Tanish Mahajan
Bengaluru,
Summary
Product Security Engineer experienced in penetration testing, secure code reviews, and vulnerability management. Adept at uncovering and mitigating critical security issues across products, with a strong focus on automation and tooling to enhance security testing efficiency.
Overview
1
1
Certification
5
5
years of professional experience
Work History
Product Security Specialist - Level 2
FDJ UNITED (Formerly Kindred Group)
Bengaluru
01.2025 - Current
- Performed penetration tests across web, mobile, and API applications to identify security gaps and support remediation.
- Completed application security reviews, including manual penetration testing and secure code reviews, for component releases across engineering teams.
- Managed YesWeHack bug bounty program by triaging vulnerabilities, assigning severity, coordinating fixes, and processing bounty payouts.
- Conducted DAST scans using Burp Suite Enterprise and OWASP ZAP, tracked SAST/SCA findings in Snyk, scheduled automated web and API scans, and collaborated with development teams to remediate identified vulnerabilities.
- Built end-to-end DAST framework with OWASP ZAP in Docker to automate web application and API scans, report delivery, and Microsoft Teams alerts through scheduled scripts.
- Created custom Nuclei templates to detect recurring and organization-specific security issues.
- Worked across organization as primary cybersecurity contact, providing security guidance and support.
Engineer, DevOps – Security
Wind River
Bengaluru
06.2023 - 01.2025
- Executed in-depth penetration testing on web applications and APIs to identify and remediate vulnerabilities, enhancing overall security.
- Conducted DAST and SAST scanning to detect and remediate web application vulnerabilities.
- Managed cloud security and CSPM with Prisma Cloud, monitoring and remediating security alerts to maintain compliance and enhance protection.
- Developed DAST pipeline using Jenkins and S3 to automate Burp Suite DAST scans, streamlining vulnerability detection with Python scripts and Burp Suite GraphQL APIs.
- Developed Python scripts for automatic remediation in AWS.
- Managed product security by identifying risks and implementing secure development practices, strengthening overall application security.
Security Research Engineer
SecPod Technologies
Bengaluru
06.2022 - 06.2023
- Conducted penetration testing and web application security assessments for multiple projects, identifying critical vulnerabilities that enhanced overall security posture.
- Conducted research on the latest CVEs and developed proof-of-concept (POC) exploit scripts in NMAP NSE for identified vulnerabilities.
- Developed Python automations to streamline tasks in Linux, improving operational efficiency and reducing manual effort.
- Created automations in Python, making work easier by automating many tasks in Linux.
- Blogs - https://www.secpod.com/blog/author/tanish-m
Security Research Engineer - Intern
SecPod Technologies
Bengaluru
10.2021 - 05.2022
- Conducted penetration testing assessments, identifying critical vulnerabilities in systems to enhance security posture.
- Implemented web application security measures, fortifying applications against potential threats.
- Created NMAP NSE scripts using Lua to automate vulnerability scanning and streamline security assessments.
- Company Description
Education
B.E (CSE) -
Chitkara University
06-2022
Skills
- Application security and penetration testing
- Cloud security and API security
- Burp Suite and Snyk expertise
- Threat modeling and risk assessment
- Networking and Linux proficiency
- Python scripting and automation
- Bug hunting and exploit writing
- DAST and SAST methodologies
- Jenkins and CI/CD practices
- Nmap and Wireshark analysis
Certification
- Certified Kubernetes Administrator (CKA) (CERTIFICATE ID NUMBER: LF-e28ep5mwu1)
- AWS Certified Cloud Practitioner
- Certified Ethical Hacker (CEH)
- Certified AppSec Practitioner (CAP)
Bug Bounty
Discovered vulnerability: CVE-2024-36419
PROJECTS
- ARP Spoofer
A project which will perform ARP spoofing attack to become man in the middle of device within the same network.
- ARP Spoofing Detector
A project in which People will able to Safely browse internet in LAN as in LAN, ARP can be used to be man in the middle between any device to see and able to change packets. So, I made a tool that will detect if ARP is manipulated.
- Packet Sniffer
A project which will sniff every packet going or coming on that device or network. Also add filters to only see specific packets and related information.
- Automatic Website Vulnerability Finder
A project in which it will go to a specific website and will search for every vulnerability like Xss attacks, SQl injection and much more.
Timeline
Product Security Specialist - Level 2
FDJ UNITED (Formerly Kindred Group)
01.2025 - Current
Engineer, DevOps – Security
Wind River
06.2023 - 01.2025
Security Research Engineer
SecPod Technologies
06.2022 - 06.2023
Security Research Engineer - Intern
SecPod Technologies
10.2021 - 05.2022
B.E (CSE) -
Chitkara University