ENGAGEMENT FILE · SMK-0011 / CLEARANCE: ██████

I find the way in, so attackers don't.

Information Security Engineer with 11+ years in penetration testing, cloud security and DevSecOps. These days I build the security tooling that watches over AI systems before they ship.

./view-tooling résumé.pdf ↓

role: Penetration Tester, AI Security
org: IBM Consulting
loc: Chennai, IN · UTC+5:30
status: open to security roles

guest@smk: ~ (interactive) TRY ME

$ cat scope.yml

Rules of engagement

I break applications for a living, with permission and on purpose. Over 11 years I've worked through penetration testing, red-team operations, cloud security audits and DevSecOps pipelines. Most recently at IBM, my focus has moved to a newer problem: securing the AI coding assistants and browser AI tools that teams are adopting faster than anyone can review them.

I'd rather ship a working control than write another finding nobody fixes. So alongside assessments, I design and build the tooling myself: DLP browser extensions, proxy-based interception, drift detection. Security as software to maintain, not a report to file.

# scope.yml · engagement: career
in_scope:
  - web, API & mobile pentesting
  - cloud security (AWS)
  - AI / LLM red-teaming
  - DevSecOps & secure SDLC
  - security tooling, built and shipped
out_of_scope:
  - findings nobody fixes
  - "the model is the security boundary"
testing_window: 2014 → present
authorization: signed

0+years in security

0companies & teams

0+apps under drift monitoring

0verified credentials

$ ./killchain --map skills

Kill chain coverage

Skills laid out the way an engagement runs, from first recon to the fix landing. Hover a column to trace it.

TA01Recon & threat modeling

Threat modeling

Attack surface mapping

Security & Privacy by Design reviews

Black-box & grey-box scoping

TA02Exploitation

Burp Suite Professional

OWASP ZAP

Web, API, mobile & thick-client

Red teaming

TA03Cloud & pipeline

AWS: IAM, S3, EC2

Kubernetes & Docker

CI/CD security: Jenkins, GoCD

Infrastructure-as-Code review

TA04AI / LLM security

Prompt injection testing

LLM red-teaming & governance

MCP (Model Context Protocol)

watsonx, OpenAI & Claude APIs

TA05Report & remediate

Checkmarx, Veracode, Snyk, SonarQube

Compliance & risk reporting

Fix verification with engineering

Python, Flask & REST tooling

$ ls -la ~/tools/

Security tooling, shipped

Controls built as working software, not slide decks. Details on request.

TOOL-01 SHIPPED

Sentinel

AI security · data loss prevention

Browser extension that stops sensitive data from reaching AI tools.

Chrome MV3
Flask

TOOL-02 INNOVATION REVIEW

Duskguard

AI security · interception

Proxy-based guardrail against data leaks through AI coding assistants.

mitmproxy
Python

TOOL-03 70+ APPS

Drift Sentinel

Supply chain · drift detection

Catches unauthorized changes to applications after security sign-off.

SBOM
watsonx

FINDING-04 SEVERITY: HIGH

AI assistant red-team

LLM red-teaming · prompt injection

Adversarial testing of an internal AI assistant. High-severity issue found and reported.

recon
inject
escalate
report

$ git log --graph career

Engagement log

Six teams, newest first. Open a commit for the details.

a1f9c2e Penetration Tester, AI Security IBM · Chennai Jun 2022 → now

Lead AI and innovation work across IBM Consulting's security practice, designing watsonx, OpenAI and MCP-integrated tools for vulnerability triage, risk classification and compliance reporting. Run black-box and grey-box testing and Security & Privacy by Design reviews across internal platforms.
7d03b81 Senior Consultant, Application & Cloud Security Cognizant Dec 2020 → Jun 2022

Led penetration testing and risk analytics across web, mobile and API platforms. Ran AWS security assessments covering IAM, network controls, S3, encryption posture and Infrastructure-as-Code.
e42c6f0 Deputy Manager, Red Team & Security Operations Axis Bank · Mumbai Apr 2019 → Dec 2020

Built a red-team capability from scratch for a major financial institution. Integrated SAST and DAST into CI/CD and built risk and compliance dashboards for leadership.
39ba5d4 Consultant, Application Security Aujas Networks · client Axis Bank Nov 2017 → Mar 2019

Application security testing across web, mobile, thick-client and web-service platforms, with emphasis on payment gateways and transaction flows.
c8e17a9 Senior Security Engineer Newt Global · client Verizon Nov 2016 → Nov 2017

Black-box and grey-box application security assessments. Documented findings and verified fixes with engineering teams.
0b5e2d1 Security Analyst / Junior Research Analyst CSS Corp & Comodo Apr 2014 → Oct 2016

Monitored security logs, analyzed vulnerabilities and performed static malware analysis for threat research and detection signatures.
000000 init: B.E. Computer Science, GKM College of Engineering