Not a fingerprint of you. A reminder that every product leaks a trust map on first paint.
I test what the product trusts.
VAPT, threat modeling, multi-cloud, AI risk, and security automation across web, API, and cloud before it ships and after it is live.
0Engagements
0Vulns found
-CISA KEV live
01 / Surface
First pass is always the origin.
No extra permission. Nothing left this machine. The same shallow read I run in hour one of a product review.
02 / Mandate
Five surfaces. One question.
Where does this product place trust that an adversary can spend?
01 / VAPT
Adversarial tests
Web, API, mobile, cloud. Chain the small stuff until it is a path, not a ticket.
02 / MODEL
Threat modeling
Draw the trust boundaries. Cross them. Write it so the path gets killed.
03 / CLOUD
Multi-cloud
AWS and Azure: IAM, exposed storage, security groups, one role with too much blast radius.
04 / AI
AI risk
Prompt injection, agent/tool abuse, CTEM-style attack paths when a model is treated as trusted.
05 / AUTO
Security automation
Custom tooling for pentest workflows, leaver/offboarding, SIEM triage, and repeatable checks.
03 / Method
Three loops. Every product.
01
Model the trust
Map identity, sessions, APIs, cloud roles, and any model the product treats as benign. Isolated bugs are symptoms. The path is the finding.
02
Spend the trust
Abuse the intended path. Skip the exploit catalog until a control actually has to fail.
03
Prove it, then close it
Write the attack path so a builder can reproduce it. Fix is the only close.
04 / Field logs
What broke, and why it mattered.
05 / Record
Where the work sits.
JAN 2026 to PRESENT · BANGALORE
Product Security Engineer
Exotel, telecom SaaS, millions of users
- VAPT across web, API, and cloud: scope, run, and validate findings (OWASP, authz, business logic) before release.
- Multi-cloud reviews on AWS and Azure: IAM, exposed storage, security groups, weak network posture.
- Threat modeling on new features. Custom security automation, phishing simulations, and incident RCA.
MAR 2025 to JAN 2026 · BANGALORE
Cyber Security Engineer
Junglee Games
- VAPT on mobile, web, API, iOS, and enterprise apps: SQLi, file upload, XSS, HTML injection, open redirects, before production.
- Multi-cloud: AWS IAM, storage, and misconfig reviews. Threat modeling attack paths across apps and cloud.
- Security automation: AI-driven CTEM, leaver/offboarding automation, SIEM investigation tooling.
INTERNSHIPS
Red team & security internships
tutelr.org · shadowfox.in · codealpha.tech
- VAPT and red-team labs: Windows assessments, Nmap/SMB enum, Wireshark intercepts, Metasploit, Python automation.
- Led a five-person team at Tutelr. Built CTF-style labs and written reports stakeholders could act on.
06 / Marks
Hands on the keyboard.
HELD
CPT: Certified Penetration Tester
Red Team Academy · Credential RTHACPT1126
HELD
Practical Ethical Hacking
TCM Security · July 2022
IN FLIGHT
CCSP, in progress
Cloud security, on purpose, not multiple choice trivia.
DEGREE
BCA · Alva’s College
Moodbidri, Mangalore · July 2024 · GPA 8.6
07 / Operator
Abhiram Seetharaghava Sathish.
Product Security Engineer at Exotel
I secure web applications, APIs, and cloud infrastructure through hands-on security assessments, penetration testing, and threat modeling. My work spans vulnerability management, AWS and Azure security, secure SDLC, and security automation.
I focus on identifying real-world attack paths, strengthening security controls, and helping teams build secure products.
08 / Channel
If the product can be spent, I want the path.
VAPT, threat modeling, multi-cloud, AI, automation. Bangalore, IST.