• Managing & Conducting end-to-end Vulnerability Assessment and Penetration Testing (VAPT) for Web, Android, and
iOS platforms, identifying security 'laws and ensuring compliance with industry standards.
• Performing comprehensive VAPT on Web, Android, and iOS applications using tools such as Burp Suite, MobSF, Drozer,
and OWASP frameworks to identify, exploit, and report security vulnerabilities.
• Identified Vulnerabilities such as SQL Injection, Cross site scripting XSS, SQLi, Insecure Deserialization, Business Logic
Bypass, SSRF, BOLA, BFLA, privilege escalation and even out of box security vulnerabilities along with Chain multiple
vulnerabilities.
• Conducted comprehensive source code reviews to identify security vulnerabilities in Applications built on Java, .NET,
Ruby, GraphQL, Swift, etc. to ensure secure coding practices are built in.
• Embedded Secure-By-Design principles into application development by conducting early-stage threat modelling,
secure design reviews and architectural risk assessment to prevent vulnerabilities before code implementation.
• Performed application security architecture review at design and pre-build stages, creating data like trust boundaries,
data lows and security control gaps to proactively close vulnerabilities at early stage of development. (Proactive
Security).
• Designed and deployed F5 BIG-IP ASM / Advanced WAF solutions securing 10+ enterprise applications against OWASP
Top 10 web vulnerabilities, reducing critical incidents by 60%.
• Lead the optimizxation of Secure Software Development Lifecycle (SSDLC), process and embededed security into
design and early phases of SDLC (Shift Left + DevSecOps).
• Integrated SonarQube with GitLab for Automated Code Scanning, CI/CD Integration with SAST Tools for Shift Left
Approach based Vulnerability Assessment.
• Performing VAPT on Microsoft Active Directory (On-Prem) using tools such as BloodHound, Sharp Hound,
CrackMapExec, Mimikatz,
escalation opportunities.
• Conducting Cloud Security assessments on Microsoft Azure and AWS platforms leveraging tools like Pacu, Scout Suite,
and Prowler to identify misconfigurations, privilege escalations, and insecure service permissions.
• Implemented AI Governance Controls by defining secure usage guidelines, access controls, risk assessment process for
AIEnabled applications in line with enterprise security and compliance requirements.
• Supported AI Governance initiatives by defining security, privacy and risk controls. Also implemented controls like AI
Usage, access management to ensure AI System adherence and smooth AI Security Audit.
• Managing vulnerability advisories, threat intelligence, and cyber investigations — leveraging platforms such as MISP,
Virus Total, and ThreatConnect to identify, correlate, and respond to evolving threats impacting Microsoft Azure, AWS,
and on-prem environments.
• Managing vulnerability lifecycle using Tenable Security Center Plus — performing scans, risk prioritization, and
remediation tracking across on-prem and cloud environments.
• Involved in AI governance initiatives — assessing AI model risks, data privacy compliance, bias mitigation, and
alignment with organizational and regulatory standards.
• Performing AI governance and assurance activities including model risk assessment, bias detection, and compliance
validation with frameworks such as ISO/IEC 42001, DPDP Act, and responsible AI guidelines — ensuring secure and
ethical deployment of AI systems.
• Performing data protection and privacy governance tasks aligned with UAE Federal Data Protection Law (PDPL), NEMA
regulations — focusing on lawful data processing, consent management, and cross-border data transfer compliance.
practices, compliance with UAE PDPL, NEMA, and GDPR-equivalent regulations, and reducing organizational risk
through proactive education.
• Tuned F5 WAF policies to reduce false positives.
- Company industry:
- IT Services
- Job role:
-
Information Technology
