Agam Thakur

Senior Security Consultant

Actively looking · Member since 22 Sep 2026

Message

Location: Bengaluru, India

Desired salary: Confidential

Work preference: Remote Only / Full Time

Experience level: Senior

About

Professional summary

I am a Senior Application Security Consultant with over three years of experience in vulnerability assessment and penetration testing for web, API, mobile, and network environments.

I lead end-to-end VAPT engagements using black-box, gray-box, and white-box methodologies. My work includes attack-surface mapping, exploit reproduction, root-cause analysis, risk assessment, and remediation validation.

I have identified and helped mitigate critical vulnerabilities including account takeover, BOLA, JWT manipulation, XSS, SSRF, token abuse, and API authorization weaknesses. I communicate technical findings as actionable business-risk insights using CVSS 3.1 and NIST SP 800-30 methodologies.

I am experienced in secure code review, open-source vulnerability analysis, software supply-chain risk evaluation, and DevSecOps security gating. I have worked with SAST and SCA approaches, including Black Duck integration.

I also perform mobile application and network security testing across Android and iOS ecosystems. My technical toolkit includes Burp Suite Pro, Nmap, Metasploit, Nessus, Frida, MobSF, Wireshark, and Python automation.

I am expanding my expertise in AI and LLM security, with a focus on prompt injection, jailbreak detection, adversarial evaluation, and guardrail validation.

Notice period: 70 days

Tech stack & tools

Working toolkit

Application Utilities

Postman

Languages & Frameworks

HTML5

JavaScript

PHP

Python

Experience

Career history

Senior Consultant Ultraviolet Cyber

Jan 2026 – Present

I lead end-to-end VAPT engagements for more than 25 complex enterprise web, API, and mobile applications using black-box, gray-box, and white-box methodologies. I perform root-cause analysis, remediation retesting, and business-risk communication using CVSS 3.1 and NIST SP 800-30.

I reproduce vulnerabilities related to open-source components and third-party dependencies in isolated local environments to assess supply-chain risk. I also conduct network security testing with Nmap, Metasploit, and Nessus, and support Shift-Left DevSecOps through SAST/SCA security-gating frameworks using Black Duck.

My testing has included critical and high-severity issues such as account takeover, BOLA, JWT manipulation, XSS, SSRF, and token abuse. I am also developing expertise in AI/LLM security, including prompt injection testing and guardrail validation.

Consultant Synopsys-BlackDuck-Ultraviolet Cyber

Jun 2023 – Dec 2025

I conducted VAPT assessments for more than 75 web applications and APIs, identifying, prioritizing, and helping mitigate critical security issues. I performed targeted API testing focused on authentication, authorization, and sensitive data exposure.

I analyzed CVE and OWASP disclosures, developed proof-of-concepts, and mapped vulnerability information against application architectures to create targeted remediation strategies. I delivered prioritized recommendations to development teams and verified deployed patches through rigorous retesting.

My remediation validation efforts helped reduce recurring vulnerabilities by 40% within three months while improving application security posture in line with industry standards.

Intern Synopsys

Jan 2023 – Jun 2023

I assisted with web application penetration testing and vulnerability assessments aligned with the OWASP Top 10 framework. I conducted active and passive reconnaissance, enumeration, and manual security testing.

I documented technical findings and supported the vulnerability management and remediation tracking lifecycle. This role helped build my foundation in application security testing, reporting, and remediation validation.