Ashish Upsham

Certified Information Security Professional with 5.8+ years of experience in Application Security and Penetration Testing across Web Applications, APIs, and Mobile Platforms (Android & iOS). Successfully performed 500+ security assessments including Black-Box and Grey-Box Testing, Vulnerability Assessment & Penetration Testing (VAPT), and remediation validation. Skilled in integrating SAST, DAST, IAST, and SCA solutions into CI/CD pipelines to strengthen application and software supply chain security.

Experienced in Secure Code Review, Threat Modeling, OWASP Top 10 mitigation, and collaborating with development teams to enhance security posture. Hands-on expertise with Burp Suite, MobSF, Frida, Fortify, SonarQube, GitHub Advanced Security, Mend, Snyk, and Contrast Security. Recognized for discovering CVEs, publishing exploits on Exploit-DB, and contributing to security research in AI and Cloud Security

Security Analyst at Fidelity National Financial (2023-10 – Present)

• Performed penetration testing on web applications, mobile applications (Android & iOS), and APIs to identify security vulnerabilities.
• Conducted SAST, DAST, IAST, and SCA using security tools integrated into CI/CD pipelines to ensure secure code review and dependency management.
• Validated and verified remediation for vulnerabilities reported through external security programs (e.g., Bugcrowd) and third-party penetration tests.
• Collaborated closely with development teams to analyze vulnerabilities and implement secure remediation strategies.
• Ensured that security fixes were properly implemented and re-tested before release.

Information Security Analyst at Indusface Pvt Ltd (2022-11 – 2023-09)

• Conducted black-box and grey-box penetration testing for clients across industries including banking, financial services, healthcare, e-commerce, and food platforms.
• Performed security assessments on web applications, mobile applications (Android & iOS), and APIs to identify vulnerabilities and security misconfigurations.
• Prepared detailed penetration testing reports with risk analysis, proof of concept, and remediation recommendations.
• Worked directly with clients to track vulnerability remediation and verify fixes through retesting.
• Mentored junior security analysts by guiding them in penetration testing methodologies, vulnerability validation, and report writing.

Information Security Consultant at qSEAp Infotech Pvt Ltd (2020-08 – 2022-11)

• Performed black-box and grey-box penetration testing for clients in banking, insurance, and e-commerce domains, including both international and domestic clients.
• Conducted security assessments on web applications, mobile applications, APIs, and network infrastructure to identify vulnerabilities and security misconfigurations.
• Assisted in vulnerability analysis, exploitation, and validation to confirm security risks.
• Prepared technical vulnerability reports with detailed findings, proof of concept, risk ratings, and remediation recommendations.

Cyber Security Analyst (Trainee) at Pristine InfoSolutions (2019-10 – 2020-05)

• Completed a 6-month internship in penetration testing, gaining foundational knowledge in application and network security.
• Performed basic security assessments on web applications for small-scale projects including travel agencies, retail platforms, and jewelry store websites.
• Assisted in identifying common web vulnerabilities and documenting findings with remediation recommendations.
• Learned and applied penetration testing methodologies, vulnerability analysis, and security reporting practices.
• Gained hands-on experience with end-to-end penetration testing processes, including reconnaissance, vulnerability discovery, exploitation, and reporting.

M.Sc in Information Technology – Karmaveer Bhaurao Patil College (2024-06 – 2026-05)

B.Sc in Information Technology – Rajiv Gandhi College of Arts, Commerce and Science (2015-06 – 2018-06)