Yash Kumar.

Performed external reconnaissance on a challenge target combining passive OSINT with active scanning (Nmap port and service scanning, subdomain enumeration, Shodan and Censys lookups, web content and vulnerability scanners). Delivered a 23-page report from 120+ intelligence items covering email security posture (MX, SPF, DMARC) with cross-validated findings and five prioritised attack chains with mitigations.

Identified, with a colleague, a publicly accessible spreadsheet of student data at an Indian college. Documented the exposure and evidence and handled the full disclosure chain through CERT-In, UIDAI, and UGC escalations with follow-up.

Designed a shift-left security programme with approximately 120 controls encoded as YAML and enforced through a CI pipeline gate, GitHub secret scanning, and Terraform/Bicep reference architectures. Automated STRIDE and PASTA threat exports into Jira tagged with control IDs. Designed Microsoft 365 Copilot security baselines (Purview labels and DLP, Entra ID Conditional Access, Secure Score uplift) and Sentinel alert queries with SOC playbooks. Planned a six-sprint £220,300 programme with a compliance evidence pack mapped to ISO 27001 and NIST AI-RMF, aligned to EU AI Act and ISO 42001.

Delivered a multi-cloud AI security architecture spanning AWS, GCP, Azure, and OCI as one of five team members. Presented the security strategy to a Big Four firm's CISO.

Designed a three-zone cloud architecture with Zero Trust controls (SSO, MFA, RBAC, just-in-time access), SIEM detection-rule logic, an incident response runbook, and a STRIDE threat risk register with preventive, detective, and corrective controls aligned to NIST CSF and GDPR.

Evaluated ISO 27001, IEC 62443, COBIT 2019, and NIST CSF for an airport with no ISMS. Recommended a hybrid NIST CSF and IEC 62443 approach and built a STRIDE-based, CVE-referenced risk register for 10 IIoT devices (including CVE-2017-7921/7923 — Hikvision authentication bypass and privilege escalation) with a cost-benefit analysis of mitigations and GDPR/DPA 2018 compliance assessment.

Built a Python banking application with PBKDF2 password hashing, TOTP two-factor authentication, AES-256 encryption, PGP messaging, TLS 1.3, and RBAC across three user roles (Customer, Employee, Admin). Evaluated its weaknesses — rate limiting, CSRF, secrets management, logging — in a critical review. Stack: Python, Flask, PyCryptodome, PGPy, PyOTP, SQLite.

Investigated a seized Windows laptop and dashcam image using FTK Imager, Autopsy, and GPSXEE. Verified evidence integrity by hash, analysed registry, prefetch, and jump-list artefacts, and classified malware with Microsoft Defender and VirusTotal. Produced a court-standard investigation report.

Configured a segmented network in Cisco Packet Tracer: VLANs, a zone-based firewall, ACLs enforcing least privilege, a site-to-site IPSec VPN, AAA (TACACS+), and WPA2 wireless access points.