Headline

Security consultant | CISSP | OSCP

About

Staff Product Security Engineer with 11+ years of experience driving AppSec and shift-left security at scale across BFSI, product-based companies, and services organizations. Currently, I lead product security for an enterprise AI platform, focusing on embedding security into CI/CD pipelines, driving a shift-left security approach by integrating controls early in the SDLC, securing AI/ML systems, and enabling engineering teams across multiple services to build secure products. My core focus areas: • Building and scaling AppSec programs (SAST, SCA, DAST, threat modeling) • Driving shift-left security by integrating security into early SDLC phases and CI/CD pipelines • AI security (prompt injection, model risks, data leakage) • Supply chain security (SBOM, OSS compliance, dependency risk) • Security architecture reviews and secure design assessments • Vulnerability management and developer enablement • Leading security tooling evaluations, running structured POCs, and driving vendor selection based on risk, scalability, and ROI Key impact: • Reduced open-source vulnerability backlog by ~60% within 2 quarters • Built and scaled AppSec practices across multiple teams and CI/CD pipelines, improving security coverage and developer adoption • Secured 200+ third-party dependencies via supply chain security initiatives • Embedded automated security gates into CI/CD pipelines • Led AI security efforts covering prompt injection, model risks, and data leakage I’ve worked across web, API, mobile, cloud (AWS), and AI platforms — combining hands-on penetration testing expertise with program-level security ownership. I focus on balancing security with developer velocity, ensuring security becomes an enabler—not a blocker. Open to: • Remote Product Security / AppSec roles If you’d like to discuss product security, AppSec, or AI security challenges, feel free to connect or schedule a quick discussion: https://calendly.com/rahulahuja304/30min

Location

Mumbai

AI stack

cursor

claudecode

Work experience

Security Consultant at GlobalLogic (Hitachi Group Company), Apr 2024 - Present · 2 yrs 5 mos, •​ Own and drive the AppSec program for an enterprise AI Platform — defined secure SDLC processes, security sign-off gates, and developer security workflows across 5+ engineering teams. •​ Manage a team of 4 security engineers; lead threat modeling, security architecture reviews, penetration testing, and vulnerability management across 20+ product services. •​ Drove shift-left security adoption — evaluated 3+ security vendors, onboarded Aikido (SAST, SCA, secret scanning, CI/CD security, IDE plugin, OSS license compliance, vuln reporting) and Snyk (SAST, SCA, container image security); configured pipeline integrations with the DevOps team in Azure DevOps and rolled out IDE plugin to developers. •​ Reduced SCA vulnerability noise by 60% through a risk-based prioritization approach — classified findings by internet-facing vs. internal code and containers, cross-referenced KEV list and EPSS scores to set accurate severities, and fed enriched context into Aikido and Snyk to focus remediation on CVEs that genuinely matter. •​ Introduced container security scanning with Trivy (repo and image scanning) and established OSS license compliance process using Aikido; resolved 50+ license violations reducing legal exposure across the product portfolio. •​ Conducted AI-specific security reviews and threat modeling for LLM-powered features covering prompt injection, model poisoning, training data exfiltration, and adversarial input attack vectors.

Information Security Engineer at Blackhawk Network, Feb 2023 - Mar 2024 · 1 yr 2 mos, Remote, •​ Performed penetration testing on high-traffic e-commerce web apps and GraphQL APIs; identified multiple critical/high vulnerabilities including business logic flaws that bypassed payment controls and authentication mechanisms. •​ Conducted security architecture reviews and threat modeling for new product features; reported findings with actionable remediation steps to product and engineering leads. •​ Enabled shift-left security — integrated Detectify (DAST) and Snyk (SCA) into CI/CD pipelines; authored secure coding standards for development teams. •​ Managed HackerOne bug bounty program — triaged 80+ researcher submissions and reduced mean time to remediation (MTTR) by 30% through tighter SLA enforcement with engineering.

Senior Product Security Engineer at Integral Ad Science, Sep 2021 - Feb 2023 · 1 yr 6 mos, •​ Performed web application penetration testing and code reviews across multiple product services; identified and tracked vulnerabilities through to remediation with development teams. •​ Conducted SCA across 30+ microservices using Snyk; triaged open-source dependency risks and enforced OSS license compliance in collaboration with engineering leads. •​ Ran automated DAST scanning pipelines and supported security architecture reviews for new platform features and third-party integrations.

Security Team Lead at Accenture, Oct 2018 - Sep 2021 · 3 yrs, Mumbai, •​ Conducted web application, thick-client, API, mobile (Android/iOS), and cloud (AWS) security testing engagements for clients across BFSI, retail, and technology verticals. •​ Identified exploitable vulnerabilities across client products; managed end-to-end vulnerability lifecycle including risk rating, mitigation tracking. •​ Worked closely with development teams to explain vulnerabilities, suggest fixes, and verify remediations — bridging the gap between security findings and engineering action.

Senior Security Analyst at Accenture, Oct 2018 - Jan 2021 · 2 yrs 4 mos, Mumbai Area, India

Security Consultant at Aujas Networks Pvt. Ltd, Jan 2018 - Sep 2018 · 9 mos, Mumbai, Maharashtra, India, •​ Conducted web application penetration testing engagements onsite for BFSI clients; documented and reported vulnerabilities with remediation guidance.

Education

Bachelor of Engineering (B.E.), Information Technology, don bosco institute of technology

Bachelor of Engineering, Information Technology, Mumbai university