SUMMARY

• Over all 10+ years of professional IT Experience in Application Security Testing particularly focused on performing technical activities such as Vulnerability Analysis, Penetration testing, Secure Application Testing based on OWASP TOP 10 and SANS/CWE top 25.
• Conducting scans and appropriate to the developers on coding standards and how to avoid security breaches. Ability to review source code to check for logical errors and flaws in the design and architecture. Understanding of and ability to find security issues such as authorization, authentication and data validation. Plans and directs the implementation and testing of security systems, blueprints the approach to achieving ATO.
• Professional with extensive experience in Information Security, Application Security, Software Security, Entse Vulnerability Management, penetration testing and generating reports using tools.
• Extensive experience in Manual Penetrationtesting - Expertise in detecting various vulnerabilities (including OWASP top 10) comprised over authentication, authorization, input validation, session management, server configuration, cryptography, information leakage areas.
• Experience in implementing security in every phase of SDLC. Have hands-on experience in application security, vulnerability assessments and OWASP along with different security testing tools.
• Vulnerability Assessment includes analysis of bugs in various applications spread across N - tier on various domains by using both manual and Automation tools.
• Experience in different web application security testingusing various tools like HP Fortify SCA,HP Web Inspect, CheckMarx, Nessus, Burp Suite Pro, SecApps.com, OWASP ZAP Proxy,, Kali Linux, Metasploit Pro.
• Implemented Application Security program (DAST and SAST) at the enterprise level to identify, report and remediate security vulnerabilities from applications deployed in DEV, PRE-PROD and PROD environments.
• Performed Dynamic Application Security Testing and Exploitation (UI and Web Services) on web applications using Burp Suite Pro, HP Web Inspect 18.20 utilizing OWASP top 10 Testing Methodology.
• Capable of identifying flaws like Injection, XSS, Insecure direct object, Security Misconfiguration, Sensitive data exposure, Functional level access control, CSRF, Invalidated redirects.
• Hands-on experience in developing Threat models, security controls, threat analysis, and creation of
• Vulnerability Assessment Testing on WEB based applications, Mobile Applications, SOAP APIs, REST API Web Services.
• Identifying the critical, High, Medium, Low vulnerabilities in the applications based on OWASP Top 10 and SANS 25 prioritizing them based on the criticality.
• Involved in recommending security solutions of new applications incorporating secured SDLC, OWASP Top 10 based Vulnerability Assessment of various Internet facing Point of Sale web applications.
• Experience in Performing Static Application Security Testing (SAST) and secure code review (SCR) and Quality Code Review(QCR) of various domain applications using static code analyzer (SCA) like HP FORTIFY.
• Sound knowledge and industry experience in Vulnerability Assessment and Penetration Testing on WEB based Applications, Mobile based application and Infrastructure penetration testing.
• Monitored and mitigated threats from intrusion detection systems, firewall logs, proxy logs, Security Risk Management with TCP-based networking and user reports.
• Create Detailed assessment reports which accurately describe identified security weakness, potential business risk, prioritize mitigation recommendations.
• Help develop improve methodology, processes, infrastructure, tools and deliverables that contribute to the ongoing enhancement of the company's vulnerability assessment capabilities.
• Ability to handle multiple tasks and work independently as well as in a team with excellent capacity to adapt new technologies and skills.

PROFESSIONAL EXPERIENCE

Confidential, MD

Application Security Engineer

Responsibilities:

• Conduct regular briefings with the customer on cybersecurity status, including preparing briefing materials. Work closely with government Information Assurance team to support Authorization to Operate (ATO) accreditation conditions and requirements. Coordinate and support site visits / audits, including System Readiness Reviews (SRR).
• Author, review, coordinate and submit required artifacts to eMASS (including change requests) to achieve milestones such as Interim Authority to Test (IATT) and ATO in accordance with the project schedule. Submit and gain approval of Ports, Protocols and Services Management (PPSM) updates, including Further Action (FA) form submissions.
• Conducted secure code analysis for application code. Supported risk assessments and application security resolution plans. Implemented threat modeling and formulated application security procedures. Participated in sessions for coding practices. Executed and managed projects relating to application security. Designed, developed and implemented information security programs. Provided technical support services in code reviews and static analysis.
• Creating Biweekly sprint stories based on Agile Methodology and working accordingly.
• Conducting Vulnerability Assessment of Web Applications, Web Services(SOAP and Rest API’s).
• Attending stand up meetings every alternate day to review the story progress.
• Perform SCA testing has been performed to identify XML External Entity (XXE), Cross-Site Scripting and SQL Injection related attacks within the Developed Source code using HP Fortify SCA 18.20, Nessus, Checkmarx
• Worked extensively with software development teams to review the source code, triage the security vulnerabilities generated by HP Fortify, HP Web Inspect, OWASP ZAP and Burp Suite, and eliminated false positives.
• Creating POC(Proof of Concept) and explaining to developers on how an attacker can able to exploit the detected vulnerabilities like SQL Injection, XSS,CSRF etc. during the Application Security Testing.
• Identifying the critical, High, Medium, Low vulnerabilities in the applications based on OWASP Top 10 and prioritizing them based on the criticality.
• Security Testing of Different Web Services (REST API’s and SOAP) using POSTMAN, Burp suite Pro.
• Vulnerability assessment for applications used in the organization using Burp Suite Pro, OWASP ZAP and HP Web Inspect.
• Experience in using Kali Linux to do web application assessment with tools like Dirbuster, SQLMAP and Nmap.
• Experienced in Setting up HP Fortify Plugins in Jenkins to Automate the Source Code Analysis(SCA) Scans.
• Experienced in Integrating Functional Selenium Test Case Scripts with OWASP ZAP and Burp Suite Pro tools to automate the Dynamic Application Security Testing(DAST).
• Worked with DevOps team to automate the Security Testing by creating Jenkins Jobs.
• Creating Detailed Documentation on how to automate the Security Testing using Jenkins.
• Maintained network performance by performing network monitoring and analysis, performance tuning, troubleshooting network problems.
• Designing, developing, engineering, and implementing specific application workflow security testing Java/PowerShell scripts using Web Inspect and Burp Suite (scripts will include coverage of Source Code, UI, Web Services, and Database) to test security controls and validate their effectiveness against external threats.
• Expert in using various tool provided by HP Web Inspect product (Site Explorer, Encoders/Decoders, SQL Injector, Web Service Designer, Reg Ex Editor, Server Analyzer, and Proxy) to analyze the Vulnerabilities

Environment: Java, .net, Fortify, Nessus, Rational, Jira, Git, TFS

Confidential

Information Security Analyst

Responsibilities:

• Perform web application penetration testing and vulnerability assessments.
• Be familiar with and adhere to the rules of engagement for all projects.
• Attending kick-off meetings for all assigned projects.
• Provide scoping data to assist in developing project proposals.
• Create detailed assessment reports which accurately describe identified security weaknesses,
• Potential business risks prioritize mitigation recommendations.
• Present and clearly communicate findings and recommendations to the senior management, andTeam members.
• Help develop improved methodology, processes, infrastructure, tools, and deliverables that
• Contribute to the ongoing enhancement of the company’s vulnerability assessment capabilities.
• Creating scoping Document to perform various penetration testing for web applications andmobile applications.
• Perform manual penetration testing using proxy tools like Burp Suite, Owasp ZAP, Nesus, Nmap for web and mobile applications.
• Conducted applicationpenetrationtesting for various business applications throughagile methodology.

Confidential

Web Application Security Engineer

Responsibilities:

• Performed External and Internal black box and white box Penetration Testing.
• Perform software security assessments, vulnerability assessment scans and penetration tests, and compliance evaluation to determine system security status and adherence to security policy and standards.
• Significant exposure designing application and security tools architecture, and implementing and configuring them in line with security guidelines.
• Possess good knowledge of OWASP top 10, SANS (CWE) Top 25 to perform application security assessments.
• Knowledgeable of PCI, SOX, HIPAA standards to effectively drive security initiatives and projects.
• Performed Information Security Risk Threat Assessments
• Implemented and utilized Open Web Application Security Project’s (OWASP) Top Ten issues as the core frame work for projects.
• Creation of Comprehensive Information Security Programs
• Code review of many mission-critical web applications based on OWASP Code Review Project
• Internal and DMZ server’s security assessment
• Categorize the assessment in various categories like Input & Data Validation, Authentication, Authorization, Session Management, Exception Management, Cryptography, Auditing & Logging
• Good experience in Web technologies like HTTP, HTML, CSS, Forms, Database Connectivity.
• Using various Firefox add-ons like Flag fox, Wappalyzer, Live HTTP Header, Tamper data to perform the pen test
• Updating of the checklist on weekly basis to ensure all the test cases are up to date as per the attacks happening in the market
• Metasploit to exploit the systems through Kali Linux OS.
• Initiative to stream line the access control mechanism of various applications.
• Preparation of risk register for the various projects in the client by performing risk assessment using NIST framework and quantitative approach
• Using DREAD methodology during the report writing to provide risk ratings.
• Identified issues on sessions management, Input validations, output encoding, Logging, Exceptions, Cookie attributes, encryption, Privilege escalations.
• Official web site black-box penetration testing
• Instructing secure programming course based on OWASP Guide titles.

Environment: Java, .Net, Oracle DBA.

Confidential

Security Analyst

Responsibilities:

• Lead, Manage, Plan, Support and Implement the Secure Coding Program
• Manage and Assign security testing projects to Security Testing Team members
• Provided the tests both in black-box and white-box
• Manage Security Testers and Secure Coding Developers.
• Oversaw security controls, implementing 853 controls as per NIST/MSA compliance to ensure no penalty for missing any compliances.
• Create, Design and Implement all Security Test Plans for project and base Security Testing Develop and Document Application Security Testing requirements, guidelines and standards
• Develop and Document all Secure Coding requirements, usage, guidelines, standards and processes
• Identify the configurational findings using tools like Nmap, NSE (NMap Script Engine), Nessus).
• Develop, Document and Execute all Test Cases for Security Testing
• Utilize and Implement OWASP Top Ten issues, WASC and CWE’s into Security Testing efforts
• Develop and Document Procedures and Methodology for Security Testing efforts
• Perform Static, Dynamic and Manual Security Testing utilizing OWASP Testing Guide Methodology
• Produce weekly, monthly and quarterly security testing and secure coding status reports
• Lead developers, project team members, executive management and vendors through remediation efforts
• Integrating Threat Modeling and Test Case Strategy development throughout the SDLC
• Producing Monthly Metrics, reporting the state of application security programs and programmers of development teams against requirements
• Track and Record all discovered security testing vulnerabilities into Sharepoint
• Create custom Injection and Scripting attacks for Application Security Testing
• Gathered and analyzed results to make professional reports containing any risk identified and its relevant mitigation measures
• Schedule the pen test for the whole year, also make sure that all the applications are covered in the schedule and completed in the time frame.

Environment: Java Script, Nessus, Python, MySQL, Kali Linux