Headline

Helping engineering teams ship secure software faster through Offensive/Product Security, AI, and Threat Modelling | Cloud • Embedded • IoT

About

I am a Product Security Engineer with 5+ years of experience helping engineering teams build secure products without slowing development. My work focuses on shifting security left, embedding security-by-design into the SDLC, and creating scalable security automation that enables developers rather than blocks them. My areas of expertise include: Security Domains: Product Security, Application Security (AppSec), DevSecOps, Threat Modeling, Red Teaming AI Security & Tooling: Custom LLMs, Agentic AI, GraphRAG, Prompt Injection Defense, Code Property Graphs (CPGs), Agentic AI Security, LLM-Powered Taint Analysis Offensive Security: Web/API/Mobile/Cloud Penetration Testing, IoT/Hardware Security, Protocol Analysis Tools & CI/CD: SAST, DAST, SBOM, CBOM, Jira Automation, Phishing Frameworks (Deepfake/Vishing) Today, I work as a Senior Engineer (Security Dev & Test) at Enphase Energy, where I design developer-first security platforms for cloud-native and embedded systems. Recently, I architected an AI-assisted secure code review solution that integrates directly into developers' IDEs, providing real-time SAST findings and security guidance during code commits. I also leverage custom LLMs, agentic AI, Hybrid RAG, GraphRAG, and Code Property Graphs (CPGs) to automate threat detection, secure code reviews, and vulnerability management. My background combines security engineering with offensive security. I have performed 100+ security assessments across web, mobile, cloud, APIs, and embedded devices, specializing in injection vulnerabilities, remote code execution, authentication flaws, and secure architecture reviews. This offensive mindset enables me to build practical security controls that address real-world attack techniques. Across Enphase Energy, KPMG India, TCS, and Payatu, I have built DevSecOps platforms that integrated SAST, DAST, secure code review, and vulnerability management directly into CI/CD and Jira workflows, reducing manual security triage by more than 90% while improving remediation efficiency. Beyond engineering, I actively conduct security research and have independently discovered and published CVE-2025-56762. I also enjoy sharing research with the security community through conference talks and technical presentations. I am passionate about building security that developers adopt, automating what humans shouldn't have to repeat, and making secure software the easiest software to build. Always open to discussing Product Security, AI Security, Offensive Security, and Security Engineering. 📩 shaunak.chattopadhyay99@gmail.com

Location

Bengaluru

AI stack

antigravity

claude code

gemini

hugging face

ollama

Amazon Q Developer

Work experience

Senior Engineer - Security Test and Development at Enphase Energy, Nov 2025 - Present · 11 mos, On-site, * Architected an AI-assisted secure code review platform integrating directly into developers' IDEs, delivering real-time SAST findings and remediation guidance during code commits. * Engineered a full-stack application to automate the integration of vulnerability findings directly into Jira workflows, significantly streamlining developer triage and reducing manual tracking overhead. * Leveraged agentic AI, Hybrid RAG, GraphRAG, and Code Property Graphs (CPGs) to automate complex threat detection and enhance vulnerability management capabilities across cloud-native and embedded systems. * Led DevSecOps initiatives to embed scalable security controls into CI/CD pipelines, enabling engineering teams to ship secure software faster without blocking deployment velocity.

Senior Security Consultant at Payatu, Jul 2025 - Oct 2025 · 4 mos, Remote, * Executed advanced web application and infrastructure penetration testing, successfully identifying and exploiting critical vulnerabilities including SSTI, RCE, and Stored XSS. * Engineered real-world CTF challenges focused on PKI infrastructure, SSRF, and command injection, while simultaneously conducting independent open-source security research.

Cyber Security Consultant at KPMG India, Apr 2024 - Jul 2025 · 1 yr 4 mos, Bengaluru, * Pioneered AI/LLM security assessments by identifying supply chain risks and prompt injection flaws; partnered with engineering to implement robust LLM guardrails and secure coding standards. * Conducted comprehensive Security Design Reviews and Threat Modeling for IoT products, defining secure architecture baselines across hardware, cloud interfaces, APIs, and mobile applications. * Training team members on niche areas i.e. threat modelling, AI Security, IoT/OT Security and AppSec. * Developed advanced phishing frameworks, utilising Deepfake, AI base Voice Cloning and Vishing. * Designed SIEM use cases for IIoT grade embedded devices and further implemented niche detection techniques specifically for Custom Linux OS.

Associate Consultant at KPMG India, Feb 2023 - Apr 2024 · 1 yr 3 mos, Hybrid, * Integrated SAST tools for Ruby, C, and C++ codebases within CI/CD pipelines, collaborating with developers to prioritize and remediate critical command injection and RCE vulnerabilities. * Designed custom SIEM detection use cases for IIoT embedded devices running custom Linux OS, and developed advanced red team phishing frameworks utilizing deepfake voice cloning. * Collaborated with engineering teams to prioritize and remediate critical issues (e.g., command injection, RCE). * Led Red Team exercises for OT/IT systems, improved incident response playbooks; Provided initial access in multiple engagements via Vishing/Phishing/and advanced Social Engineering technqiues physically as well.

Senior Security Analyst at Tata Consultancy Services, Apr 2022 - Feb 2023 · 11 mos, ‣ Led a team of 4 to gather remediation plans/risk acceptances, and ensure effective communication of solutions to stakeholders via meetings or mail. ‣ Researched, developed & implemented process improvement for clients by creating interactive dashboards & custom automation in the environment. ‣ Created cybersecurity best practice communications to educate staff against breaches, zero-day vulnerabilities & remedial measures through research. ‣ Developed options to advise on prioritization of remediation actions and reconciliation of vulnerability mitigation action date.

Cyber Security Analyst | TCS Digital at Tata Consultancy Services, Aug 2021 - Feb 2023 · 1 yr 7 mos, Bhubaneswar, Odisha, India, ‣ Joined TCS as a Digital Cadre being in the top 0.1% of the hiring drive. ‣ Performed vulnerability assessment scans on the client side to ensure maximum coverage and conducted penetration tests for clients. ‣ Reviewed violations of computer security procedures and supported the remediation plan development as well as the current status of remediation plan execution.

Intern at NCIIPC India (A unit of NTRO), Aug 2020 - Nov 2020 · 4 mos, ‣ The objective of the project was to identify online ICS/SCADA/IoT systems and their vulnerabilities using passive reconnaissance. ‣ Developed a framework that uses APIs (Censys, Shodan, etc) to enumerate ICS/SCADA/IoT devices used by GOI which are vulnerable to foreign threats.

Education

Bachelor of Technology - BTech, Computer Science and Information Technolgy, Siksha 'O'​ Anusandhan University