Nambikkai Maharajan Sundaram

VAPT & Application Security
• Conducted grey-box and black-box penetration testing on web applications and REST APIs, identifying OWASP Top 10
vulnerabilities including IDOR, Broken Access Control, Broken Authentication, and Sensitive Data Exposure.
• Produced formal pentest reports with CVSS-scored findings, exploit evidence, risk ratings, and actionable remediation
recommendations for development and infrastructure teams.
• Executed Proof-of-Concept (POC) validations alongside manual retesting and automated re-scans to ensure complete
remediation and secure closure.
• Used Burp Suite, OWASP ZAP, Nmap, and Wireshark for active security assessments across application and network
layers.
• Performed security assessment of web and mobile application APIs, validating authentication, authorization, session
management, and sensitive data exposure issues aligned with OWASP Mobile and API Security risks.
• Improved vulnerability remediation efficiency through risk-based prioritisation (CVSS, EPSS, asset criticality), ensuring
timely resolution of critical issues

Vulnerability Management
• Owned end-to-end vulnerability lifecycle across 2, 000 on-site assets (application and infrastructure) using Qualys
VMDR — from identification through risk-based prioritisation to validated closure.
• Executed risk-stratified scanning: weekly for critical and internet-facing assets, monthly for internal infrastructure, ad
hoc post-patch and change cycles.
• Applied multi-factor prioritisation (CVSS, EPSS, asset criticality, internet exposure) ensuring critical exploitable
vulnerabilities were resolved within SLA windows.
• Coordinated remediation with development and infrastructure teams across CI/CD and production environments,
performed root cause analysis on recurring vulnerabilities and posture gaps presented findings with business impact
context to governance and executive stakeholders.
DevSecOps Integration
• Integrated SAST (SonarQube) and embedding security into CI/CD pipelines by designing and enforcing security gates
using SAST and SCA tools to prevent vulnerable code from reaching production.
• Triaged scan results after each build to eliminate false positives delivered developer-ready findings with severity
ratings and fix guidance focused on exploitable issues.
• Collaborated with development teams across the Secure SDLC to validate critical and high vulnerability fixes via re
scans before release approval, ensuring security sign-off at each stage of the pipeline.

• Recipient of the Best Find of the Year Award, recognised for outstanding contribution to security operations within the
team.
• Investigated security incidents using Sumo Logic SIEM supported vulnerability validation and incident response
coordination.
• Developed detection queries and dashboards to enhance monitoring visibility and reduce alert noise.

• Led end-to-end vulnerability management program for 3, 000+ assets across EU and LATAM regions, applying NIST and
ISO 27001 control frameworks to prioritise and govern remediation.
• Served as escalation owner for critical and high-severity vulnerabilities, driving cross-team response within defined SLA
windows.
• Built Power BI dashboards to track vulnerability backlog, SLA compliance, and risk posture trends presented monthly
reports to governance and CAB stakeholders.
• Guided risk acceptance decisions based on exploitability assessment and business impact analysis.

• Led vulnerability management across 1, 000+ systems in APAC environments covering network and server
infrastructure.
• Performed web application security testing on internal platforms, identifying access control and API security
vulnerabilities coordinated remediation with development teams.
• Supported security testing activities for mobile-enabled applications and backend APIs, identifying access control and
authentication-related vulnerabilities during application assessments.
• Assessed AWS cloud security posture using Pacu and ScoutSuite, identifying misconfigurations across IAM, S3, VPC,
and Security Groups used IAM Access Analyser to detect overly permissive policies and implemented least-privilege
hardening.
• Enabled AWS GuardDuty for continuous threat detection and configured API Gateway rate limiting to protect backend
services from abuse and DoS exposure.

• Conducted vulnerability assessments across network and server environments supported remediation validation and
system hardening for Windows and Linux systems.
• Assisted in security monitoring and incident response activities.