warfare LabsJun 2025Certified Multi-Cloud Blue Team Analyst
- SISA InfosecJul 2020Certified PCI Security Implementer
Recommendations
What people I've worked with say.
“I had the privilege of working with Nirmal. He led a comprehensive security audit that uncovered critical vulnerabilities and delivered a clear remediation roadmap…”
Aslam Ali on LinkedIn (opens in a new tab)Former Head of SOC, eSewa“I worked with Nirmal as a security vendor across several audit engagements. He identified and helped remediate high-risk vulnerabilities and ensured alignment with standards like ISO 27001. Top-tier expertise, recognized globally.”
Abhisek Bhattarai on LinkedIn (opens in a new tab)Former ISO, IME Khalti“I highly recommend Nirmal as a cybersecurity leader who combines deep technical expertise with exceptional client engagement. He's incredibly knowledgeable, generous with his time, and a true asset to any team.”
Samme Newton on LinkedIn (opens in a new tab)Head of SOC, Defence Logic“Nirmal has gone on to co-found CryptoGen Nepal and establish himself as one of the country's leading cybersecurity visionaries, earning global recognition for his expertise in offensive and defensive security as well as GRC.”
Hugh Shepherd Jr. on LinkedIn (opens in a new tab)Principal Consultant, HSJR Global SolutionsWriting
Research and write-ups.
- 18 Apr 2026 · 6 min readFrom PyCon JP 2024 speaker to PyCon JP 2026 organiserHow Python shaped my offensive security work, what I presented at PyCon JP 2024 in Tokyo, and how it led to joining the PyCon JP 2026 organising team.#PyCon#pyconjp#cybersecurityRead the post

- 12 Jul 2022 · 2 min readLeveraging SQL injection to execute XSS by evading CSPHow a SQL injection was used to get past a content security policy (CSP) and execute XSS, starting with a short introduction to how CSP works.#csp bypass#sqlinjectionRead the post

- 9 Sep 2023 · 4 min readHardware hacking: bridging the cybersecurity gapHow a childhood spent repairing electronics led me to hardware hacking, and why hardware skills matter for closing gaps in cybersecurity.Read the post

Let's scope it together.
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.