Cyber Security - Web Application Security VAPT

I have 6+ years of experience in Application Security and VAPT, with hands-on experience across SAST, DAST, SCA, API Security, Web Application Security, Threat Modeling, and Vulnerability Management. My core expertise includes performing security assessments of web applications, APIs, and backend services; identifying vulnerabilities; manually validating security findings; assessing their severity; and providing remediation recommendations. I have worked extensively with tools such as Burp Suite, OWASP ZAP, SonarQube, Checkmarx, Semgrep, Trivy, Nuclei, ffuf, and SQLMap. I also have experience with integrating security testing into CI/CD pipelines and automating security scanning and reporting. I have strong knowledge of OWASP Top 10, API security, authentication and authorization testing, IDOR, SQL Injection, XSS, SSRF, security misconfigurations, security headers, and vulnerability validation. I also have experience with STRIDE-based threat modeling and identifying security threats across different application architectures. More recently, I've focused on AI and LLM security, including LLM and RAG security testing, prompt injection, chatbot security, AI application threat modeling, and security testing of AI-driven workflows. Beyond hands-on security testing, I have experience reviewing and performing QA on security assessment reports, including validating reproduction steps, evidence, impact, remediation, severity, CVSS, and CWE/CVE mapping, and ensuring reported vulnerabilities are technically accurate and actionable. Overall, my experience combines hands-on offensive security testing with application security engineering, threat modeling, security automation, and AI security. Currently, I am focusing on strengthening my expertise in advanced API security, VAPT, cloud security, AI security, and security automation.