Sthitaprajna Biswal

Cloud Security Engineer with 2.5+ years securing FinTech and BFSI platforms on GCP and AWS — specializing in GCP-native security architecture, identity governance, threat detection, and application VAPT. Proven track record reducing cloud attack surface, closing critical CVEs, and delivering PCI DSS v4.0.1, ISO 27001:2022, and SOC 2 Type 2 compliance for NPCI, UIDAI, and major Indian banks including Axis Bank, Bank of Baroda, and Kotak Mahindra.

Information Security Engineer / Penetration Tester at iServeU Technology Pvt. Ltd. (2023-12 – Present)

• Cloud IAM & Attack Surface Reduction: Enumerated and remediated misconfigurations across 92+ GCP Cloud Storage buckets and over-privileged IAM roles; enforced least-privilege IAM, private bucket policies, and CMEK via Cloud KMS — eliminating 100% of identified public exposure paths with zero production impact.
• GKE & Container Security: Deployed and tuned Nessus across 200+ GCP services and GKE nodes; triaged 38 critical/high CVEs to full closure within 30 days, reducing overall container attack surface by ~72%; applied CIS Benchmarks across containerised workloads.
• Sensitive Data Protection & DLP: Identified PAN and Aadhaar exposure across 6 legacy banking endpoints and 3 misconfigured Cloud Storage buckets; engineered a Google DLP API pipeline (Python 3.10) classifying and masking PCI/PII data across 500+ daily transactions — aligned to Sensitive Data Protection and VPC Service Controls best practices.
• Internal Infrastructure VAPT: Conducted VAPT of GCP Compute instances, VMs, and Kubernetes nodes, uncovering 3 privilege escalation paths and 5 lateral movement vectors; proposed network segmentation and service hardening controls implemented across 200+ internal services.
• Web Application VAPT: Led 50+ full-scope penetration tests against FinTech, BFSI, and payment platforms using Burp Suite Pro — uncovering 200+ unique vulnerabilities including IDOR, auth bypass, SSRF, XXE, SQL injection, stored/reflected XSS, CSRF, and broken access controls; all engagements closed with exploit-backed PoC reports and remediation playbooks aligned to OWASP Top 10.
• REST & SOAP API Security: Performed targeted API assessments on BBPS, UPI, and payment gateway integrations — validated auth flows, token handling, rate-limiting, BOLA/IDOR, mass assignment, and business logic flaws; identified and closed 12 critical/high findings in IndusInd Bank API integrations within 3 weeks ahead of compliance deadline.
• Mobile Application Security: Executed Android and iOS VAPT covering insecure data storage, session management, APK reverse engineering, certificate pinning bypass, and traffic interception via Burp Suite Pro — uncovering deeplinked injection paths across mobile payment apps deployed to millions of end-users.
• AppSec Architecture & Threat Modeling: Delivered threat-aware architecture reviews and DFDs for 8 payment platforms, mapping 40+ design-level attack vectors across trust boundaries; recommendations reduced architecture-level findings in subsequent VAPT cycles by ~55%.
• SIEM Deployment & Tuning (Wazuh): Implemented Wazuh SIEM from scratch with 20+ custom detection rules, reducing false-positive alert volume by 45% while increasing true-positive detection rate; tuning insights fed directly into red-team stealth and evasion techniques for subsequent engagements.
• Cryptojacking Incident Response: Led red-team-style investigation of a live cryptojacking incident — traced initial access and 2 persistence mechanisms (malicious cron/systemd); authored 6 new Wazuh detection rules cutting MTTD for similar attacks by ~80%; detection logic directly applicable to Chronicle Security Operations and Cloud Audit Logs pipelines.
• Security Automation: Built Python, Bash, and Google Apps Script pipelines (JIRA REST API) automating VAPT ticket tracking, risk dashboards, and SLA breach alerts — improving high-risk finding closure rates by 35% and reducing manual reporting effort by ~8 hours/week.
• Delivered 8 end-to-end security audits (PCI DSS v4.0.1, ISO 27001:2022, SOC 2 Type 2, UIDAI AUA/KUA, NPCI, RBI guidelines) for clients including Axis Bank, Bank of Baroda, Kotak Mahindra, UCO Bank, NSDL, Indus Bank, and Slice — achieving full closure with zero non-conformance carry-overs; all findings framed with exploit narratives and remediation playbooks.
• Cloud Threat Emulation: Led adversarial simulation targeting GCP privilege escalation paths (x3) and lateral movement vectors (x5) across production segments; identified unauthenticated MQTT broker in AWS payment services capable of manipulating live financial transactions — built full PoC and drove mTLS/ACL hardening across 4 microservices before regulatory exposure.
• OSINT & External Recon: Used SpiderFoot to map external attack surfaces of 10+ partner organisations, identifying 25+ shadow IT assets and exposed subdomains; reduced unmonitored external attack surface by ~40% post-remediation.
• Wireless Penetration Testing: Identified WEP/WPA weaknesses and 4 rogue access points across campus networks adjacent to payment infrastructure; validated WPA3 migration and VLAN-based segmentation fully isolating payment systems from corporate traffic.

Bachelor of Technology in Computer Science & Engineering – Veer Surendra Sai University of Technology (VSSUT) (2020 – 2024)

Intermediate (+2 Science) in Computer Science – DAV Public School Pokhariput (2018 – 2020)

Matriculation in Computer Science – Saint Lawrence School (2008 – 2018)