Devansh Doshi

OSCP Certified Professional with ~1.5 Years of experience in Product Security and Offensive Security.

Security Engineer at PharmEasy (2025-02 – Present)

• Led end-to-end penetration testing of web, API, and Android applications; collaborated with developers to explain each vulnerability, its risk, and remediation specific to the service
• Identified 40+ critical/high vulnerabilities including 19 P0 issues — Zip Slip in application leading to RCE, SSTI in Velocity Template, OAuth Misconfiguration leading to account takeover, SQL Injection (RCE via xp_cmdshell), SSRF, OTP bypass, and insecure WebView handling
• Performed manual source code reviews (ASP.NET), identifying auth bypass and SQLi via headers/cookies
• Reduced active exploitation risk by 50% through collaboration with stakeholders and timely remediation
• Conducted red teaming exercises simulating real-world attack scenarios across internal and external infrastructure, identifying critical detection and response gaps
• Identified and secured 30+ internal services — including Kubernetes dashboards exposing secrets, API contracts, and critical service dashboards — exposed to the public internet via load balancer misconfigurations across 5 business units (PharmEasy, Thyrocare, Docon, Aknamed, Retailio)
• Chained attack paths to demonstrate real impact: SSRF → AWS Metadata → IAM credential compromise; unauthenticated kubelet access and container misconfigurations → RCE on Kubernetes pods
• Integrated Trivy into Jenkins CI/CD pipelines for automated container image scanning at build and ECR push stages, preventing insecure images from reaching production
• Implemented org-wide secret scanning using GitHub Actions with TruffleHop across 1,000+ repositories, identifying and tracking 4,000+ secret exposures
• Automated Jira ticket creation and drove rotation of 100+ credentials, significantly reducing credential leak risk
• Monitored 2,000+ repositories using Dependency-Track with SBOMs published via GitHub Actions and Bitbucket Pipelines; identified 200,000+ vulnerable components and remediated 500+ vulnerabilities including zero-day exposures
• Built internal tooling in Python — Copyright Violation Scanner for automated detection of copyright issues, and Credential Leak Monitor to track exposed credentials across Telegram and the dark web

M.Tech in Computer Science and Information Security – IIIT Hyderabad (2021 – 2023)

B.Tech in Computer Science and Engineering – Bhilai Institute of Technology, Durg (2017 – 2021)