Skip to content

Experience

Dec 25 - Present

San Francisco, CA (Remote)

Security Researcher — HackerOne

  • Submitted 35+ vulnerability reports to global programs including Goldman Sachs, Flipkart, Adobe, Netflix, Red Bull, NVIDIA, Anduril, Coca-Cola, and Superdrug - headlined by a Critical (CVSS 9.1) GraphQL flaw at Red Bull exposing employee PII, and an unauthenticated API exposing 892 employees' PII with write access to a production database.
  • Found high-impact infra and supply-chain bugs: remote code execution in a build pipeline, a subdomain takeover at Anduril, and exposed source maps leaking OAuth secrets at Flipkart/Myntra.
  • Discovered hardcoded OAuth secrets leaking NHS medical data and an appointment IDOR at Superdrug - preventing potential patient-data breaches.
Burp SuiteGraphQLIDORSubdomain TakeoverCVSS 3.1

Jul 25 - Present

Patiala, IN (On-site)

Head of Cyber Security — Google Developer Groups TIET

Head of Cyber Security August 2026 - Present

  • Leading the club's security work - building security projects with core members, alongside bug bounty hunting and security research.

Core Member July 2025 - August 2026

  • Delivered a 2-hour cybersecurity workshop at DevFest 2025, covering core security concepts through live demonstrations for 160+ attendees.

Apr 26 - Jun 26

Delhi, IN (Hybrid)

Security Engineer — Iris Intelligence

  • Identified and remediated IDOR, SQL injection, authentication bypass, and RCE vulnerabilities across APIs and application flows.
  • Implemented Cloudflare Workers and custom WAF rules to mitigate bot abuse across the application serving 5K+ users.
API SecurityCloudflareAccess ControlThreat Modeling

2024-2028

Education

B.E. · Computer Engineering — Thapar Institute of Engineering & Technology

Core coursework: Data Structures & Algorithms, Operating Systems, Computer Networks, DBMS.

Generating world

Loading level · 0%Tip: press Esc on any screen to go backClick or press any key to skip