Ambuj Kumar

Performed penetration testing on Web, Mobile Android, and API applications following OWASP security standards. Conducted threat modelling for new and emerging products and used Prisma Cloud to enhance the organization’s cloud security posture. Integrated and designed DevSecOps pipelines to include secret detection plus SCA and SAST for earlier identification of risk. Configured security best practices to align with compliance expectations, stayed updated on emerging threats and exploitation techniques, and worked with cross-functional teams to raise security awareness and implement patches to mitigate identified risks.

Conducted vulnerability assessments and penetration testing across web, API, mobile, and cloud environments. Participated in threat modelling for new products and developed proof-of-concepts for multiple EDR solutions, ultimately finalizing CrowdStrike for enterprise-wide deployment. Improved AWS cloud security using cloud-native security solutions and best practices. Built SecureCodeTrack to detect secrets in code and auto-assign issues using Python and Bash, improving detection time. Supported incident response activities with remediation collaboration and integrated security testing into CI/CD pipelines with DevSecOps practices, including automated and manual source code review.

Implemented DevSecOps by integrating SAST and DAST checks (Checkmarx) into Jenkins pipelines to automate CI/CD and enable early threat detection via a shift-left approach. Used Qualys for vulnerability management for a banking client. Strengthened AWS security posture by running regular assessments with Scout Suite and Prowler to reduce misconfigurations and maintain compliance with security standards. Collaborated with cross-functional teams on incident response and reliability improvements while driving continuous improvement in security and cloud practices.