06/29/2026 updated
100 % available
Senior Application Security Engineer | Threat Modeling | Cloud Security | Bug Bounty
Dehradun, India
Only remote
CEH v11 (Certified Ethical Hacker)Production-Quality Security Code
Development of secure Python backends, authenticated REST and GraphQL APIs, encryption logic, and authentication systems serving billions in transactions.
Design Reviews & Threat Modeling
Execution of 100+ design reviews and threat models for new features before engineering starts, eliminating entire vulnerability classes prior to code shipment.
Cloud Security (AWS & Kubernetes)
Hardening of AWS environments including EC2, RDS, S3, IAM, KMS, and Secrets Manager, as well as Kubernetes RBAC, network policies, and pod security configurations.
Web Application Security
Securing of GraphQL and REST APIs using OAuth 2.0, JWT, session management, and CSRF/SSRF injection prevention on platforms handling financial transactions.
Bug Bounty Coordination
Triage of 200+ bug bounty findings, coordination with external researchers, building of remediation workflows, and understanding of exploitation chains.
Vulnerability Assessment & Pentesting
Hands-on penetration testing including identification of injection vulnerabilities, auth bypasses, and business logic flaws, with prioritization of real risk versus noise.
Security Tooling (SAST/DAST)
Building of security testing pipelines covering static analysis, dynamic scans, and penetration testing automation using SAST and DAST tooling.
Compliance Frameworks
Implementation of security controls aligned with SOC 2 Type II, ISO 27001, and FedRAMP requirements, resulting in passed audits.
Security Champions Program
Establishment of security champion programs, training of product teams on threat modeling, and mentoring of security analysts on web vulnerabilities.
Offensive Security
Participation in CTFs, bug bounty programs, and vulnerability research, with CVE-2020-36081 published.
Development of secure Python backends, authenticated REST and GraphQL APIs, encryption logic, and authentication systems serving billions in transactions.
Design Reviews & Threat Modeling
Execution of 100+ design reviews and threat models for new features before engineering starts, eliminating entire vulnerability classes prior to code shipment.
Cloud Security (AWS & Kubernetes)
Hardening of AWS environments including EC2, RDS, S3, IAM, KMS, and Secrets Manager, as well as Kubernetes RBAC, network policies, and pod security configurations.
Web Application Security
Securing of GraphQL and REST APIs using OAuth 2.0, JWT, session management, and CSRF/SSRF injection prevention on platforms handling financial transactions.
Bug Bounty Coordination
Triage of 200+ bug bounty findings, coordination with external researchers, building of remediation workflows, and understanding of exploitation chains.
Vulnerability Assessment & Pentesting
Hands-on penetration testing including identification of injection vulnerabilities, auth bypasses, and business logic flaws, with prioritization of real risk versus noise.
Security Tooling (SAST/DAST)
Building of security testing pipelines covering static analysis, dynamic scans, and penetration testing automation using SAST and DAST tooling.
Compliance Frameworks
Implementation of security controls aligned with SOC 2 Type II, ISO 27001, and FedRAMP requirements, resulting in passed audits.
Security Champions Program
Establishment of security champion programs, training of product teams on threat modeling, and mentoring of security analysts on web vulnerabilities.
Offensive Security
Participation in CTFs, bug bounty programs, and vulnerability research, with CVE-2020-36081 published.
Experience
Professional experience5 - 10 years
Freelancer since2021
Languages
EnglishNative speaker
Project history
Wrote production-quality security code including Python backends, REST/GraphQL APIs, and authentication systems. Designed security controls to eliminate vulnerability classes such as injection, broken auth, and insecure deserialization. Conducted 100+ design reviews and threat models, triaged 200+ bug bounty findings, coordinated third-party security assessments, built secure Python API frameworks, implemented GraphQL security controls, hardened AWS and Kubernetes environments, mentored security analysts, built security tooling pipelines, passed SOC 2 Type II audits, and participated in offensive security activities.
Designed secure API authentication using OAuth 2.0, JWT, and session management for financial transactions. Built Python security libraries for encryption, credential handling, and audit logging. Threat modeled financial APIs, identified SSRF and business logic flaws, conducted pentesting, performed ISO 27001 and FedRAMP compliance work, established security champion programs, and secured AWS cloud environments.
Wrote production-quality security code in Python including API development and authentication. Conducted design reviews and threat models for new products, performed security assessments including manual pentesting and vulnerability finding coordination, built SAST/DAST security tooling pipelines, and engaged in offensive security activities including CTF and vulnerability research.