Headline

Building Secure Financial APIs & Infrastructure | AppSec · WAF · Detection Engineering | Senior Security Engineer @ Decentro

About

I build security systems at a scale most engineers never encounter. At PhonePe, I protect 700M+ user transactions across a distributed fintech platform handling billions of events daily. That means engineering WAF rule sets across Cloudflare, Akamai, and F5 that cut malicious traffic by 45%, architecting a 500-rule detection layer on Elastic Stack that reduced alert noise by 30%, and shipping an in-house WAF on Pingora and Coraza that improved bot fingerprinting accuracy by 48% — all in production, all at scale. But the work I'm most proud of is Barbican — a production AI security orchestration platform I designed from scratch. It exposes SOC tooling as LLM-callable functions via a FastAPI-based MCP server, uses vector embeddings (all-MiniLM sentence-transformers) with FAISS cosine similarity indexing for semantic alert deduplication, and cuts L1/L2 mean-time-to-investigate by ~60%. It's what AI-augmented security actually looks like in production, not in a demo. Before PhonePe, I spent two years at Loginsoft doing deep vulnerability research for Cisco, Juniper, and McAfee — discovering 70+ critical vulnerabilities through Java source code reviews, authoring 6,000+ OVAL rules and custom YARA signatures, and contributing to CVE-credited patches shipped to enterprise customers worldwide. My expertise sits at the intersection of WAF engineering, detection engineering, cloud security, and AI-augmented defense. I work across AWS, GCP, and Azure, and I'm comfortable operating from raw packet analysis and TLS fingerprinting all the way up to compliance frameworks like PCI-DSS, ISO 27001, and SOC2. I write about WAF engineering, detection logic, and AI in security at hackervault.tech. If you're working on hard security problems at scale — or building the next generation of AI-native security tooling — I'd love to connect.

Location

Odisha

AI stack

claude code

claude

gemini

github copilot

n8n

notebooklm

Work experience

Senior Security Engineer at Decentro, Jul 2026 - Present · 4 mos, Bengaluru

Senior Infosec Engineer at PhonePe, Jul 2025 - Jun 2026 · 1 yr, India, Protecting 500M+ user transactions across PhonePe's distributed fintech platform. 1.WAF Strategy & Rule Engineering: Engineered sophisticated rule sets across Cloudflare, Akamai, and F5 ASM/AFM, achieving a 45%+ reduction in malicious traffic and significantly lowering false-positive rates for production APIs. Performed continuous threat modeling and defense-in-depth tuning to block OWASP Top 10, bot, and zero-day threats. 2.In-House WAF Development: Architected and shipped a proprietary WAF leveraging Nginx Ingress Controller, Pingora, and Coraza with custom iRules-style logic; achieved a 48% improvement in bot fingerprinting accuracy and hardened the PhonePe CDN against layer-7 attacks. Deployed in Docker containers with automated CI/CD rollout. 3.AI-Augmented Alert Investigation: Designed and deployed Barbican — a production MCP (Model Context Protocol) server built on FastAPI — to expose security tools as LLM-callable functions for AI-assisted WAF alert investigation. Integrated vector embedding pipeline (all-MiniLM sentence-transformers) with FAISS cosine similarity indexing to enable semantic deduplication and intelligent alert clustering across millions of daily events, cutting L1/L2 mean-time-to-investigate by ~60%. 4.SOC Architecture & Detection Engineering: Designed an Elastic Stack-based SOC with SOAR-integrated playbooks that reduced alert noise by 30% and correlation time by 40%; integrated ML-based anomaly scoring to surface high-confidence threats from billions of daily log events. 5.Zero Trust & API Security: Established hardened API gateways and edge controls aligned with Zero Trust and defense-in-depth principles; enforced mTLS, rate limiting, and bot-scoring at the perimeter for all critical payment endpoints. 6.Performance & Scalability: Optimized WAF rule precedence and evaluation order, improving processing throughput under peak load without degrading latency SLAs.

Infosec engineer at PhonePe, Jul 2023 - Aug 2025 · 2 yrs 2 mos, Bangalore, 1.SOC Architecture & Stack Design: Served as architect of PhonePe's Security Operations Centre — designed and owned the full detection stack: Elastic Stack (ELK) as the core SIEM, Opensearch for log search and analytics, Wazuh for host-based detection and FIM, QRadar for enterprise correlation, Logstash and Rsyslog for log ingestion/normalisation, Filebeat and Vector as lightweight shippers, and SOAR playbooks for automated response — handling billions of events per day at 99.99% pipeline availability across 12,000+ systems. 2.High-Fidelity Detection Rules: Developed 500+ detection rules mapped to MITRE ATT&CK tactics across network, endpoint, and application layers; authored custom Sigma and YARA rules enabling the SOC team to identify attack patterns previously invisible to existing tooling. 3.SIEM Ingestion Pipeline Rebuild: Rebuilt the ELK + Opensearch ingestion pipeline to normalise log schemas from 20+ source systems (Wazuh agents, Filebeat, Rsyslog, Vector) enabling consistent cross-source correlation and real-time SOC dashboarding. 4.Compliance Automation & Drift Detection: Automated patch compliance workflows for 12,000+ systems using Python, Go, and Terraform; delivered hardened OS baselines (RHEL/Ubuntu, Windows) with CIS Benchmarks and implemented drift detection to auto-revert unauthorized configuration changes — improving measurable compliance posture by 60%. 5.Vulnerability Management: Owned the end-to-end vulnerability lifecycle — triaged findings from Nessus/Qualys scans, prioritized remediation based on threat intelligence, and ensured critical CVEs were resolved within defined SLAs across 12,000+ systems. 6.JA4/JA4H Bot Detection: Built a TLS fingerprinting pipeline using JA4 and JA4H signatures that reduced automated abuse attempts on payment APIs by 45% while maintaining zero friction for legitimate users.

software engineer-security researcher at Loginsoft, Aug 2021 - Jul 2023 · 2 yrs, Hyderabad, Enterprise vulnerability research for Cisco, Juniper, McAfee and other Tier-1 vendors. 1.Vulnerability Research (Cisco, Juniper, McAfee): Discovered 70+ critical vulnerabilities through deep Java source code reviews and binary analysis; findings directly resulted in CVE-credited patches shipped to enterprise customers worldwide. 2.VAPT & DAST Tooling: Conducted structured penetration tests using Burp Suite Professional, OWASP ZAP, nmap, and Nikto for web app and network security assessments; identified exploitable attack chains in network device firmware and application layers across enterprise products. 3.YARA & OVAL Rule Development: Authored 6,000+ OVAL rules and purpose-built YARA signatures for malware classification and firmware threat detection; developed custom SecLang detection logic for automated scanning of proprietary binary formats against known vulnerability patterns. 4.Workflow Automation: Built Python and Go tooling to automate policy and compliance workflows, cutting manual analyst effort by 60% and enabling consistent, scalable vulnerability triage across multiple client engagements.

Founder at Mitigater Techsecure Pvt. Ltd., Jun 2020 - Aug 2021 · 1 yr 3 mos, India, Co-founded a security services and training company delivering cybersecurity education, assessments, and secure development solutions. Highlights: > Delivered hands-on training for CEH, Security+, CCNA, Linux, helping students launch cybersecurity careers. > Secured client web-server infrastructures using ModSecurity, DDOS Deflate, Rootkit Hunter, and custom hardening scripts. > Built full-stack web applications (PHP, Python) and integrated secure CI/CD pipelines. > Provided end-to-end consulting on server security, malware protection, and controlled network architecture.

Professional Trainer at Golars Networks, Nov 2019 - Mar 2020 · 5 mos, Hyderabad, Delivered advanced cybersecurity, networking, and cloud training programs for students and corporate clients. Key Responsibilities: > Trained in CEH, ECSA, CISA, including hands-on ethical hacking labs. > Conducted networking training on routing, switching, firewalls, and AWS cloud basics. > Delivered Linux administration training, including server security, permissions, and user management.

Education

Bachelor of Technology - BTech, Electrical, Electronic and Communications Engineering Technology/Technician, Gandhi Institute of Technological Advancements (GITA), Bhubaneswar

hse, Saraswati sishu vidya mandir - bhubaneswar

Public links

hackervault.tech: https://hackervault.tech/