Bhomik Babra

Cybersecurity Engineer / Security Analyst

Innefu Labs

Jan 2022 - Jan 2025

Supported GRC activities including audit evidence collection, policy and control implementation, and audit coordination for compliance frameworks including SOC 2 and PCI-DSS — directly applicable to internal/external audit support. Conducted vendor and third-party risk assessments, reviewing security controls and responding to security questionnaires as part of TPRM processes — core experience for ongoing vendor compliance monitoring. Performed VAPT for web applications, networks, and REST APIs using Burp Suite, OWASP ZAP, Nessus, Metasploit, and Nmap, identifying and remediating critical vulnerabilities including SQL injection and Broken Object Level Authorization (BOLA). Improved AWS/Azure security posture by hardening IAM policies, network security groups, and encryption settings, and by expanding security monitoring and logging coverage — strengthening the technical controls auditors assess under PCI DSS Req. 1, 3, 7, 8, and 10. Monitored and triaged security events using Splunk and Microsoft Sentinel, supporting incident response and providing a practical foundation in log review and security monitoring — a key control area under PCI DSS Requirement 10. Integrated security checks (SAST, DAST, dependency scanning) into CI/CD pipelines, enabling earlier detection of application security issues and reducing the volume of vulnerabilities reaching production.