Kaustav Pallob

CEH | CRTP | ISO 27001| CASE Certified Information Security Professional with 6+ years of experience in information security and services industry, currently working as a Cyber Security Engineer at F. Hoffmann-La Roche AG a Switzerland based pharmaceutical company. Previously served in EY, Accenture and different on-site clients.

• Deeply engaged in end-to-end execution and management of security projects, perform risk assessment, Vulnerability Management, providing remedial solutions and handling project teams of different continents.

• Holds a Master’s degree in information security.

Responsibility and Engagement details I was engaged so-far:

▪ Worked as a security consultant for a multinational corporation. Conducted a wide range of security testing approaches, tools, and techniques to carry out baseline security testing for a major international financial services business. Worked together with the security department of the organization to conduct thorough evaluations of key apps and to make useful suggestions for enhancing overall security posture. Successfully found and fixed a number of security flaws, particularly those involving web apps and APIs, to help safeguard the company's data and systems from potential cyber attacks.

▪ Conducted an annual security assessment for global tech industry. Uncovered critical security issues, including XSS, SQL injection, and others, which could have potentially exposed sensitive data and systems to cyber threats.

▪ Conducted penetration testing and vulnerability assessments for web application security penetration testing, API security assessment for one of the leading cargo industry. Found several vulnerabilities in these assessments. Deliver high quality security assessment report with proper explanations and recommendations

▪ Conducted a security assessment for a leading African payment company, with a specific focus on a company mergers and acquisitions engagement. I was conducted penetration test on public-facing web applications, mobile application which were due to launch soon. With a through assessment, I identified a critical vulnerability in one of the applications that could have exposed sensitive data and systems to cyber threats. I promptly reported the issue to the company's security team, enabling them to remediate the vulnerability before the launch. The assessment and report submitted by him helped the company to proactively address security concerns, ensuring that their web applications were secure and protected from potential cyber-attacks

▪ Performed penetration testing on 100+ business Web applications based on OWASP guideline. Had deliver services to banking/payment industries, oil and gas industry, IT industries, healthcare Industry, ecommerce etc.

▪ Reported other major critical findings for the African financial corporation such as: broken authorization, XSS, sql injection, OTP authentication bypass, OTP flooding, IDOR vulnerability on Internet facing applications, SSL Pinning bypass, SQLite db enumeration for a banking mobile application.

▪ Performed vulnerability assessment and penetration testing for internal network of the organization. Scan the infrastructure with the help of Nessus, Nmap, and exploit the identified vulnerabilities with the help of Metasploit, Nmap etc. Performed wireless network security analysis, WiFi penetration testing with the help of Airomon-Ng, Airodump-Ng, Aireplay-Ng, ARP spoofing, poisoning using Ettercap etc

▪ Conducted social engineering by launching phishing campaigns for an African financial services statutory body, Universities etc. With the expertise in social engineering techniques and knowledge of the latest phishing trends, I was able to simulate realistic scenarios to test the awareness and response of employees. This activity helped organizations to improve their security posture and protect against the risk of data breaches and financial losses.

▪ Engaged in a Red Teaming activity, performing AD vulnerability assessment, with the help of Bloodhound, and AD-Command. Reported several outdated and misconfigured policies, and found more than one domain admin account, etc.

▪ Recently engaged in few AWS config review projects, highlighted several mis-configured entities, deliver best practices according to CIS benchmark and AWS best-practice guide lines.