Penetration Tester · Red Team & Web/API VAPT · Application Security
I'mBALASUBRAMANIYAN B
> Penetration Tester & Application Security
Fellow of Management Systems Auditing (FMSA)
Ariyalur, India · Open to relocation to Germany
I test web, API, network, and infrastructure surfaces, then turn findings into clear fixes. Across 30+ enterprise engagements, I’ve uncovered 40+ critical and high-severity issues. I also build tools for the work: RREF, Sentinel-SDK, and WebSec Check. ISO lead auditor and CRTOM; currently pursuing OSCP.
AfterQuery
Software Engineer (Remote)
30+
Enterprise Pentests
FMSA
Fellow & 3x Lead Auditor
2+ Yrs
Offensive Ops & VAPT
Whoami
About Me
Offensive security professional with 2+ years of hands-on penetration testing, Red Team operations, and vulnerability research across web, network, and infrastructure environments. Identified and exploited 40+ critical/high-severity findings across 30+ enterprise client engagements (client-confidential; findings reported under NDA, aggregate figures publicly citable). Skilled in privilege escalation, lateral movement, post-exploitation, and Active Directory attacks.
Creator of custom offensive frameworks including RREF (RedOps Recon & Exploitation Framework), Sentinel-SDK (Black-Box Security Auditing Framework), and WebSec Check (Passive Web Security Auditor published on npm v1.1.0). Delivers CVSS-scored pentest reports with reproducible PoCs and prioritized remediation guidance aligned to OWASP Top 10 and MITRE ATT&CK.
Holds ISO/IEC 27001:2022, ISO/IEC 27701:2025, and ISO/IEC 42001:2023 Lead Auditor credentials from Mastermind Assurance (IAF-accredited) and is a Fellow of Management Systems Auditing (FMSA). Also holds CRTOM and VAPT Specialist certifications and is actively pursuing OSCP. Familiar with NIS2, DORA TLPT requirements, and BSI IT-Grundschutz compliance frameworks relevant to the German and EU regulatory environment.
Ariyalur, India
Software Engineer AfterQuery Experts (Remote)
Open to relocation to Germany · On-site, hybrid, and remote
English C1 · German A1 (actively learning)
BSc Computer Science (Cloud & Info Security) · 89% Distinction
Technical Skills & Arsenal
Skills & Domains
Offensive tooling, penetration testing methodologies, development stacks, and compliance standards from my verified resume.
Web Application Security
Offensive Operations & Red Teaming
Network & Infrastructure Security
Vulnerability Management & Research
SOC & Digital Forensics (DFIR)
Cloud & Development
Standards & Compliance Frameworks
Career & Professional Experience
Professional Experience
Hands-on penetration testing, offensive platform development, and enterprise engagements.
Software Engineer
AfterQuery Experts
PresentRemote
- Engineers production software architectures, multi-file codebases, and evaluation environments used to train and benchmark frontier AI models and autonomous coding assistants.
- Designs and implements full-stack features, API integrations, and robust automated test suites with deterministic validation.
- Constructs containerized developer environments using Docker, enforcing strict code quality, performance benchmarks, and OWASP secure development principles.
- Collaborates with distributed international engineering teams to evaluate model problem-solving capabilities across diverse technology stacks and algorithmic workflows.
Cyber Security Research Analyst
Terra System Labs
Jul 2025 – Jul 2026Bangalore, India
- Conducted 30+ web application, network, and infrastructure penetration tests (Burp Suite, Nmap, Nessus, Metasploit, Wireshark); identified 40+ critical and high-severity vulnerabilities across enterprise environments (client-confidential engagements; aggregate figures cited, findings reported under NDA).
- Performed privilege escalation, lateral movement, and post-exploitation during Red Team engagements; simulated adversarial attack chains using MITRE ATT&CK framework and custom C2 workflows.
- Delivered CVSS-scored pentest reports covering OWASP Top 10 vectors (SQLi, SSRF, IDOR, XSS) with actionable remediation guidance for enterprise clients.
- Presented pentest findings and risk remediation strategies to client stakeholders including technical leads and C-level executives; translated complex vulnerability chains into clear business-risk narratives during final report walkthroughs.
- Conducted attack surface management and OSINT reconnaissance as part of Red Team pre-engagement planning; mapped external exposure and identified high-value targets prior to active exploitation phases.
Cyber Security Analyst
Terra System Labs
Dec 2024 – Jun 2025Bangalore, India
- Conducted vulnerability assessments, penetration tests, and security-log analysis; promoted to Cyber Security Research Analyst in July 2025.
- Documented findings and actionable remediation guidance, analyzed security logs to support incident response, and built frontend and backend components for an internal testing framework.
Full-Stack Developer – Security Focus
SkillKaster
June 2024 – Dec 2024Remote
- Built React.js / Node.js applications to OWASP secure coding standards; implemented CSP policies, input validation, and authentication hardening across 2 production platforms.
- Conducted security code reviews identifying 12+ injection and authentication vulnerabilities prior to deployment.
Cyber Crime Investigator Intern
Tamil Nadu Cyber Crime Wing
Jun 2023 – Jul 2023Coimbatore, India
- Investigated 20+ cybercrime incidents using digital forensics and Splunk log analysis; findings used in law enforcement proceedings.
- Reduced mean time to evidence collection by ~20% through structured incident triage procedures.
VAPT Intern
BM Infosec Limited
Jun 2022 – Jul 2022Coimbatore, India
- Performed vulnerability assessments on 5+ platforms using Nessus and manual testing; reported 8 critical findings with CVSS scores and remediation steps.
Key Projects & Tooling
Key Projects
Offensive security frameworks, published npm CLI tools, enterprise platforms, and security research.
Phishing Simulation Ecosystem
Enterprise Security Awareness Platform (Confidential)
Full-stack security platform built at Terra System Labs comprising: phishing simulation engine (campaign creation, email spoofing, landing pages), integrated LMS for post-phishing security awareness training, campaign analytics and tracking dashboard, and automated reporting pipeline. Deployed across client environments as an integrated security awareness and testing platform.
Full-Stack
Phishing Engine
Awareness LMS
Campaign Analytics
Reporting Pipeline
Enterprise Deployed
RREF
RedOps Recon & Exploitation Framework
Python/Bash offensive toolkit automating recon (port scanning, subdomain enumeration, service fingerprinting), exploitation, and report generation. Deployed in 4 Red Team engagements; reduced pentest cycle time by ~35%.
Python
Bash
Nmap
Recon Automation
Exploit Delivery
Red Team Ops
Sentinel-SDK
Black-Box Security Auditing Framework
Modular plugin-based vulnerability detection framework covering OWASP Top 10 vectors (SQLi, XSS, SSRF, IDOR). Detected 18 vulnerabilities missed by automated scanners across 3 client assessments. Features WAF detection, dark crawler modules, and dual HTML/PDF reporting.
Python
OWASP Top 10
WAF Detection
Dark Crawler
FPDF2
SQLite
WebSec Check
Passive Web Security Auditor | Node.js, JavaScript, npm
Developed and published an open-source CLI that passively audits 8 web-security configuration categories: headers, cookies, CORS, redirects, caching, HTTP methods, information disclosure, and security.txt. Implemented SSRF protection, redirect limits, timeout handling, security scoring, severity-based findings, and JSON reporting, backed by 11 automated test suites.
$ npx websec-check <url>
Direct execution
npm Verified
Node.js
SSRF Defense
Security Scoring
11 Test Suites
Phantera
Insider Threat Detection (ML)
Behavioural biometrics anomaly detection system tracking keyboard and mouse dynamics. Machine learning model achieved 89% detection accuracy in lab testing. FastAPI backend with interactive Streamlit dashboard for real-time monitoring.
Python
Machine Learning
FastAPI
Streamlit
Behavioral Biometrics
Isolation Forest
REDOPS-VA
Automated Vulnerability Assessment Suite
Orchestration tool integrating Burp Suite, Nessus API, and OWASP ZAP scans into a unified operational script. Automated scan setup and review cycles, reducing manual pentest turnaround by over 50% across 50+ target nodes.
Python
Burp REST API
Nessus API
OWASP ZAP API
Report Aggregation
TraceBack
Enterprise Digital Forensics Platform
Automated digital forensics incident response platform that collects, analyzes, and correlates forensic artifacts from Windows and Linux systems to reconstruct incident timelines and generate structured investigator reports.
Python
Bash
SIEM
DFIR
Timeline Reconstruction
IT System Log Analyzer
Custom SIEM Security Tool · Published Research
Sophisticated security log analysis and correlation engine that processes logs across heterogeneous enterprise sources to detect anomalous patterns and trigger automated triage alerts. Backed by published research paper in IJPREMS.
Python
Splunk
SIEM
Log Correlation
Anomaly Alerts
Burp Suite Packet Capturing
Practical Traffic Interception & Proxy Guide
Comprehensive offensive guide and configurations for intercepting HTTP and HTTPS request/response packets using Burp Suite, proxy routing, SSL CA certificate installation, and browser traffic security analysis.
Burp Suite
HTTPS Interception
Proxy Setup
SSL/TLS Certificates
Packet Inspection
Achievements & Community
Achievements & Community
National hackathons, competitive CTFs, algorithmic problem solving, and public security research.
Kavach 2023 · Top 5% Nationally
National Cybersecurity Hackathon conducted by the Ministry of Education & Govt. of India; ranked in top 5% of teams nationwide.
TN Startup & Idea Hackathon 2.0
State-level finalist in the cybersecurity innovation track presenting automated vulnerability mitigation solutions.
CTF Competitions
Active participant across HackerOne, Payatu, and Razzify CTFs; focused on web exploitation & binary exploitation tracks with write-ups on GitHub.
HackerRank SQL 5-Star
Ranked in top percentile globally for SQL data querying, schema optimization, and database manipulation.
HackerRank Python 3-Star
Hands-on programming validation for automated tool development, exploit scripting, and backend pipelines.
Open Source & CTF Writeups
Publishes offensive frameworks, security auditing utilities, and CTF walkthroughs on GitHub for the security community.
Credentials
Certifications
Credentials in offensive security, auditing, and professional development.
// Accredited Auditing Credentials
Lead Auditor credentials accredited by Mastermind Assurance under IAF validation, establishing competence in governance, compliance, and multi-disciplinary systems auditing.
Premier Fellowship
IAF VERIFIED
Fellow of Management Systems Auditing (FMSA)
Mastermind Assurance (MSCB-356) · 2026 · VerifiedAwarded for completing all three Lead Auditor credentials from the same IAF-accredited body: ISO/IEC 27001:2022 (Information Security), ISO/IEC 27701:2025 (Privacy Information Management — GDPR-aligned), and ISO/IEC 42001:2023 (AI Management Systems). Mastermind Assurance was the first certification body globally to issue accredited ISO 42001 certificates.
✓
ISO/IEC 27001:2022
Information Security Lead AuditorAccredited Lead Auditor credential from Mastermind Assurance (MSCB-356), validating governance and risk assessment frameworks.
IAF VERIFIED
✓
ISO/IEC 27701:2025
Privacy Information Lead AuditorCertified Lead Auditor for Privacy Information Management Systems (PIMS) ensuring regulatory GDPR-aligned security.
IAF VERIFIED
✓
ISO/IEC 42001:2023
AI Systems Lead AuditorCertified lead systems auditor for Artificial Intelligence Management Systems (AIMS), focusing on safe, secure, and compliance model audits.
IAF VERIFIED
// Diversified Credentials
Technical credentials in offensive security, red team operations, penetration testing, and security analysis.
CRTOM – Certified Red Team Operations Management
Red Team Leaders
2024
Verified
VAPT Specialist
Bored Monk
2024
Verified
C3SA – Certified Cyber Security Analyst
CyberWarfare Labs
2023
Verified
SOC Analyst
LetsDefend.io
2023
Verified
OSCP — Offensive Security Certified Professional
OffSec / TryHackMe
In Progress
Pursuing
Active Directory Exploitation & Defense
CyberWarfare Labs
2024
Verified
Offensive Agent AI
Red Team Leaders
2025
Verified
CCEP – Certified Cybersecurity Educator Professional
Red Team Leaders
2023
Verified
Incident Response Fundamentals
LetsDefend.io
2022
Verified
Splunk SIEM Basics for Security Analysts
Splunk
2022
Verified
Nessus Vulnerability Assessment Fundamentals
Tenable
2022
Verified
CSI Linux Investigator
CSI Linux
2022
Verified
CSI Linux Administration
CSI Linux
2022
Verified
Steganography & Malware Analysis
CSI Linux
2022
Verified
Introduction to Critical Infrastructure Protection
OPSWAT
2022
Verified
OWASP Top 10 Web Application Security
Bored Monk Pvt Ltd.
2023
Verified
Oracle Cloud Infrastructure Foundations Associate
Oracle
2023
Verified
CPPS – Certified Phishing Prevention Specialist
Hack&Fix Academy
2023
Verified
Ethical Hacking Essentials (EHE)
CodeRed / EC-Council
2022
Verified
Network Defense Essentials (NDE)
CodeRed / EC-Council
2022
Verified
Cyber Security Fundamentals
IBM
2022
Verified
Introduction to Cybersecurity
Cisco Networking Academy
2021
Verified
Academics & Education
Education
Formal degree and foundational coursework.
BSc Computer Science — Cloud Technology & Information Security
Rathinam College of Arts and Science · Coimbatore, India
2021 – 2024
Graduated with 89% — First Class with Distinction. Focused curriculum covering Network Security, Web Application Penetration Testing, Cloud Architecture (AWS & Azure), Cryptography & Security Protocols, Operating System Internals, and Computer Forensics.
Research
Articles & Writing
Academic publications and technical research papers.
AN SECURITY LOG ANALYSIS FOR IT SYSTEMS
International Journal of Progressive Research in Engineering Management and Science (IJPREMS)
Paper ID: IJPREMS40400008068
Volume 4, Issue 4, April 2024
Off the clock