About
Application Security Engineer with 3.9 years of hands-on experience delivering end-to-end VAPT across Web, Android, API, and Cloud (AWS) environments at HCLTech for enterprise Health, Banking, Entertainment, and E-Commerce clients. Skilled in manual exploitation of OWASP Top 10 and API Top 10 vulnerabilities, going beyond what automated scanners can detect. Recognized by NASA, WHO, RBI, Flipkart, Nokia, Indian Railways, EC-Council, UNESCO, and 50+ global organizations for responsible vulnerability disclosure and inducted into their Hall of Fame programs.
Skills & Expertise (34)
Work Experience
Software Engineer (Application Security)
HCLTech
Aug 2022 - Present
Delivered end-to-end VAPT engagements for enterprise Health, Entertainment and E-Commerce clients, manually identifying and exploiting Business Logic Flaws, Auth bypass, XSS, SSRF, CSRF, IDOR, File upload vulnerability and SQL Injection that automated scanners consistently missed. Executed DAST using Burp Suite Pro and HCL AppScan with thorough false-positive triage; assessed REST APIs against OWASP API Top 10 uncovering BOLA, BFLA, JWT weaknesses, OAuth misconfigurations, and rate limiting bypass. Conducted Android application security assessments using Jadx for static analysis and Frida for dynamic instrumentation identifying SSL pinning bypass, hardcoded secrets, insecure data storage, and vulnerable exported components. Performed deep manual business logic testing exploiting payment validation bypass, price manipulation, coupon abuse, multi-step process bypass, and broken access controls that no automated tool flagged. Participated in STRIDE threat modelling sessions for critical business applications; enforced OWASP Top 10 and GDPR compliance across assessments; maintained monthly vulnerability dashboards to track remediation progress. Produced CVSS v3.1-rated pentest reports with detailed PoC, reproduction steps, and developer-facing remediation advice; mentored junior security analysts and partnered with Dev, DevOps, and QA teams to validate fixes within Agile sprint cycles.
Education
BSc (Computing & Design) - BITS Pilani, WILP
2022 - 2026 · Afghanistan
Intermediate (MPC) - APSWREIS
2019 - 2021 · Afghanistan
Certifications
No certifications added yet
Interested in this developer?
Profile Score Breakdown
Profile Overview
Skills (34)
Click a skill to find developers with the same skill
