clizSec
I'm Mark Liapustin (clizSec), a cybersecurity architect where email security, Web/API security, and regulatory compliance intersect. As CISO at Trustifi, killing phishing for a living, I set enterprise security strategy, GDPR, HIPAA, ISO 27001 framework programs, and AI/ML anti-phishing through intelligent agents and applied machine learning across the email, Web, and API stack.
From Israel to United States, Miami · English · Hebrew · Russian
Security tools I build outside my day-to-day CISO work.
Find the gaps. Close them. Stay audit-ready.
GRC is Governance, Risk, and Compliance. Missing policies, broken clause maps, and silent expirations kill audits - GRC Assistant surfaces the errors, auto-completes what is missing, and keeps completion rate climbing.
Paste an IOC. Know if the world already flagged it.
Suspicious links and hashes should not wait on a spreadsheet of feeds. ScaMatrix queries trusted threat intelligence for URLs, domains, IPs, emails, and file hashes - so you can spot phishing, malware, and known IOCs in real time during email and web triage.
Local URL and IOC investigation
Chrome extension that captures redirect chains, headers, HTML, scripts, and extracted indicators without uploading pages to the cloud.
Live log tail for Kibana
Chrome extension that turns any Kibana or Elastic deployment into a fast, tail -f style log stream, in the side panel or right inside Kibana.
Roles, impact, and skills across my career.
Full-time · Aug 2017 - Present
Miami, Florida, United States · Hybrid
Lead enterprise and product security for Trustifi's AI-powered email security platform, protecting MSPs, enterprises, and regulated organizations.
Las Vegas, Nevada · Hybrid
Built Trustifi's product email protections and company compliance program, the foundation of the later CISO role.
Tel Aviv District, Israel · On-site
Email threat research, vulnerability analysis, and penetration testing that shaped the product's defenses.
Self-employed · Mar 2025 - Present
Miami, Florida, United States · Remote
Independent security toolkit for security analysts, SOC, and IT teams, built alongside my CISO role.
Full-time · Nov 2014 - Aug 2017
Herzliya, Tel Aviv District, Israel · On-site
ICS/SCADA and IoT security research and customer proof-of-concepts against zero-day class threats.
Freelance · Mar 2007 - Jan 2011
Tel Aviv District, Israel · Remote
Freelance web application security for a range of clients.
Tel Aviv District, Israel · Remote
Built, hardened, and ran public-facing Linux servers for internet radio (SHOUTcast) and online game servers.
Responsible disclosure and bug bounty contributions.
Responsibly finding and reporting vulnerabilities across DoD systems and infrastructure through the Vulnerability Disclosure Program on HackerOne.
Reported two high-to-critical vulnerabilities in FlexiSPY services, with confirmed security impact and a bounty award. Public disclosure was not approved due to the sensitive nature of the findings.
Identified a path traversal vulnerability in WordPress Core AJAX handlers, contributing to the security of one of the most widely deployed CMS platforms.
Denial-of-service in Conext ComBox (model 865-1058), co-discovered with Arik Kublanov (Nation-E Ltd) and acknowledged by US-CERT and Schneider Electric.
Public research and advisory work.
Cybersecurity and Infrastructure Security Agency (CISA)
CVE-2017-6019. Identified and exploited a denial-of-service vulnerability affecting Schneider Electric Conext ComBox Solar Battery Monitor (model 865-1058) and related integrated devices. The finding was responsibly disclosed and publicly documented under advisory ICSA-17-061-02, contributing to mitigation guidance for industrial infrastructure.
NVD / MITRE
National Vulnerability Database record for the Conext ComBox (model 865-1058) uncontrolled resource consumption flaw, all firmware versions prior to V3.03 BN 830. Credited to Arik Kublanov and Mark Liapustin of Nation-E Ltd; fixed by Schneider Electric in firmware V3.03 BN 830.
Get in touch.
Best way to reach me for collaboration, security discussions, or professional inquiries - especially around email security, phishing, and enterprise security programs.