Web, mobile, API, Active Directory, and wireless testing against OWASP Top 10 and API Top 10, with secure code review and threat modeling baked into the SDLC.
In-house security tooling and automation: a Unified Security Command Center, custom SAST and SCA, external attack-surface monitoring, and pipelines that turn manual work into continuous workflows.
Implementation and audit readiness across ISO 27001, SOC 2, PCI-DSS, GDPR, HIPAA, and DPDPA, with third-party risk, risk registers, and AI governance aligned to ISO 42001.
An internal security platform used org-wide, up to the CEO. It unifies application security, SOC, GRC, compliance, vendor management, and threat intelligence into one dashboard, with automated evidence collection, SAST and SCA scans, external attack-surface monitoring, and Azure DevOps sync.
A self-hosted phishing-simulation and awareness platform. FastAPI and React, shipped as a Docker image.
Embedded SonarQube, Checkov, and ScanCode into Azure DevOps and rolled out threat modeling across three product lines, cutting critical vulnerabilities by roughly 70%.
Surfaced an account-takeover flaw allowing unauthorized password changes across accounts within weeks of joining, then drove containment and remediation.
Vulnerability research on Medium: account takeover via the verification-mail flow, and via a 2FA bypass, explained step by step.
Fifteen active certifications spanning offensive security, red teaming, AI security, cloud, API testing, and audit.
Maharashtra College of Science, Arts and Commerce.