Muhammad Haris

Senior Application Security Engineer with 9+ years of engineering experience, specializing in securing high-scale web applications, mobile platforms, and cloud infrastructure. Proven track record of driving "shift-left" security, leading threat modeling, and enforcing secure-by-default architectures across microservices. Expert in integrating SAST/DAST tools within CI/CD pipelines, managing vulnerability triage, and establishing secure SDLC best practices.

Strong proficiency in Python, JavaScript, AWS, Kubernetes, and mentoring cross-functional teams to foster a security-first culture.

Principal Application Security Engineer - Codesy

(2024-02)

• Lead threat modeling and secure design reviews for enterprise cloud platforms and microservices, ensuring secure-by-default architectures.
• Drive "shift-left" security initiatives by successfully integrating SAST and DAST tools directly into GitHub Actions and Docker-based CI/CD pipelines.
• Assess, prioritize, and remediate security risks across AWS infrastructure, backend Node.js applications, and React-based frontends.
• Manage third-party dependency risks and mitigate vulnerabilities in external libraries across the software supply chain.
• Act as a security champion, defining application security best practices for the SDLC and mentoring engineering teams on secure coding standards.

Lead Application Security Engineer - Lime Software

(2022-09 - 2024-01)

• Led the secure rebuild and cloud migration of a high-availability SaaS platform, deploying scalable security solutions across AWS infrastructure.
• Conducted advanced static (SAST) and dynamic (DAST) analysis across backend microservices and React Native mobile applications.
• Designed and implemented robust authentication mechanisms, role-based access control (RBAC), and secure API access patterns (REST/GraphQL).
• Led vulnerability triage and remediation efforts in close collaboration with the core development and QA teams.
• Secured on-premise to AWS cloud migrations, utilizing Terraform and enforcing strict IAM and networking security policies.

Senior Full Stack & Security Engineer - Right Solutions

(2019-05 - 2022-08)

• Modernized enterprise applications with a focus on web security principles, integrating OAuth, JWT, and enforcing SSL/TLS across all services.
• Automated secure deployments using Docker and AWS CodePipeline, effectively bridging the gap between development and security operations.
• Designed backend APIs with strict data validation, auditing, caching, and rate-limiting to protect against common web vulnerabilities.
• Optimized database and network security, establishing audit logging for high-volume transactions to ensure data integrity and compliance.

Software Engineer (Web & Mobile) - Kingdom Vision

(2017-03 - 2019-04)

• Developed and secured B2B applications and mobile solutions, integrating secure third-party communication and payment APIs.
• Improved deployment safety and system stability by introducing secure infrastructure practices using Jenkins and Docker.
• Collaborated across teams to enforce early-stage security checks and maintain production-ready, secure web and mobile applications.

Software Developer - PolyWeb Tech

(2016-04 - 2017-02)

• Built and maintained CMS and e-commerce platforms using PHP, JavaScript, and MySQL.
• Integrated secure payment gateways and API endpoints while sanitizing inputs to prevent injection attacks and cross-site scripting (XSS).

Bachelor's Degree - Computer Science