Ravichandran

Offensive security professional and AI red teamer with 3+ years of hands-on penetration testing and vulnerability research across web, cloud, network, mobile, REST API, and thick client environments (80+ engagements). Pioneered LLM red teaming at EY, demonstrating prompt injection leading to RCE and data leakage.

Build

Python adversarial testing harnesses (PyRIT, Garak) to measure jailbreak resilience and model safeguards; published an open-source cybersecurity LLM and offensive framework. Skilled at judging real-world exploitability and communicating risk to technical and non-technical teams. HTB CPTS, eCPPTv2, CAPENX certified.

Independent Security Consultant & AI Security Researcher at Independent (2025-10 – Present)

Focus: AI/LLM Security Tooling & Applied Offensive Security Research

• Conducted independent research on AI safety, adversarial robustness, and model cyber capabilities; built and evaluated a fine-tuned cybersecurity LLM and a 105-module automated offensive framework.
• Designed repeatable, automated tests of prompt injection, jailbreaking, and evasion tactics using PyRIT, Garak, and custom Python harnesses to measure safeguard resilience across models.
• Maintained technical currency through continued certification study, hands-on lab practice, and open-source publishing on GitHub and Hugging Face.

Security Analyst - II (Offensive Security / Penetration Testing & AI Red Teaming) at EY Global Delivery Services India LLP (2025-04 – 2025-09)

Focus: Offensive Security, VAPT & Penetration Testing

• Executed multi-layered penetration testing on enterprise web applications and network nodes utilizing Burp Suite, OWASP ZAP, and Kali Linux; uncovered high-to-critical vulnerabilities (SQLi, XSS, SSRF, authentication bypasses) and mapped remediation paths aligned with PTES and OWASP Top 10 guidelines.
• Conducted security assessments of SAP SuccessFactors (SF) cloud environments, evaluating Role-Based Permissions (RBP), auditing user provisioning workflows, and ensuring strict data privacy controls to safeguard sensitive employee PII.
• Conducted binary analysis and traffic capturing for Windows/Java-based thick client applications using Procmon, dnSpy, and Wireshark; exposed critical hardcoded credentials and insecure local API calls, assisting in remediation.
• Architected and executed a repeatable AI red teaming methodology for Generative AI and Large Language Model (LLM) applications using PyRIT and custom Python harnesses; audited and exploited vulnerabilities including Prompt Injection leading to Remote Code Execution (RCE), Prompt Code Injection, Model Manipulation, and Sensitive Data Leakage mapped to MITRE ATLAS and OWASP Top 10 for LLMs.
• Evaluated REST APIs based on OWASP API Security Top 10 using Postman and Burp Suite; identified and reported authentication flaws, Broken Object Level Authorization (BOLA), and improper information disclosure.

Associate Security Consultant at Cybersecurity NxxT Pvt Ltd (2023-07 – 2025-04)

Focus: VAPT, Web, Network & Mobile Security

• Spearheaded VAPT engagements for 80+ global projects across web, network, and mobile (iOS & Android) environments for enterprise clients in the GCC, US, India, and Europe.
• Uncovered and successfully demonstrated high-impact vulnerabilities including Remote Code Execution (RCE), Multi-Factor Authentication (MFA) and OTP bypasses, authorization logic bugs, and payment gateway flaws (e.g., negative payment transaction processing), safeguarding clients from critical compromise and substantial financial loss.
• Compiled clear, technical, and executive-level security reports detailing findings, CVSS severity ratings, and proof-of-concept (PoC) exploits; conducted validation scans to verify successful patching.
• Standardized corporate use of Nessus, Acunetix, Burp Suite, and Kali Linux for automated and manual network scans, reducing assessment turnaround times while maintaining rigorous quality.

Trainee Engineer at Cybersecurity NxxT Pvt Ltd (2023-01 – 2023-07)

Focus: Network Security, OSINT & Vulnerability Assessment

• Audited security postures of core banking platforms, internet banking portals, CRM systems, and ERP structures to prevent unauthorized privilege escalation and data theft.
• Executed network-level vulnerability scans using Nmap and Nessus; cataloged open ports, misconfigured network services, and outdated software packages, filtering out false positives.
• Assisted in dark web research and structured OSINT reconnaissance to support client red-teaming activities; drafted simulated phishing campaigns to test organizational resilience.

Intern - Security Testing at Zacco Cyber Security Pvt Ltd (2022-07 – 2022-12)

Focus: OWASP Top 10 Exploitation & Reconnaissance

• Maintained security scanning and exploitation activities under senior consultant supervision, discovering and exploiting OWASP Top 10 vulnerabilities, including Remote Code Execution (RCE), SQL injection, and cross-site scripting on client-facing websites.
• Assisted in target technology identification and information gathering stages, utilizing Spiderfoot, Shodan, and Nmap to map attack surfaces.
• Drafted initial draft reports summarizing discovered vulnerabilities, aligning findings with risk-based mitigation strategies.

Bachelor of Technology in Computer Technology – Bannari Amman Institute of Technology (2019-06 – 2023-04)