-------• Web AppSec: Comprehensive security assessments of web applications, APIs and supporting infrastructure. Including, but not limited to: ◦ White/black/grey box penetration testing activities, (manual and automated) against the OWASP Top 10, ASVS, biz logic and env config. ◦ Testing RESTful, GraphQL, APIs etc. ◦ Familiarity with file formats such as ProtoBuf, JSON, XML, XML & YAML. ◦ Testing Authentication & Authorization using modern auth such as OAuth2.0, SAML, etc. ◦ Extensive use and exp with tools such as integrated browser devtools, Burp Suite Professional, Selenium, Visual Studio, EclipseIDE & cheffing up of custom burp exts as required. -------• Mobile AppSec: Security assessments of cross-platform mobile applications (Android & iOS), APIs, supporting network/cloud infrastructure and reverse engineering apps.-------• Thick AppSec: Security assessments of cross-platform thick/enterprise applications (Windows & Linux): ◦ Leveraging of transparent layer 3 network proxies for system wide, full protocol interception & analysis capabilities. ◦ Performing DBI augmented reverse engineering and debugging using Frida and other decompilation/debugging tools.-------• AppSec Engineering: Safeguarding games/apps from cyber attacks, encompassing both "shift-left" SDLC security integration & hands-on technical application pen-testing, Involving but not limited to: ◦ Extensive usage/familiarity with OOP languages C#/.Net Core/ASP.NET Core, Python, PHP, Java, JavaScript/Node.js & CodeQL. ◦ Threat Modeling/Risk Assessment: Analysis of large system design architecture, data flow and user interactions to assess attack vectors/vulns. ◦ Shift Left SDLC: Integrating security measures early in the SDLC. ◦ SAST/DAST Integration: CodeQL powered manual/auto white box source code review, DBI assisted AFL Fuzzing, traffic analysis etc.-------• Red Team Ops | Adversary Simulation: Engaged in RTO simulation of APT threats to emulate real-world cyber attacks; including: ◦ Design/exec of complex, multi-stage RTO engagements tailored to org envs. ◦ Employing a wide range of attack TTPs to simulate real-world attacker behaviors/methodologies. ◦ Adapting/evolving strategies based on the target env, defensive mechanisms, and emerging threats. ◦ Development of custom tools. ◦ Delivery of comprehensive and actionable reports.-------• CloudSec: Safeguarding cloud infrastructure from cyber attacks, including but not limited to Cloud: ◦ Risk Assessment. ◦ Identity and Access Management (IAM). ◦ Security Best Practices.