About
Application Security Engineer with 3.5+ years of experience in Secure SDLC implementation, Web/API security testing, and vulnerability lifecycle management. Experienced in SAST, DAST, and SCA execution, secure code review, and DevSecOps integration using Jenkins. Strong understanding of OWASP Top 10, threat modeling, authentication mechanisms, and risk-based remediation. Passionate about embedding security early in the development lifecycle and collaborating with engineering teams to build secure applications.
Skills & Expertise (31)
Work Experience
Cyber Security Engineer
TCS
Feb 2022 - Present
Performed SAST using Fortify, analyzing and prioritizing vulnerabilities such as Injection, Broken Access Control, Insecure Deserialization, and Sensitive Data Exposure. Conducted DAST using WebInspect Enterprise and Burp Suite, identifying runtime and business logic vulnerabilities in staging environments. Executed SCA using OWASP Dependency Check, mapping vulnerable libraries to CVEs and CVSS v3 risk scores. Integrated SAST and SCA into Jenkins CI/CD pipelines, enabling automated Shift-Left security with severity-based quality gates. Conducted manual secure code reviews focusing on OWASP Top 10 vulnerabilities including SQL Injection, XSS, IDOR, and improper authentication. Provided remediation guidance such as parameterized queries, input validation, output encoding, and secure session handling. Participated in Secure SDLC activities including requirement reviews, security design validation, and pre-release security assessments. Led vulnerability triage sessions, validated false positives, and verified remediation prior to production deployment. Conducted Web and API penetration testing (Gray-box & Black-box) using Burp Suite. Identified vulnerabilities including SQL Injection, XSS, CSRF, SSRF, IDOR, and misconfigurations. Demonstrated proof-of-concept exploitation and assessed business impact. Validated security controls such as TLS configurations, token integrity, and session management mechanisms. Managed end-to-end vulnerability lifecycle including detection, CVSS-based risk prioritization, remediation tracking, and validation. Mapped vulnerabilities to CWE, OWASP Top 10, and MITRE ATT&CK where applicable.
Education
Bachelors Of Engineering - Amaravati University
2018 - 2021 · Afghanistan
Diploma - MSBTE
2015 - 2018 · Afghanistan
Interested in this developer?
Profile Score Breakdown
Profile Overview
Availability Details
Relocation
Open to Relocation
