Sunil Palepu

Results-driven penetration tester with 11 years of experience performing offensive security assessments across web, mobile, API, cloud, and network environments. Experienced in manual and automated testing to identify and exploit complex vulnerabilities, including OWASP Top 10 issues, misconfigurations, and insecure design patterns. Strong background in application security, secure SDLC, and DevSecOps with hands-on expertise in SAST, DAST, SCA, and container security.

Proficient with industry-standard tools such as Burp Suite, OWASP ZAP, Nmap, Metasploit, Nessus, and Wireshark, and familiar with frameworks including OWASP ASVS, NIST, and MITRE ATT&CK. Adept at translating technical findings into actionable remediation guidance and partnering with engineering teams to reduce risk and improve overall security posture.

Application Security Engineer / Penetration Tester - Dark Rock Cybersecurity - Austin, TX

(2025-05)

• Conduct comprehensive penetration tests and vulnerability assessments for web, mobile (iOS/Android), and API-based applications using manual techniques, SAST/DAST tools, and custom scripts.
• Perform manual exploitation of identified vulnerabilities including SQL injection, XSS, CSRF, authentication bypass, and broken access control to validate impact and risk.
• Integrate automated security testing (SAST, DAST, SCA, container scanning) into CI/CD pipelines to enable continuous security validation and earlier defect discovery.
• Lead threat modeling and security design reviews to identify attack vectors and define preventative controls prior to implementation.
• Provide remediation guidance, secure coding recommendations, and security training to development teams while maintaining delivery velocity.
• Manage and prioritize findings based on risk, track remediation progress, and report metrics and KPIs to leadership.
• Support incident response for application-centric incidents, contributing forensic analysis, root-cause identification, and long-term control improvements.
• Ensure compliance with PCI-DSS, HIPAA, SOC 2, and GDPR through regular testing, documentation, and control validation.

Product Security Intern (Offensive Security Focus) - Sinch - Minnesota, USA

(2024-05 - 2024-12)

• Performed web application penetration testing using OWASP ZAP and Burp Suite, uncovering and documenting vulnerabilities such as SQL injection, XSS, and CSRF.
• Executed DAST-based security assessments aligned with project timelines, triaged results, and worked with teams on remediation strategies.
• Conducted manual testing of complex application logic to identify authorization flaws and business logic issues beyond automated scanner coverage.
• Created and maintained detailed penetration testing reports, including proof-of-concept exploits, risk ratings, and remediation recommendations.
• Advocated for application security best practices, contributing to increased security awareness across engineering teams.

Application Security Engineer / Penetration Tester - CDK Global - Hyderabad, India

(2019-11 - 2023-08)

• Performed penetration testing on key web and mobile products, identifying authorization flaws, injection vulnerabilities, and other OWASP Top 10 issues with a 95% remediation rate.
• Led security testing for iOS and Android applications, including static analysis, dynamic analysis, and manual penetration testing, remediating 200+ vulnerabilities.
• Executed SAST and SCA scans to identify insecure coding patterns and vulnerable third-party components before production deployment.
• Participated in threat modeling sessions to identify attack paths and recommend security controls and validation checks.
• Helped design a Product Security Scorecard & Catalog to measure and report product security maturity across the portfolio.
• Integrated security testing into CI/CD workflows, including Docker and Kubernetes security checks, reducing deployment-related security incidents.

Cybersecurity Analyst (Red Team & VA/PT) - Wipro - Chennai, India

(2019-06 - 2019-11)

• Conducted manual and automated web application and API penetration tests guided by OWASP standards, delivering detailed assessment and remediation reports.
• Participated in red team exercises to simulate real-world attacker behavior, uncover control gaps, and validate detection and response capabilities.
• Performed vulnerability assessments on Windows and Linux servers using Nessus, collaborating with infrastructure teams to remediate 300+ vulnerabilities.
• Used SIEM logs and threat hunting techniques to identify suspicious activity, reducing mean time to detection by 30%.

Infosec Test Engineer / Penetration Tester - Aricent - Bangalore, India

(2015-06 - 2019-05)

• Executed in-depth DAST-based web application security assessments, identifying and remediating more than 400 vulnerabilities including clickjacking and CORS misconfigurations.
• Performed penetration testing engagements for web applications, analyzing and reporting on findings to stakeholders and improving test plans based on results.
• Developed Python scripts using Nmap and WebSocket libraries to automate network reconnaissance and vulnerability scanning.
• Conducted container and Kubernetes security scans and implemented orchestration policies to enhance availability and security.

Masters - Cyber Security & Computer Science - Concordia University

Bachelor of Technology - Electronics and Communication Engineering - JNTU Kakinada University