Matam Raghunandana Soujanya
Cybersecurity Analyst
About
Cybersecurity analyst specializing in Vulnerability Assessment and Penetration Testing (VAPT) across web applications, REST APIs, and network infrastructure. Adept at identifying application and architectural security flaws, performing Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), and strengthening enterprise vulnerability management programs. Streamlined organizational vulnerability posture by analyzing recurring trends, optimizing remediation workflows, and delivering targeted developer security training to reduce repeat findings. Strong advocate of Security by Design, integrating security controls at the foundational stage of development rather than post-production detection. Skilled in Software Bill of Materials (SBOM) analysis and risk evaluation aligned with NIST and MITRE ATT&CK frameworks. Currently pursuing a Master of Science degree in Artificial Intelligence and Cybersecurity at IIT Patna with a focus on AI-driven security engineering and threat detection.
Skills & Expertise (29)
Work Experience
Network Security Intern
Intelliroot Technologies Private Limited
Sep 2022 - Oct 2022
Performed network reconnaissance, service enumeration, and port scanning using tools such as Nmap and Netcat. Performed banner grabbing and version detection to identify vulnerable service versions and potential exploitation paths. Learned and applied fundamental concepts of network protocols (TCP/IP, DNS, HTTP, SMB) during security assessments. Gained practical exposure to TCP/IP networking concepts, packet flow analysis, and protocol behavior during assessments. Worked on network vulnerability assessments and penetration testing under senior security engineers. Performed detailed port scanning and service enumeration using Nmap to identify exposed services and attack surfaces across internal and external networks. Conducted service enumeration for protocols such as SSH, SMTP, FTP, HTTP, and SMB to identify misconfigurations and security weaknesses. Participated in post-assessment debrief sessions to understand risk prioritization and remediation strategies. Simulated real-world attack scenarios under supervision to assess network resilience and identify potential attack paths. Documented technical findings with proof-of-concept evidence and recommended remediation steps.
Software Engineer - Cybersecurity Analyst
KFin Technologies Limited
Jul 2023 - Present
Led Vulnerability Assessment and Penetration Testing (VAPT) engagements in web applications, REST APIs, and network infrastructure. Performed manual business logic testing to identify authorization bypasses and workflow manipulation vulnerabilities not detected by automated tools. Conducted VAPT on 50+ application threat modeling to proactively identify attack surfaces, trust boundaries, and abuse cases. Identified, validated, and documented security vulnerabilities including injection flaws, authentication bypasses and authorization weaknesses vulnerabilities. Conducted authentication and session management testing including MFA bypass and privilege escalation scenarios. Conducted Static Application Security Testing (SAST) using SonarQube and partnered closely with development teams to remediate code-level issues prior to production deployment. Conducted assessment on 20+ applications, preventing high-severity vulnerabilities from reaching production and reducing post-deployment findings by 25%. Performed API security testing on 500+ APIs identifying vulnerabilities including token manipulation, JWT tampering, rate-limit bypass, and IDOR exploitation. Managed and maintained Software Bill of Materials (SBOM) for multiple enterprise applications to track third-party dependency risks. Analyzed vulnerability trends across 15+ assessments, reducing repeat critical findings by 30% through structured remediation tracking and developer training. Executed network penetration tests using tools such as Nessus, Nmap, and Metasploit, simulating real-world attack scenarios to evaluate defensive resilience. Applied NIST and MITRE ATT&CK frameworks to map vulnerabilities to attack techniques and assess risk impact. Performed root cause analysis to identify recurring security gaps and recommended long-term mitigation strategies. Integrated Security by Design principles into development workflows by recommending secure coding practices. Improved vulnerability lifecycle tracking, reducing average remediation time (MTTR) by 20% through structured follow-ups and risk-based prioritization. Developed Python automation scripts to streamline vulnerability validation, reducing manual verification time by 40%. Worked on the security assessment programs by AWS, to review the organization architecture and controls to strengthen the AWS Security Posture. Contributed to remediation governance by tracking vulnerability lifecycle metrics and ensuring timely closure in alignment with organizational risk thresholds. Detailed technical and executive-level reports prepared summarizing risk impact, exploitability, and prioritized mitigation recommendations. Conducted trainings to developers on the secure coding practices and vulnerable flows in application, to help them understand the vulnerability posture and reduce the occurrence of vulnerabilities and ensuring performance optimization. Explored AI-assisted vulnerability detection approaches to improve accuracy and reduce false positives in assessment workflows.
DigiLABS - Foundational Project
Singapore International Foundation
Feb 2023 - Apr 2023
Conducted a comprehensive cybersecurity risk assessment for a simulated healthcare organization, analyzing real-world hospital cyberattack case studies to identify systemic security gaps. Designed an organizational access control model implementing role-based access principles to minimize unauthorized data exposure across clinical and administrative roles. Applied the NIST Risk Management Framework to map healthcare-specific threats including ransomware, DDoS, IoT botnets, and SQL injection to risk scenarios. Developed a structured risk register identifying vulnerabilities such as weak authentication, unpatched systems, misconfigured firewalls, and open relay exposure. Conducted scanning and network analysis to identify exposed services and potential attack vectors within healthcare infrastructure. Proposed incident response and recovery strategies aligned with critical infrastructure protection guidelines to enhance operational resilience.
DigiLABS - Accelerator Project
Singapore International Foundation
Apr 2023 - Jun 2023
Worked country-level research analyzing the national cybersecurity ecosystem, regulatory landscape, and government cyber risk messaging initiatives. Evaluated national cybersecurity initiatives including CERT-In, NCIIPC, Cyber Surakshit Bharat, and Personal Data Protection frameworks to assess institutional readiness and resilience. Analyzed government cyber awareness campaigns focused on financial fraud, phishing, ransomware, and cyber hygiene to assess communication effectiveness. Assessed incident statistics and national response mechanisms to evaluate improvements in cyber maturity and global cybersecurity rankings. Developed strategic recommendations to enhance cyber risk communication, public awareness, and policy alignment with critical infrastructure protection goals.
Education
Master of Science in Artificial Intelligence and Cybersecurity - Hybrid Mode - Indian Institute of Technology, Patna
2026 - 2027 · Afghanistan
Bachelor of Engineering in Electronics and Telecommunication - Dayananda Sagar College of Engineering, Bengaluru
- 2023 · Afghanistan
