SUMMARY

• An Lead Information Security Professional with experience of around 10 years in Application Security, Security Architecture & Design, SAST and DAST, Cyber Security Audits, Penetration Testing, AWS Cloud Security, Secure Coding, Mobile Application Security, Security Information Event Management (SIEM), Database Activity Monitoring (DAM), Security Controls and Validation, IT Risk Assessments, Regulatory Compliance and Secure Software Development Life Cycle (secure SDLC).
• Experience using a wide variety of security tools to include Kali - Linux, Metasploit, HP WebInspect, HP Fortify, Burp Suite Pro, Wireshark, L0phtcrack, Snort, Nmap, Nmap-NSE, Cain and Abel, Nitko, Dirbuster, IBM App Scan, OWASP ZAProxy, Nessus, OpenVAS, W3AF, BeEF, Etthercap, Maltego, Wifi-Security, SIFT, SOAP UI, FOCA, Havij, Recon-ng, Aircrack-ng suite,
• Highly analytical computer security analyst with success both defending and attacking large-scale enterprise networks.
• Involved in implementing and validating the security principles of minimum attack surface area, least privilege, secure defaults, avoiding security by obscurity, keep security simple, Fixing security issues correctly.
• Experience in conducting IT Security Risk Assessments in accordance to NIST and FFIEC framework.
• Analyze the results of penetrations tests, design reviews, source code reviews and related security tests. Decide on what to remediate and what to risk accept based on security requirements.
• Strong knowledge in Manual and Automated Security testing for Web Applications.
• Working knowledge of OWASP Top 10 and SANS Top 25 software guidelines, Federal Financial Institutions Examination Council's (FFIEC) regulations, including Payment Card Industry (PCI-DSS), HIPAA and Sarbanes-Oxley Section404 (SOX).
• Analyze the results of penetrations tests, design reviews, source code reviews and other security tests. Decide on what to remediate and what to risk accept based on security requirements.
• SOX Compliance Audit experience on controls like User access management, Change Management, Incident Management.
• Working experience with Imperva and AWS Cloud Security in implementing Web Application Firewalls (WAF).
• Good Experience in exploiting the recognized vulnerabilities.
• Experience in Threat Modeling during Requirement gathering and Design phases.
• Experience with Security Risk Management with TCP-based networking.
• Experience with TCP/IP, Firewalls, LAN/WAN.
• Experience in implementing Security Incident and Event Management System (SIEM) using HP ArcSight, Splunk.
• Quick Learner, Committed team player with interpersonal skills and enjoy challenging environment with scope to improve self and contribute to the cause of the organization.
• Excellent problem-solving and leadership abilities.
• Experience in Web UI Development implementing web development tools like HTML 4.0/5, XHTML, DHTML, CSS/CSS3, JavaScript, jQuery, AJAX, JSON and XML.
• Knowledgeable about Document Object Model (DOM) and DOM Functions along with experience in Object Oriented Programming Concepts, Object Oriented JavaScript and Implementation.
• Technical Skills:

TECHNICAL SKILLS

Network Enumeration: Maltego, Google Hacking, DNS, SMB, LDAP.

Port/Vulnerability Scanning: Nmap/Nmap Scripting Engine (NSE), Netcat, Nessus

Sniffing/Man-in-the-Middle: Wireshark, Ettercap, Cain

Web Application Vulnerability Scanning: , Nessus, OpenVas, Vega, Acunetix, HP Web inspect, IBM AppScan, Qualys guard.

Server/Client-Side Exploitation: Metasploit, Social Engineering Toolkit (SET).

Password Cracking: Hydra, Medusa,Rainbow Crack, 0phcrack, John the Ripper, Pyrit

Web Application: Manual SQL Injection, Manual Cross Site Scritping(XSS), Cross site request forgery(CSRF), SQLMAP

Debuggers: Ollydbg, WinDBG.

Wireless: Aircrack-NG Suite and Kismet

Security Tools: IBM AppScan Enterprise (ASE), Standard & Source editions, HP WebInspect, QualysGuard, BurpSuite Pro, Acunetix, Fortify SCA, SQLMAP. CHEKMARX ( Code Analysis) AppDetect, AppRador, Oracle Identity Manager, Oracle Access Manager,JHijack, Metasploit Pro, ZED attack proxy, Firemon, SQLMAP, Wireshark, WebScarab, Paros, BlueCoat Proxy, Nmap, BMC BladeLogic, BlueCoat Proxy, Nessus, Rapid7, Nexpose, Tripwire, Symantec Vontu, DBProtect, ArcSight SIEM, e-DMZ Password Auto Repository (PAR), Varonis, Amazon Web Services (AWS) Cloud security.

Programming Languages: Java, J2EE, JSP, Servlet, .NET, C, C++, C#, NodeJS

Scripting Languages: Python, Ruby, Basic shell Scripting

Web Technologies: HTML 4.0/5, XHTML, DHTML, CSS2/CSS3, JAVASCRIPT, AngularJS, ReactJS, JQUERY, AJAX, JSON and XML AJAX, HTML, XML, SOAP.

Web Services: RESTFul/SOAP, SOA, UDDI, WSDL

Operating System: Linux/Unix (Red Hat Enterprise Linux, Debian, Ubuntu, Fedora, Santoku, Kali Linux), Windows. Windows, i5/OS, z/OS, AIX.

PROFESSIONAL EXPERIENCE

Lead Security Engineer/ Consultant

Confidential, San Diego, CA

Responsibilities:

• Conducted Vulnerability Assessment (DAST and SAST) of Web and Mobile (iOS and Android Applications, including third party applications. The tools IBM AppScan, ZAProxy, BurpSuite Pro have been utilized for scanning the applications.
• Skilled using Burp Suite Pro, HP Web Inspect, IBM AppScan Standard, Source and Enterprise, NMAP, Dirbuster, Qualysguard, Nessus, Nexpose, Rapid7, SQLMap for web application penetration tests and infrastructure testing.
• Performed pen testing of both internal and external networks as per PCI-DSS standards. The pen testing scope included O/S (Windows and Linux) and external facing web apps and database servers that store credit card information.
• Working knowledge of OWASP Top 10 and SANS Top 25 software guidelines, Federal Financial Institutions Examination Council& (FFIEC) regulations, including Payment Card Industry (PCI-DSS), HIPAA and Sarbanes-Oxley Section404 (SOX).
• Participated in the development of IT risk assessments for enterprise applications. The NIST framework has been utilized for IT risk assessments.
• Conducted security assessments of firewalls, routers, VPNs, Switches, BlueCoat Proxy, IDS/IPS and verified its compliance to internal and external security standards
• Supported day-to-day monitoring of logs and alerts from firewalls, log management, intrusion detection systems and content filtering controls, etc. and also Performed forensic analysis and investigation of log alerts and malware.
• Performed monitoring, research, assessment and engineering analysis (Security Operations Center) on Web Application Firewalls (WAF), Intrusion Detection and Prevention (IDS/IPS), Data Loss Prevention (DLP) tools as well as Anomaly Detection systems, Firewalls, Antivirus systems, proxy devices (HP ArcSight, Tripwire, Varonis, Palo Alto Networks, etc.) and responded to security incidents.
• Designed and implemented Endpoint Security solutions in an enterprise environment. Endpoint security systems including intrusion protection solutions
• Conducted IT security risk assessments including, threat analysis and threat modeling (STRIDE, DREAD).
• Participated in forensic analysis in identifying internal fraud and investigations.
• Working knowledge of AWS Cloud Security in implementing Web Application Firewalls (WAF).
• Implemented security controls for AWS Virtual Private Clouds (VPCs), EC2 instances, RDS and Route53.
• Performed code analysis with CHECKMARX and Served as a Subject Matter Expert (SME) in the field of application security.
• Experience in implementing Security Incident and Event Management System (SIEM) using HP ArcSight.
• Performed the configuration of security solutions like RSA two factor authentication, Single Sign on (SSO), Symantec Vontu DLP and log aggregation and analysis using HP ArcSight SIEM..
• Performed the review of a newly implemented Security Incident and Event Management (SIEM) system.
• Reviewed technical specifications for SIEM, logging and proposed recommendations to improve the overall deployment of the solution.
• Working experience with Automated Security testing for Web and mobile Applications to find the vulnerabilities
• Implemented Secure Software Development Life Cycle (S-SDLC) processes; developed secure coding practices for web, mobile applications, including database and middleware systems.
• Managed vulnerability assessments and coordinate remediation’s by acting as a liaison between the Information Security and Development teams
• Triaged security vulnerabilities to eliminate false positives and worked with the developers for remediation.
• Acquainted with various approaches to Grey & Black box security testing.
• Hands-on with Database Activity Monitoring (DAM) and vulnerability scanning using Imperva Scuba.
• Implemented Imperva Scuba database activity monitioring (DAM) tool to scan database servers(Oracle, SQL Server, MYSQL) across the enterprise.
• Deployed and scheduled database scanning for all enterprise database servers using Imperva Scuba.
• Developed Security API and deployed to development teams which helps them write lower risk applications in a secure manner.
• Extensively worked with security assessments, risk analysis, recommend security requirements, participate in code reviews, provide security defect remediation guidance, and served as a consultant to other business units while acting as an Application Security Subject Matter Expert (SME)
• Developed security policies and standards and made sure the business applications are in compliance with the standards.
• Implemented Single Sign-on (SSO) deployments.
• Identifying the critical, High, Medium, Low vulnerabilities in the applications based on OWASP Top 10 and SANS 25 and prioritizing them based on the criticality.
• Proficient in understanding application level vulnerabilities like XSS, SQL Injection, CSRF, authentication bypass, cryptographic attacks, authentication flaws etc.
• Conducted security assessment of PKI Enabled Applications
• Performing onsite & remote security consulting including penetration testing, application testing, web application security assessment, onsite internet security assessment, social engineering, wireless assessment, and IDS/IPS hardware deployment.
• Strong understanding of IP networking concepts and SSL/TLS, TCP/IP protocols
• Capturing and analyzing network traffic at all layers of the OSI model.
• Monitor the Security of Critical System (e.g. e-mail servers, database servers, Web Servers, Application Servers, etc.).
• Change Management to highly sensitive Computer Security Controls to ensure appropriate system administrative actions, investigate and report on noted irregularities.
• Conduct network Vulnerability Assessments using tools to evaluate attack vectors, Identify System Vulnerabilities and develop remediation plans and Security Procedures.
• The experience has enabled me to find and address security issues effectively, implement new technologies and efficiently resolve security problems. With having strong Network Communications, Systems & Application Security (software) background looking forward for implementing, creating, managing and maintaining information security frameworks for large scale challenging environments.

Sr. Information Security Consultant

Confidential, NC

Responsibilities:

• Conducted Vulnerability Assessment for various applications.
• Performed security assessments to ensure compliance to firm’s security standards (i.e., OWASP Top 10, SANS 25). Specifically, security testing has been performed to identify XML External Entity (XXE), Cross-Site Scripting,ClickJacking and SQL Injection related attacks within the code.
• Skilled using BurpSuite, App Scan, Checkmarx, HP Fortify, Nexpose, Rapid7, NMAP, Havij, DirBuster for web application penetration tests.
• Conducted security assessment of Cryptography applications including the apps that use Hardware Security Model (HSM).
• Working knowledge of AWS Cloud Security in implementing Web Application Firewalls (WAF).
• Experience in implementing Security Incident and Event Management System (SIEM) using HP ArcSight.
• Worked with software development teams, DB/Unix administrators and solution architects as a subject matter expert related to security compliance with PCI DSS and industry standards.
• Interviewed various IT staff, obtained supporting documents to evidence the existence of actual security controls as per both internal and external standards (NIST, CIS).
• Provided Technical Support to the team and worked with various information technologies like network devices, operating systems, endpoint security systems such as intrusion protection, antivirus solutions, and information security technologies.
• Administered Maintained, and Deployed Imperva web application firewall, Checkpoint IPS & VPNsystems, and McAfee network based Data Loss Prevention (DLP) devices.
• Administered Maintained, and Deployed Imperva web application firewall, Checkpoint IPS VPN systems, and McAfee network based Data Loss Prevention (DLP) devices.
• Extensive work experience with IP networking concepts and DNS, DHCP, NTP, HTTP, FTP, SSH, TLS/SSL, IPsec, RADIUS, Kerberos, LDAP, SNMP, SQL,VPN, NAT, PKI TCP/IP protocols.
• Performed the penetration testing of mobile (Android and iOS) applications, specifically, APK reverse engineering, traffic analysis and manipulation, dynamic runtime analysis was performed.
• Implemented HP ArcSight ESM including, correlation rules, data-monitors, reports, event annotation stages, case customization, active lists, and pattern discovery.
• Performed pen testing of both internal and external networks. The pen testing scope included O/S (Windows and Linux) and external facing web apps and database servers that store customer confidential information.
• Participated in Web Application Security Testing including the areas covering Mobile, Network, security, WIFI.
• Conducted pen testing for the Web Services (SOA) used by various travel agency partners to connect to Wyndham for booking and reservations.
• Generated and presented reports on Security Vulnerabilities to both internal and external customers.
• Security assessment of online applications to identify the vulnerabilities in different categories like Input and data Validation, Authentication, Authorization, Auditing & logging.
• Vulnerability Assessment of various web applications used in the organization using Burp Suite, and Web Scarab, HP Web Inspect.
• Experience with Identity and Access Management (IAM) and development of user roles and policies for user access management.
• Analyzed correlation rules developed for Security Incident and Event Management (SIEM) system. Reviewed the solution implemented for “log forwarding” from various network devices to ArcSight central logging for alerting and security monitoring.
• Training the development team on the most common vulnerabilities and common code review issues and explaining the remediation.
• Follow up and ensure the closure of the raised vulnerabilities by revalidating and ensuring 100% Closure.
• Developed security policies, procedures and standards and ensured that the respective teams within the organization comply with it.
• Update with the new hackings and latest vulnerabilities to ensure no such loopholes are present in the existing System

Information Security Consultant

Confidential, Chicago IL

Responsibilities:

• Extensive Interaction with Onsite Coordinator in understanding the business issues, requirements, doing exhaustive analysis and providing end-to-end solutions.
• Conducting Web Application Vulnerability Assessment & Threat Modeling, Gap Analysis, secure code review on the applications.
• Conducted security assessments of firewalls, routers, VPNs, BlueCoat Proxy, IDS/IPS and verified its compliance to internal and external security standards.
• Doing multiple level of testing before production to ensure smooth deployment cycle.
• Creation of Generic Scripts for testing and reusability.
• Application Security Review of all the impacted and non-impacted issues.
• Providing guidance to Development team for better understanding of Vulnerabilities.
• Assisting customer in understanding risk and threat level associated with vulnerability so that customer may or may not accept risk with respect to business criticality
• Identifying the critical, High, Medium, Low vulnerabilities in the applications based on OWASP Top 10 and SANS 25 and prioritizing them based on the criticality for remediation.
• Assisting in review of solution architectures from security point of view which helps avoiding security related issues/threats at the early stage of project
• Ensuring compliance with legal and regulatory requirements.

Confidential

Web developer

Responsibilities:

• Developed company's principal Website, the lead generation mechanism for selling insurance over the Internet.
• Developed complete front & back end using JSPs & Servlets, Java Beans.
• Designed and developed effective internal Web applications, relational database and stored procedures to analyze and monitor all activities related to Web-based sales.
• Developed application presentation layer, which is based on Spring MVC framework involving JSP, Servlets and HTML, CSS.
• Involved in implementing SOAP as well as RESTful web services using WSDL, SOAP, JAX-WS, JAX- RS, SOAP UI and JERSEY.
• Developed this web application to store all system information in a central location. This was developed using Spring MVC, jQuery, JSP, Servlet, Oracle 10g, HTML and CSS.
• Automated sales monitoring and credit/identity verification application processes, decreasing costs and improving quality.
• Created documents related to System Development Life Cycle (SDLC) deliverables.
• Assisted in business process design and documentation as needed for new technology solution implementations.