Performed application security assessments across web, mobile, and API ecosystems in a high-scale fintech environment. Secured high-risk user journeys involving payments and third-party integrations, identified and drove remediation of high-impact vulnerabilities including business logic flaws in critical workflows. Conducted threat modelling, security design reviews, and secure code reviews (Java, Python, JavaScript), partnering with engineering teams to implement DevSecOps controls at scale.

Triaged vulnerabilities for the bug bounty and vulnerability disclosure program with impact-driven prioritization. Drove vulnerability management for application security, assessing exploitability, business impact, and real-world abuse potential. Collaborated with engineering teams to remediate reported bugs and improve the security posture of production systems.

Led security assessments of third-party ecosystems across enterprise environments, identifying vulnerabilities and business logic gaps in vendor-facing applications. Evaluated external attack surfaces and vendor integrations to uncover real-world exploitation paths. Collaborated with CISOs and security leaders to strengthen organizational security posture across third-party ecosystems.

Worked on reports for 42 different clients and produced 17 advisories published on CloudSEK’s website. Monitored the XVigil Digital Risk Protection platform and highlighted critical threats. Coordinated with AI, data acquisition, and engineering teams to suggest product improvements.

Conducted OSINT investigations for phishing scams and brand-impact threats, including ID printing and fake cryptocurrency phishing cases. Triaged Russian and English cybercrime forums as part of the global threat research team, conducting threat actor profiling and research on TTPs for evolving ransomware families.

Developed penetration test case studies for specific clients based on assessment reports. Wrote white papers and reference guides for NotSoSecure’s Basic Infrastructure Hacking and Basic Web Hacking courses.