Antti Ruhala Email & Phone Number

Working in the Security Engineer role of Product Security team. The role includes tasks such as performing security penetration testing as well as security and vulnerability assessment of software products deployed as Web Applications / Desktop / Mobile / Cloud Services and cloud infrastructure. I have years of experience in participating in threat modelling sessions of security critical cross-platform software features. Additionally, I have worked on improving the automation of different security areas of CICD release pipelines, including SAST, DAST, Secret scanning etc.I have acquired experience in security penetration testing of large scale complex data and resource management systems leading to the discovery of numerous critical level vulnerabilities before and after deployment. Some of these vulnerabilities have touched subjects and techniques regarding permissions and authorization, code injections by user input as well as file metadata, storage manipulation, privilege escalation within the data management systems and open redirection vulnerabilities. As per recent trends and the gaining popularity of AI LLM based solutions; I have also found and helped mitigate multiple exploits in features based on popular LLM Models and their access control and processing of confidential information.Working with the development teams I manage the vulnerabilities and help to find the required mitigations. I have experience in participating in the running of a successful security champion program. Similarly, I have facilitated security related meetings and training including live demonstration of exploitation paths after an internal application security assessment. I'm familiar with the handling of a CVE process and have worked as a sub-CNA.Master's thesis: Software security testing and analysis of an authentication service based on OpenID Connect; Authorization Code Flow with Proof Key for Code Exchange Identity ProviderBachelors' thesis; Ways to hide a backdoor application in different phases of an ongoing attack

Listed skills include Microsoft Office and Microsoft Excel.