Canonical page: About # The people behind Guvenkaya. [Discuss your scope](https://www.guvenkaya.co/contact?source=about) Every specialist on your engagement is named in the proposal, with public work you can read before you sign. We review custody and key management, blockchain systems, and the applications and infrastructure built around them. Founded **2022** Origin Timur Güvenkaya founded Guvenkaya in 2022. Previously, he established and led a security engineering practice for complex blockchain systems. Earlier at Invicti, he helped build vulnerability-detection engines used by Fortune 50 companies and public-sector organizations. Today, Guvenkaya reviews the code, architecture, and operations that control digital assets. Why Guvenkaya? ## How we work with you. ### You work directly with a principal Your principal defines the scope with you, leads communication, and reviews the report before delivery. ### You get the expertise your review needs We choose specialists for the systems under review. For a custody review, your team includes a custody specialist. ### You see risks beyond the code We examine your architecture, infrastructure, and release process to explain how weaknesses can put funds and operations at risk. ### You work with experienced security leaders Our advisors lead security teams at other companies and bring experience from Kraken, Binance, OpenZeppelin, ZKsync, Union Labs, Gauntlet, Agora Finance, Tensor, Nillion, Tectonic Labs, and Invicti. Team ## Our leadership & advisory team Explore the team’s public profiles, published work, and experience. Principals & Partners - [Timur Güvenkaya Timur](#timur-guvenkaya) - [Müjde Nur Asgarli Güvenkaya Müjde](#mujde-guvenkaya) - [Piotr Cielas Piotr](#piotr-cielas) Specialist Advisors - [Paul Vijender Paul](#paul-vijender) - [Michal Bajor Michal](#michal-bajor) - [Manuel B. Santos Manuel](#manuel-santos) - [Georgii Plotnikov Georgii](#georgii-plotnikov) - [Hussein Ait-Lahcen Hussein](#hussein-ait-lahcen) - [Łukasz Mikuła Łukasz](#lukasz-mikula) - [José C. Ramírez José](#jose-ramirez) ### Principals & Partners ![Timur Güvenkaya portrait](https://www.guvenkaya.co/v2/portraits/timur-guvenkaya.webp) #### Timur Güvenkaya Founder & Partner [LinkedIn](https://www.linkedin.com/in/timur-guvenkaya/) - Previously Invicti Timur founded **Guvenkaya** after seeing teams reduce security to code review while their real risk spans architecture, infrastructure, operations, custody, and launch decisions. Before Guvenkaya, he **established and led a security engineering practice** for complex blockchain systems, specializing in Rust-based and non-EVM ecosystems including Substrate and NEAR. Earlier at **Invicti**, he helped build enterprise vulnerability-scanning and security detection engines used by **Fortune 50 companies and public-sector organizations**. He holds the **CISSP** certification. ![Müjde Nur Asgarli Güvenkaya portrait](https://www.guvenkaya.co/v2/portraits/mujde-guvenkaya.webp) #### Müjde Nur Asgarli Güvenkaya Growth & Marketing Partner [LinkedIn](https://www.linkedin.com/in/m%C3%BCjde-nur-asgarli-g%C3%BCvenkaya-7a7a47170/) - Previously Optimum7 Müjde leads **growth and marketing**, bringing hands-on agency experience in **performance marketing**, data-led strategy, and audience-specific campaign planning. At **Optimum7**, on the agency side, she worked with **major brands** across healthcare, e-commerce, and other sectors, translating business goals into focused growth strategies for different markets and audiences. She holds a **Bachelor's degree in International Affairs** and a **Master's in Business Administration**. ![Piotr Cielas portrait](https://www.guvenkaya.co/v2/portraits/piotr-cielas.webp) #### Piotr Cielas Principal Advisor [LinkedIn](https://www.linkedin.com/in/piotr-cielas/) - Currently Head of Security, Agora - Previously EY Piotr is **Head of Security at Agora**, where he oversees information security, data protection, and corporate IT risk management. He brings both industry and consulting experience, having led information security advisory engagements and **security program development** for **global financial institutions** and large organizations. Earlier in his career, Piotr was a Senior Cybersecurity Consultant at **Ernst & Young (EY)**, leading security assessments across financial services, healthcare, and government. He holds **CEH, OSCP, and OSWE** certifications, has contributed to the **CVE program**, and is the inventor of **multiple U.S. patents** related to information security and blockchain technology. ### Specialist Advisors ![Paul Vijender portrait](https://www.guvenkaya.co/v2/portraits/paul-vijender.webp) #### Paul Vijender Specialist Advisor [LinkedIn](https://www.linkedin.com/in/paulvijender/) - Currently Head of Security, Gauntlet - Previously Tensor, Broadcom, EY Paul is **Head of Security at Gauntlet**, a hands-on security leader experienced in building and operating **security teams for digital asset systems**. His experience spans product security, identity and access management, cloud and network security, data loss prevention, DevSecOps, blockchain security, and compliance. He has advised and delivered engagements for **Fortune 500 firms**, big-tech companies, and frontier-technology startups across crypto and AI. Earlier he was **Head of Security at Tensor** and a **Senior Cybersecurity Manager at EY**, and held security roles at **Broadcom and ADP**. He holds the **CISM** certification. ![Michal Bajor portrait](https://www.guvenkaya.co/v2/portraits/michal-bajor.webp) #### Michal Bajor Specialist Advisor [LinkedIn](https://www.linkedin.com/in/michal-bajor/) - Previously Kraken, EY, Cisco Michal is a security expert with a **Master's in ICT**, **three published research papers**, and active academic research in blockchain technology. He has reviewed **60+ Web3 projects** across DeFi, L1 systems, bridges, oracles, and other critical ecosystem components. At **Kraken**, he was responsible for security across **crypto and fiat funding services and custody**, B2B APIs, on-chain monitoring, smart-contract risk, and architectural and compliance reviews. Earlier at **EY**, he conducted web application penetration tests, participated in red-team activities, and worked across defensive security responsibilities; at **Cisco**, he supported Security Advisory penetration-testing work and internal cybersecurity training. ![Manuel B. Santos portrait](https://www.guvenkaya.co/v2/portraits/manuel-santos.webp) #### Manuel B. Santos Specialist Advisor [LinkedIn](https://www.linkedin.com/in/manel1874/) [Research articles](https://github.com/manel1874#--research-articles) - Previously Tectonic, Nillion, Tekever Manuel is a **cryptography engineer** doing applied research in **post-quantum cryptography, secure multiparty computation, and zkTLS**. He holds a **Ph.D. in Information Security** from **Instituto Superior Técnico, University of Lisbon**, and an **M.Sc. in Applied Mathematics** from **Imperial College London**, with **13 published research articles** across quantum oblivious transfer, privacy-preserving computation, and post-quantum blockchain design. He worked on **post-quantum cryptography at Tectonic** and on **MPC and zkTLS at Nillion**, where he contributed to **Nada**, a language for secure multiparty computation, and authored **technical reports on threshold ECDSA**. Earlier he was a **Quantum Cryptography Researcher at Tekever**. ![Georgii Plotnikov portrait](https://www.guvenkaya.co/v2/portraits/georgii-plotnikov.webp) #### Georgii Plotnikov Specialist Advisor [LinkedIn](https://www.linkedin.com/in/0xgeorgii/) [Inference language](https://inference-lang.org/) - Currently CEO, Inferara - Previously OpenZeppelin Georgii is **CEO at Inferara** and the designer of **Inference**, a statically typed, high-assurance language built so executable programs and formal specifications can live in the same source. The language uses a deterministic, WebAssembly-aligned execution model with verification-only specification blocks. He led the **Rust** implementation of the infc compiler, which produces optimized **WebAssembly** for execution and **Rocq** theorem obligations for formal verification. He also leads development of a **Stellar smart-contract decompiler**. Previously, as **Lead Security Tooling Developer at OpenZeppelin**, he designed and implemented the foundation of **Code Inspector**, the Defender code-analysis module, shipping GitHub-integrated analysis that grew beyond **130 static-analysis rules**. His work spans reentrancy and unsafe-call detection, vulnerable-dependency and standards checks, contract fingerprinting, fuzz-target identification, and LLM-driven vulnerability analysis, with static-analysis tools in Python and Rust for Solidity, Rust-based DSLs, and Midnight Compact. ![Hussein Ait-Lahcen portrait](https://www.guvenkaya.co/v2/portraits/hussein-ait-lahcen.webp) #### Hussein Ait-Lahcen Specialist Advisor [LinkedIn](https://www.linkedin.com/in/hussein-a-967810a7/) [Union source](https://github.com/unionlabs/union) - Currently Founding Principal Engineer, Union Labs - Previously Composable Finance, MLabs Hussein is **Founding Principal Engineer at Union Labs**, where he leads protocol and cryptography engineering for a zero-knowledge bridging protocol built on IBC. Union connects around 10 chains and has processed **more than $100M in volume**. He designed **CometBLS**, a CometBFT fork with aggregated BLS signatures that is cheap to verify in a ZK circuit, and built **Galois**, its **Groth16 prover in Go and gnark**, which proves 128 validators in about 7 seconds on consumer hardware. He built most of Union's **on-chain light clients**, including Ethereum, BNB Chain, Arbitrum, Linea, and OP Stack chains; the backend for a **trusted setup ceremony** with around 5,600 contributors; and **private cross-chain payments** that hide user addresses while keeping issuer audit access. He has shipped contracts in **Solidity, CosmWasm, and Move**. Earlier he led a team at **Composable Finance** building Substrate pallets, including an AMM and a lending protocol, and infrastructure connecting Cosmos and Polkadot. At **MLabs** he built Plutus DeFi protocols for SundaeSwap and Liqwid Finance. He has **12+ years in software engineering** and a Master of Engineering in Computer Science from Polytech Paris-Saclay. ![Łukasz Mikuła portrait](https://www.guvenkaya.co/v2/portraits/lukasz-mikula.webp) #### Łukasz Mikuła Specialist Advisor [LinkedIn](https://www.linkedin.com/in/lukaszmikula/) - Previously Binance, ING Łukasz is a security researcher with **10+ years in offensive security** and a public portfolio of **100+ audits across 8+ ecosystems**. His smart-contract work spans EVM/Solidity, Move, Rust-based ecosystems, CosmWasm, Solana, Substrate, and TON, including assessments for **Coinbase, MegaETH, Kyber, Jupiter, Zilliqa, IOTA, and Initia Move**. At **ING**, he worked across web application and infrastructure penetration testing, red-team work, exploit development, reverse engineering, mobile security, adversary simulation, and smart-device testing. At **Binance**, he worked on security concerns for high-scale digital asset systems. He holds the **OSCP, OSCE, eWPT, and eWPTX** certifications and has **CVE disclosures affecting IBM, Oracle, F5, Dell, and Red Hat**. ![José C. Ramírez portrait](https://www.guvenkaya.co/v2/portraits/jose-ramirez.webp) #### José C. Ramírez Specialist Advisor [LinkedIn](https://www.linkedin.com/in/jcramirezv/) - Previously ZKsync José is a security engineer and technical trainer specializing in **smart contract and blockchain security**, with around **10 years of experience** across offensive security, application security, and security review. At **ZKsync**, he reviewed code, architecture, and design across Solidity/EVM, **account abstraction**, protocol-level security, and Rust-based components, later building **AI-assisted workflows** for vulnerability discovery and protocol security analysis. He has participated in smart contract audits across **CosmWasm, EVM, and NEAR** and holds **OSCP, CREST CRT, AWS Certified Security, and AWS Certified Solutions Architect** certifications. José has also delivered university courses, guest lectures, and workshops on blockchain and smart contract security, including at the **University of Málaga** and with the **University of Porto**. Team credentials **13** published cryptography research papers **200+** audits across the team **2** Heads of Security on the advisory team - ![OSCP](https://www.guvenkaya.co/v2/certifications/oscp.svg) - ![OSCE](https://www.guvenkaya.co/v2/certifications/osce.svg) - ![OSWE](https://www.guvenkaya.co/v2/certifications/oswe.svg) - ![CREST Registered Tester (CRT)](https://www.guvenkaya.co/v2/certifications/crest-crt.svg) - ![CISM](https://www.guvenkaya.co/v2/certifications/cism.svg) - ![CISSP](https://www.guvenkaya.co/v2/certifications/cissp.png) - ![AWS Certified Security Specialty](https://www.guvenkaya.co/v2/certifications/aws-security.svg) - ![AWS Certified Solutions Architect Associate](https://www.guvenkaya.co/v2/certifications/aws-architect.svg) - ![eWPT](https://www.guvenkaya.co/v2/certifications/ewpt.svg) - ![eWPTX](https://www.guvenkaya.co/v2/certifications/ewptx.svg) ## Discuss your scope. Describe your system, main concern, and deadline. We'll reply with scoping questions and a proposed next step. [Discuss your scope](https://www.guvenkaya.co/contact?source=about)