Akashsheshan Ramanadhan

Results-driven penetration tester with nearly 5 years of hands-on experience delivering Vulnerability Assessment and Penetration Testing (VAPT) across web applications, APIs, network infrastructure, and cloud environments. Skilled at identifying, validating, and exploiting security vulnerabilities through both manual and automated testing, with deep command of the OWASP Top 10, OWASP API Security Top 10, and white-box source code review. Hands-on with industry-standard tooling including Burp Suite Professional, Nessus, Metasploit, Nmap, and Kali Linux.

Proven track record of producing detailed security assessment reports with risk ratings and prioritised remediation recommendations, partnering with development and infrastructure teams to remediate findings, and re-testing fixes to verify successful closure. Holds seven OffSec certifications — including the OffSec Web Expert (OSWE) — and is actively preparing for the OSCP exam.

Application Security Engineer / Penetration Tester at Virtusa (2026-02 – Present)

Wiley engaged as a client following Virtusa's acquisition of Wiley Sri Lanka

• Deliver end-to-end VAPT engagements across web applications, APIs, and cloud-hosted infrastructure (AWS/Azure) for enterprise clients including Wiley, combining manual exploitation with automated scanning.
• Identify, validate, and exploit vulnerabilities spanning the OWASP Top 10 and OWASP API Security Top 10 — SQLi, XSS, CSRF, IDOR, SSTI, command injection, SSRF, insecure deserialization, and broken authentication — using Burp Suite Professional, Nessus, and custom exploit scripts.
• Perform white-box source code review and threat modelling of new features, enforcing OWASP controls through SAST (Checkmarx) and DAST (OWASP ZAP) integrated into CI/CD pipelines.
• Produce detailed assessment reports with CVSS-based risk ratings and prioritised remediation guidance, then re-test fixes to verify successful closure.
• Partner with development and DevOps teams to embed security into the SDLC and provide actionable remediation support, preventing production-level exploits.

Application Security Engineer / Penetration Tester at Wiley (2024-12 – 2026-02)

• Performed manual and automated penetration testing of web applications and APIs, targeting SQLi, XSS, CSRF, IDOR, SSTI, command injection, SSRF, and broken authentication.
• Conducted white-box source code reviews and threat modelling, enforcing OWASP controls with SAST (Checkmarx) and DAST (OWASP ZAP) tooling.
• Built and maintained AppSec automation within CI/CD pipelines using Burp Suite Professional to gate builds and track vulnerability-remediation SLAs.
• Authored detailed security reports, technical guidelines, and remediation recommendations, and re-tested fixes to confirm closure and strengthen overall security posture.

Cybersecurity Engineer (Penetration Tester) at Scybers (2022-01 – 2024-12)

Cybersecurity Advisory & Managed Services

• Conducted black-box and white-box VAPT of web applications across diverse client environments using the OWASP Testing Guide methodology.
• Executed API security testing aligned to the OWASP API Security Top 10, identifying authentication, authorisation, and injection vulnerabilities.
• Performed network penetration testing and host assessments using Nmap, Nessus, Metasploit, Burp Suite, Nikto, Nuclei, and Netcat on Kali Linux, producing detailed reports prioritised by risk severity.
• Delivered phishing simulation assessments and security awareness training for enterprise clients.
• Identified multiple critical and high-severity vulnerabilities — including SQL injection, privilege escalation, and insecure API endpoints — and provided remediation guidance that measurably improved client security posture.
• Contributed to internal penetration testing methodologies and standardised reporting templates, improving delivery consistency and team efficiency.

Bachelor of Science in Cyber Security – Edith Cowan University