Pallavi Deshmukh

Application Security, DevSecOps and Secure Software Development leader with extensive experience designing and scaling Application Security programs across enterprise SaaS and cloud-native platforms. Proven expertise integrating security into Secure SDLC, CI/CD pipelines and developer workflows through threat modeling, secure architecture reviews, SAST, DAST, SCA, API security testing and cloud security. Experienced partnering with Engineering, Platform and Product teams to define secure engineering standards, deliver developer enablement, drive secure-by-design practices and improve application security maturity.

Passionate about AI-assisted software development, modern DevSecOps practices and enabling developers to build secure applications at scale

Cloud Security Manager at Coupa (2022-09 – 2026-03)

• Built and led enterprise Application Security initiatives, driving secure-by-design practices, DevSecOps adoption and scalable security engineering across enterprise SaaS and cloud-native platforms
• Partnered with Engineering, Product and Platform teams to define secure engineering standards, reusable security patterns and secure architecture guidance for modern cloud-native applications and APIs
• Conducted threat modeling, secure architecture reviews and security design assessments, identifying architectural weaknesses and embedding preventive security controls throughout the Secure SDLC
• Integrated SAST, DAST, Software Composition Analysis (SCA), API security testing, dependency scanning and secret detection into CI/CD pipelines, embedding automated security controls throughout software delivery
• Governed application security reviews across the Secure SDLC, partnering with engineering teams to validate remediation, verify security fixes and improve compliance with secure development standards
• Delivered developer-focused security enablement through secure coding guidance, security playbooks, technical workshops and hands-on mentoring, improving engineering adoption of secure development practices
• Partnered with Engineering teams to translate security findings into practical remediation strategies, secure implementation guidance and developer-friendly security controls
• Led offensive security assessments, penetration testing and red team exercises across web applications, APIs, AWS, Azure and enterprise platforms, identifying exploitable attack paths and improving overall application security posture
• Led risk-based vulnerability management across applications, cloud workloads, containers and infrastructure, prioritizing remediation based on exploitability, business impact and operational risk
• Performed cloud security assessments across AWS and Azure, leading CSPM initiatives to identify cloud misconfigurations, excessive permissions and security control gaps while driving remediation aligned with cloud security best practices
• Evaluated emerging application security technologies, AI-assisted development workflows and offensive security methodologies, recommending improvements that strengthened enterprise security capabilities and developer productivity
• Led AWS and Azure WAF implementation and policy optimization, improving protection of customer-facing applications while maintaining operational stability
• Enhanced enterprise security visibility through centralized logging, cloud-native security services and detection engineering capabilities, strengthening threat detection and operational resilience
• Leveraged AI-assisted security workflows to improve vulnerability analysis, remediation prioritization, security investigations and engineering productivity
• Supported security incident investigations, validating security controls, analyzing attack scenarios and coordinating remediation activities across engineering and operations teams
• Mentored security engineers through technical coaching, security reviews and knowledge sharing, strengthening application security capabilities across engineering organizations

Senior security Engineer at Coupa (2019-12 – 2022-08)

• Built and led the enterprise HackerOne bug bounty program, establishing vulnerability triage, validation workflows and remediation governance to strengthen application security maturity
• Conducted manual penetration testing and offensive security assessments across web applications, APIs and microservices, identifying critical vulnerabilities and validating exploitability
• Performed threat modeling and secure design reviews, partnering with engineering teams to eliminate architectural weaknesses before production deployment
• Owned the complete application vulnerability lifecycle from discovery through remediation validation, ensuring critical findings were prioritized, remediated within SLA targets and verified before closure
• Implemented Runtime Application Self-Protection (Tcell RASP), enabling real-time attack visibility and strengthening application-layer detection capabilities
• Prepared detailed penetration testing reports and communicated technical findings, exploit scenarios and risk-based remediation recommendations to engineering teams, product owners, leadership and customers
• Collaborated with developers to validate security fixes, improve secure coding practices and reduce recurring application security vulnerabilities across business-critical applications

Technology Security Specialist at Accenture Technology (2019-06 – 2019-12)

• Delivered VAPT engagements across web, API and thick client applications for multiple enterprise clients
• Discovered critical vulnerabilities and worked with teams to remediate and validate fixes
• Performed security architecture assessments and technical risk reviews, recommending security controls aligned with client security and compliance requirements
• Contributed to client onboarding and pilot engagements by shaping testing strategies for new setups

Associate Security Architect at Icertis Solutions (2017-01 – 2019-06)

• Led threat modelling and security architecture reviews for a cloud-hosted SaaS platform, identifying design risks and driving secure-by-design improvements
• Drove adoption of Secure SDLC practices across engineering teams, embedding security reviews and risk assessments early in the software development lifecycle
• Performed secure code reviews and application security testing, uncovering critical vulnerabilities and guiding teams through effective remediation
• Designed and rolled out a platform-wide input validation framework and strengthened cloud security in collaboration with DevSecOps, reducing XSS risk and aligning with CIS benchmarks

Senior Project Engineer at Wipro Technologies (2016-04 – 2017-01)

• Led end-to-end web and mobile application security assessments, identifying and validating critical, high-impact vulnerabilities
• Performed dynamic and forensic analysis of native and hybrid apps to demonstrate real-world exploitability
• Partnered with engineering teams and customers to communicate security risks, prioritize remediation and validate fixes across web and mobile applications
• Delivered global training on mobile security testing, improving secure coding practices and strengthening overall security posture

Senior Information Security Engineer at SecurView Systems (2009-12 – 2016-03)

• Performed web and API security assessments (black-box/grey-box) across multiple client environments, identifying and validating application-layer vulnerabilities with PoCs
• Conducted mobile application testing and reverse engineering, uncovering data exposure and insecure implementations
• Performed internal and external network penetration testing, identifying infrastructure vulnerabilities, validating security controls and recommending risk-based remediation strategies

Bachelor of Engineering – North Maharashtra University (2005-06 – 2009-03)