Staff Information Security Engineer

Leading Illumina's Product and Application Security efforts within the Cyber Security team.

• Performing risk assessments on Illumina’s cloud services via design reviews, architecture reviews and custom security questionnaires, involving ~100 developers across multiple development teams.
• Performing manual web application penetration tests against Illumina's cloud services. Identified and helped fix several critical bugs in public facing cloud infrastructure and applications.
• Helping developers fix security issues discovered via manual security code reviews and static source code analysis.
• Promoting policies and processes around secure coding, static source code analysis and dynamic application security testing across instrument and cloud product teams.
• Promoting security best practices and providing direction for compliance with standards and regulations like OWASP, NIST, HIPAA and FDA guidelines to cross-functional teams consisting of members from engineering through customer support.
• Designing, developing and maintaining infrastructure for code signing. Developed and maintain an internal online code signing system that integrates with Illumina's CI/CD pipelines for instrument software and allows build agents to sign installers and executables via an authenticated REST API. The system supports signing EXE, MSI, JAR, APK and RPM files and signs 50-100 executables per day.
• Managing Illumina's PKI and HSMs. Maintaining internal and product Root CAs, intermediate CAs, certificate templates and instrument platform keys/certificates used for code signing and ensuring installers/executables are authenticated on instruments.
• Determining and enforcing core OS security requirements for Windows and Linux based instruments and application servers, which includes everything ranging from simple password policies to complex Windows SRP or SELinux configuration.
• Developing scripts and automation for the Cyber Security team’s orchestration efforts.
• Performing 3rd party vendor security assessments.

Senior Product Security Engineer

• Performed risk and threat analysis and provided recommendations for mitigation of security threats for home networking and IoT products.
• Helped internal divisions and teams establish processes to embed security at various stages in their software development cycle.
• Improved the security posture of products by assessing and mitigating risk via security code reviews in components ranging from low-level system services to web interfaces.
• Sample Projects:
  • End-to-end secure design and risk analysis of the 2Net wireless health platform and mobile application.
  • Manual security code review of multiple QSEE (Qualcomm’s TrustZone solution) applications.
  • Secure protocol design and manual security code review for an over-the-air licensing and activation service that allows OEMs to license and activate Qualcomm software components on after-market devices.
  • Defined secure default configuration for Qualcomm Atheros router firmware builds (based on OpenWRT) which ship with proprietary and open source software.
  • Incident response for Snapdragon Web Engine.
  • Porting and testing an IDS/IPS based on Suricata for Qualcomm Atheros router and IoT chips.

Associate Consultant Intern

• Performed manual and automated penetration tests using (formerly) IBM Rational AppScan for numerous web applications for a reputed client in the banking domain.
• Participated in several client-facing reporting calls explaining discovered vulnerabilities, exploits and mitigation steps to the client.

Software Engineer

• Performed manual and automated testing for products in the IBM Cognos 8 Business Intelligence suite. Managed defect reporting and bug verification for these products.
• Developed features and bug fixes for the several products in the IBM Cognos Series 7 suite.
• Lead the development of a major feature for Cognos 7 that involved creating a custom XML parser to parse excessively large XML files.

• Awarded ‘Qualstar’ for exceptional contributions to two projects at Qualcomm.
• Awarded two ‘Certificates of Excellence’ at Infosys and was chosen as the ‘Rookie of the Year’ at unit level in September 2008 for exceptional work and for involvement in various account level activities.
• Multiple other ‘Spot Awards’ at Infosys.

MS Information Security

GPA - 3.77

http://www.gatech.edu

BE Computer Engineering

First Class with Distinction

http://www.ddu.ac.in