Headline

I make products secure by shift-left. Lead Application Security Engineer | Cloud Security · AppSec · AWS · AI/LLM · Bug Bounty Management · OSCP

About

I am a Senior Product Security Engineer specializing in securing Applications, Cloud (AWS), and AI-driven platforms at scale. My work sits at the intersection of security engineering, product architecture, and business risk strategy. I partner closely with Product, Platform, and SRE teams to embed security early in the SDLC — ensuring teams ship fast without compromising resilience. Over the years, I’ve led initiatives across: • Application Security (SAST, DAST, IAST, SCA, Secure Code Reviews) • Threat Modeling (STRIDE) & Secure Design Reviews • Cloud Security (AWS IAM, GuardDuty, Macie, Inspector, CloudTrail, CSPM) • AI/LLM Security Assessments • Bug Bounty & Vulnerability Disclosure Programs • Enterprise Vulnerability Management & Risk Prioritization At G-P, I reduced pre-production security risk by 60% by shifting vulnerability management from severity-based to business-impact-driven prioritization. I also led adoption of CSPM across AWS Organizations, driving remediation of 200+ critical findings through structured ownership and cross-functional alignment. Previously at Mastercard, I scaled the Bug Bounty Program, strengthened remediation SLAs, and conducted advanced penetration testing across web, API, mobile, and cloud environments. I’m OSCP-certified and bring a strong offensive foundation, but my core strength lies in translating technical risk into clear business decisions. I’m known for maintaining clarity during high-severity incidents and building trust with engineering leadership. Beyond enterprise security, I build security automation tools (Python), contribute to the security community, and speak at conferences on AWS security and bug bounty insights. My mission: Make security a business enabler, not a bottleneck. Focus areas: Product Security Leadership | Cloud & AI Security | Secure SDLC | Security Automation | Risk Strategy

Location

Indore

AI stack

claude code

claude

cursor

gemini

geminicli

opencode

Work experience

Lead Application Security Engineer at PropertyGuru Group, Mar 2026 - Present · 6 mos, Within first 30 days, reduced unpatched critical vulnerabilities from 18 to 4 (78% decrease) by triaging the existing vulnerability backlog in VM and reassigning highest‑risk findings to engineering owners with specific remediation deadlines. Completed threat modeling for 2 newly planned features (AI‑assisted property search and payment gateway refresh), identifying 12 security gaps before a single line of code was written. Cut automated SAST false positive rate from 40% to 18% by reconfiguring SonarQube rulesets and creating a custom Jira integration that auto‑suppressed 67 irrelevant findings in the first 2 sprints. Delivered a 2‑hour secure SDLC workshop to 35 engineers, achieving 100% completion of follow‑up knowledge checks and receiving a 4.8/5 satisfaction score (measured via post‑session survey). Established an end-to-end Vulnerability Management Program, integrating Asset Discovery, Vulnerability Scanning, and AI-enabled Remediation SLAs to reduce risk exposure.

Information Security Engineer at G-P/Globalization Partners, Oct 2023 - Feb 2026 · 2 yrs 5 mos, Indore, • Trusted security advisor to Product, Platform, and DevOps teams across a global SaaS platform, driving secure design early in the SDLC and leading application and cloud security initiatives end-to-end. • Reduced pre-production security risk by 60% by shifting vulnerability management from severity-based to business-impact-driven prioritization, and driving remediation ownership among engineering teams • Drove adoption of Wiz CSPM across AWS Organizations, remediating 200+ high/critical findings through structured cross-functional alignment • Built Python automation tooling for security operations and led AI/ML & LLM security assessments without slowing product velocity • Mentored engineers on secure coding and cloud security practices; maintained composure during high-severity incidents, ensuring clear communication and timely resolution

Vulnerability Analyst at Mastercard, Apr 2022 - Sep 2023 · 1 yr 6 mos, Pune, Maharashtra, India, In this dynamic role, I was at the forefront of ensuring Mastercard’s global security resilience through in-depth vulnerability analysis and proactive penetration testing across critical systems. • Led and executed end-to-end penetration testing on a wide array of platforms including web applications, APIs, thick clients, and network infrastructure, identifying critical vulnerabilities and ensuring secure development lifecycles. • Collaborated cross-functionally with development, security, and operations teams to drive security improvements, deliver detailed reports, and ensure remediation of identified threats in a timely and effective manner. • Enabled application security by conducting comprehensive walkthroughs with development teams, obtaining in-depth knowledge of systems to accurately scope tests and ensure exhaustive security assessments. • Spearheaded internal Capture the Flag (CTF) events, fostering an engaging environment that improved cybersecurity skills across teams while promoting collaboration and problem-solving within the organization. This role allowed me to combine deep technical skills with collaborative efforts across departments, ultimately contributing to Mastercard's mission of maintaining a secure and trustworthy payment environment on a global scale.

Cyber Security Analyst at Cyberops Infosec LLP, Mar 2021 - Mar 2022 · 1 yr 1 mo, Jaipur, Rajasthan, India, • Designed and delivered customized cybersecurity training programs, enhancing awareness and promoting best practices. • Led engaging and interactive sessions using diverse teaching methodologies to ensure retention of cybersecurity knowledge. • Developed comprehensive training materials including presentations, videos, and quizzes tailored to different audiences. • Provided one-on-one coaching and support, ensuring individual participants developed strong cybersecurity skills. • Ensured cybersecurity training met the unique requirements of various industries and client-specific needs.

Cyber Security Consultant at Cyberops Infosec LLP, Mar 2021 - Mar 2022 · 1 yr 1 mo, Developed strong presentation, facilitation, and coaching skills, later applied in enterprise environments. Designed and led hands-on security workshops, simplifying complex security concepts for diverse engineering audiences. Delivered security consulting engagements requiring strong client communication, expectation management, and technical depth.

Intern at ISECURION, Dec 2020 - Feb 2021 · 3 mos, Bengaluru, Karnataka, India

Education

Bachelor's of Computer Application, Computer Science, The bhopal school of social sciences

Saraswati vidya mandir inter college banda

Public links

github: https://github.com/ved-ant-jain