Aseem is currently unavailable
Aseem Shrey
Verified Expert in Engineering
Vulnerability Assessment Developer
Pittsburgh, PA, United States
Toptal member since October 17, 2022
Bio
Aseem enjoys building DevSecOps pipelines and setting up automation using Go, Python, Terraform, CI/CD pipelines, AWS Lambda, and Google Cloud Platform (GCP), among others. To effectively manage infrastructure security at scale, he often builds fault-tolerant systems and automatic failure detection in these systems. Aseem reviews code changes going to production for security issues and frequently engages in web app penetration testing.
Portfolio
Self-employed
AI Security, Red Teaming, AWS IoT, Cloud, Metasploit
Local SEO Experts Inc.
IT Security, Webflow, Zapier, Salesforce, Airtable
Self-employed (Working with Clients in the US and Europe)
Android, Linux, Web, Web App Security, Red Teaming, Burp Suite, IT Automation...
Experience
- Vulnerability Assessment - 7 years
- Cybersecurity - 6 years
- Web Security - 6 years
- Burp Suite - 6 years
- Python - 5 years
- Go - 3 years
- Terraform - 2 years
- Google Cloud Platform (GCP) - 1 year
Preferred Environment
Python, Go, Kali Linux, OWASP Top 10, Android, Web Security, Red Teaming, AI Security, Dynamic Application Security Testing (DAST), Ethical Hacking
The most amazing...
...thing I’ve developed is a compliance as code (CaC) framework that scanned 10,000 Google Cloud Projects against CIS benchmarks.
Work Experience
Red Teaming Lead
2024 - 2025
Self-employed
- Led a red team of four security engineers responsible for adversary emulation across cloud, web, endpoint, and physical vectors for a consumer-facing product company.
- Performed AWS-focused red teaming for a major client: identified IAM misconfigurations, exposed over-privileged roles, and validated real-world lateral movement paths from compromised cloud identities to sensitive S3 buckets and databases.
- Discovered multiple critical vulnerabilities in customer-facing microservices and POS integrations; collaborated with engineering to remediate before public exposure.
- Reduced mean time to detect (MTTD) and mean time to respond (MTTR) by driving detection engineering improvements from red team findings; replaced noisy alerts with high-fidelity detections and reduced false positives.
- Implemented credential hygiene program (rotation, ephemeral roles, MFA enforcement, and secrets scanning) after red-team compromise scenarios demonstrated high impact of stale secrets.
Technologies: AI Security, Red Teaming, AWS IoT, Cloud, Metasploit
IT Security Specialist | Secure Webflow Sites
2024 - 2025
Local SEO Experts Inc.
- Helped secure Zapier workflows by adding robust spam filters and avoiding abuse of Zapier credits.
- Performed regular audits for client websites, including those hosted on Webflow.
- Set up Cloudflare for the client to ensure threats were mitigated at the very perimeter.
Technologies: IT Security, Webflow, Zapier, Salesforce, Airtable
Security Lead
2024 - 2025
Self-employed (Working with Clients in the US and Europe)
- Created a CVE bot issue tracker, clubbing similar issues based on the library and creating tickets on Jira for the same. Populated a CVE dashboard on Jira.
- Created a Python program to monitor changes to production Amazon S3 (AWS S3) buckets. Auto-reverted any dangerous configurations. Used Amazon EventBridge and AWS Lambda.
- Leveraged Trivy to automate container security in CI/CD pipelines. Gave the client real-time information on their security containers.
- Built security automation using Wazuh to enable monitoring and security end-to-end for the client across their stack.
Technologies: Android, Linux, Web, Web App Security, Red Teaming, Burp Suite, IT Automation, Python, Go, Google Cloud Platform (GCP), Security, Training, Jira, Confluence, IT Security, Security Testing, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Penetration Testing, iOS, Authentication, Vulnerability Identification, Cloud, APIs, Cybersecurity, Risk Management, SaaS, DevOps, Scraping, Data Protection, Architecture, Data-level Security, Azure, Cloud Security, SIEM, Amazon Web Services (AWS), OpenID, Chef, Puppet, OAuth, Data Privacy, Privacy, Intrusion Prevention Systems (IPS), AWS CloudFormation, AWS Lambda, Amazon API Gateway, API Gateways, Amazon S3 (AWS S3), Amazon RDS, Amazon Athena, Data Lakes, Database Security, Vulnerability Assessment, Security Analysis, Threat Modeling, Application Security, NIST, Identity & Access Management (IAM), Single Sign-on (SSO), Cloud Architecture, Security Architecture, DevSecOps, Secure Containers, Vanta, Information Security, Managed Security Service Providers (MSSP), Google Webmaster Tools, eCommerce, Infrastructure Security, Network Architecture, Secure Access Service Edge (SASE), Endpoint Security, Endpoint Detection and Response (EDR), Cloud Infrastructure, YAML, Automation, Azure Cloud Security, GitHub Actions, Azure Cloud Services, Azure DevOps, SOC 2, CI/CD Pipelines, GitHub, Security Information and Event Management (SIEM), Shell Scripting, Code Review, Source Code Review, Integrated Development Environments (IDE), Technical Writing, Writing & Editing
Technical Lead
2024 - 2024
Freelance Clients
- Helped deploy the Ghost blogging website for the client.
- Set up anonymous tracking with Umami, a privacy-preserving analytics platform.
- Wrote extensive documentation on self-hosting and privacy-preserving technologies as the team's technical writer.
Technologies: JavaScript, Python, Go
Technical Lead
2024 - 2024
HugoSave
- Led a team of developers and DevOps engineers to build the security platform for the banking arm of the company.
- Helped the team build a platform to manage the cloud security risk posture management using open source solutions such as Wazuh and Prowler.
- Wrote extensive technical documentation related to Kubernetes deployment and CI/CD auto-deployment for the company's internal tooling.
Technologies: Amazon Web Services (AWS), Google Cloud Platform (GCP), Azure, Cloud Security, AI Security, Web Security, Cybersecurity Automation
Cybersecurity Consultant
2024 - 2024
Cecilia Agnew
- Investigated some network attacks and Windows machine viruses on the client's personal network and devices.
- Worked on the security and privacy of personal devices and the home network, establishing a sanctuary of safe connectivity within the household.
- Kept the client informed about potential attack scenarios in their home network and provided guidance to maintain security.
- Helped the client fortify their personal computing space, ensuring that every keystroke, every stored document, and every user interaction remained under vigilant protection. Documented all the findings and investigations during the process.
Technologies: Security, IT Security, Certified Ethical Hacker (CEH), iOS
Security Engineer
2024 - 2024
Relay Hawk, Inc.
- Found three critical bugs on the client's internal portal that was up for penetration testing.
- Helped improve the cloud security posture of the application.
- Developed good relations with the client and hence suggested some internal tooling improvements.
Technologies: IT Security, Penetration Testing, OAuth, SAML, OpenID Connect (OIDC), OWASP Top 10, Burp Suite, Azure, Cloud Platforms, Technical Writing, Writing & Editing
Black-box Pen Tester for Security Assessment
2024 - 2024
Association for the Advancement of Sustainability in Higher Education, Inc
- Helped the client complete the black-box pentest with multiple roles for their web application. It was a web application with almost 20 different pages, four different roles, and access to critical data of their participating users.
- Found one critical and a few high and medium bugs that helped the client save sensitive info of their participating users.
- Advised the client on best measures and next steps to prevent these bugs in the future.
Technologies: Penetration Testing, IT Security, Security, Google Cloud Platform (GCP), Web Security, Automation, Technical Writing, Writing & Editing
Vulnerability Assessment Engineer
2023 - 2023
Yahoo! - Paranoids (Cybersecurity) - India
- Rewrote and optimized Python tooling for a vulnerability log management system. This was a cross team project, where I worked with other teams in Paranoids (security org in Yahoo).
- Migrated old security systems which was responsible for handling billions of input data points. I, along with three other people, only had access to these systems. These helped the security monitoring team to stay on top of any incidents that happened.
- Helped develop automation for StackStorm integration for wider adoption in the organization.
Technologies: Python, JavaScript, Amazon Web Services (AWS), DevOps, Infrastructure as Code (IaC), Vulnerability Management, Vulnerability Assessment, Kubernetes, CI/CD Pipelines, Docker Swarm, Amazon EKS, Amazon Virtual Private Cloud (VPC), Terraform, AWS CloudFormation, Information Security, Cybersecurity, Google Webmaster Tools, Infrastructure Security, Network Architecture, Secure Access Service Edge (SASE), Endpoint Security, Cloud Infrastructure, YAML, Automation, GitHub Actions, Azure Cloud Services, Azure DevOps, GitHub, Shell Scripting, Code Review, Source Code Review, Technical Writing, Writing & Editing
Security Engineer
2022 - 2023
Rippling
- Worked in the SecInfra team and built security automations through code. Built the Vulnerability Management System (VMS) backed by JIRA for centralizing all our security findings and enacting on them.
- Built a product security automation as part of the assurance team. This was used for doing automated dynamic application security testing (DAST). It was a self-serve portal for developers to upload their Postman collection for scanning.
- Worked with the ProdSec team and did threat modeling, code reviews, etc.
Technologies: Amazon Web Services (AWS), Terraform, Cloud Security, Threat Modeling, Automation, Web Security, Dynamic Application Security Testing (DAST), Web Application Firewall (WAF), Information Security, Cybersecurity, Google Webmaster Tools, Infrastructure Security, Network Architecture, Secure Access Service Edge (SASE), Endpoint Detection and Response (EDR), Cloud Infrastructure, YAML, Azure Cloud Security, Azure Cloud Services, SOC 2, CI/CD Pipelines, GitHub, SIEM, Shell Scripting, Product Security, Code Review, Source Code Review, Technical Writing, Writing & Editing
Senior Information Security Engineer
2021 - 2022
Gojek
- Built a Go framework to follow benchmarks and auto-remediation in Google Cloud. Optimized costs and real-time solutions.
- Executed pen tests for any feature release in the Gojek web API back end and Gojek Android application.
- Found critical vulnerabilities and escalated privileges to gain admin access to almost all Gojek infrastructure using a low-privileged 3rd-party account.
- Initiated regular code reviews for any feature release in the Gojek API or mobile application.
- Organized the first-ever security conference for Gojek. Included a Capture the Flag (CTF) competition and external and internal speakers over a span of two days.
- Managed Bugcrowd program with hundreds of researchers.
Technologies: Python, Go, JavaScript, Figma, Dart, Google Cloud Platform (GCP), GitLab, GitLab CI/CD, Cybersecurity, Burp Suite, Web Security, Web App Security, Kali Linux, Red Teaming, Security, Training, Jira, Confluence, IT Security, Security Testing, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Penetration Testing, OWASP, Mobile Security, Authentication, Vulnerability Identification, Cloud, APIs, Risk Management, SaaS, Scraping, Data Protection, Architecture, Data-level Security, Azure, Cloud Security, SIEM, Amazon Web Services (AWS), OpenID, Puppet, OAuth, Privacy, Intrusion Prevention Systems (IPS), AWS CloudFormation, AWS Lambda, Amazon API Gateway, API Gateways, Amazon S3 (AWS S3), Amazon RDS, Amazon Athena, Data Lakes, Database Security, Vulnerability Assessment, Bugcrowd, Security Analysis, Threat Modeling, Application Security, NIST, Identity & Access Management (IAM), Single Sign-on (SSO), Cloud Architecture, Security Architecture, DevSecOps, Information Security, Google Webmaster Tools, eCommerce, Infrastructure Security, Network Architecture, Cloud Infrastructure, YAML, Automation, Azure Cloud Security, Azure Cloud Services, CI/CD Pipelines, GitHub, Shell Scripting, Code Review, Source Code Review, Writing & Editing
Security Engineer
2019 - 2021
Blinkit
- Created an automated pipeline from scratch. Used Terraform to create DNS entries in Cloudflare and Amazon Route 53 with a failover option for easy switching to either of the DNS providers.
- Created a GitHub bot with a shift-left intention, bringing security closer to the developer workflow. Scanned for security issues like hardcoded secrets. Set up modular code for easy addition by team members.
- Integrated Vault with DB and GitHub so that users can generate temporary credentials for the database based on their GitHub team.
- Worked with multiple teams to integrate Amazon Cognito with legacy APIs. Provided better authentication workflows with OAuth and OTP-based workflows.
- Integrated an OAuth proxy for Google Workspace authentication and compliance with some of our internal applications.
- Managed a self-hosted public bug bounty program, working with teams to close those findings and maintaining the SLA.
Technologies: Python, Go, GitHub API, HTML, JavaScript, React, Flutter, Dart, Terraform, Vault, Ansible, Cloudflare, Burp Suite, Web Security, Web App Security, Red Teaming, Security, Training, Jira, Confluence, IT Security, Security Testing, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Penetration Testing, OWASP, Mobile Security, Authentication, Vulnerability Identification, Cloud, APIs, Cybersecurity, Risk Management, SaaS, DevOps, Scraping, Data Protection, Architecture, Data-level Security, Azure, Cloud Security, Amazon Web Services (AWS), OpenID, Chef, Puppet, OAuth, Intrusion Prevention Systems (IPS), AWS CloudFormation, AWS Lambda, Amazon API Gateway, API Gateways, Amazon S3 (AWS S3), Amazon RDS, Amazon Athena, Data Lakes, Vulnerability Assessment, Security Analysis, Threat Modeling, Application Security, NIST, Identity & Access Management (IAM), Cloud Architecture, Security Architecture, DevSecOps, Information Security, Google Webmaster Tools, eCommerce, Infrastructure Security, Network Architecture, Cloud Infrastructure, YAML, Automation, SOC 2, CI/CD Pipelines, GitHub, Shell Scripting, Source Code Review, Writing & Editing
DevOps Intern
2018 - 2018
Innovaccer
- Integrated health checks into applications whose metrics were further populated on Kibana dashboards for easy management of the services.
- Tracked metrics and automated alarm systems from Kibana dashboards. Integrated Slack webhook for alerts in specific channels.
- Created a generic Slackbot with a webhook for use by any team in the organization.
Technologies: Ansible, Automation, Jenkins, Authentication, Vulnerability Identification, Cloud, APIs, Cybersecurity, DevOps, Scraping, Architecture, Data-level Security, Azure, Cloud Security, Amazon Web Services (AWS), Chef, OAuth, AWS CloudFormation, AWS Lambda, Amazon API Gateway, API Gateways, Amazon S3 (AWS S3), Amazon RDS, Amazon Athena, Data Lakes, Database Security, Vulnerability Assessment, Security Analysis, Threat Modeling, Application Security, Cloud Architecture, Security Architecture, DevSecOps, Information Security, Cloud Infrastructure, YAML, GitHub, Shell Scripting, Technical Writing, Writing & Editing
Experience
Unified Payments Interface (UPI) Recon Command Line Interface (CLI)
https://github.com/LuD1161/upi-recon-cliDeveloped a command line tool for reconnaissance using a virtual payment address. This tool leverages the openness available with the UPI platform to find:
1. The UPI ID and name associated with a mobile number
2. The UPI ID and name associated with a Gmail account
3. The UPI ID and name associated with a vehicle registration number.
I made sure that leverage a UPI ID associated with a FASTag.
1. The UPI ID and name associated with a mobile number
2. The UPI ID and name associated with a Gmail account
3. The UPI ID and name associated with a vehicle registration number.
I made sure that leverage a UPI ID associated with a FASTag.
Automated Compliance as Code Framework
Developed a Go framework (previously Python) to follow benchmarks and auto-remediation in Google Cloud. Optimized costs and real-time solutions.
This framework actively checked more than 350 active projects, excluding the sys- projects.
Firewall rules > 4000.
Storage buckets > 1000.
All the metrics of the scan were sent to the ELK stack and displayed with Kibana dashboards for easier metric-driven decisions.
I also created automated ticketing based on these checks; if there was a new finding, the framework created tickets on the respective team's Jira queue.
The framework is modular enough so that engineers can write their own checks and schedule them to run when the whole set of checks is run. Or they can mark it to run on only specific GCP projects too.
This framework actively checked more than 350 active projects, excluding the sys- projects.
Firewall rules > 4000.
Storage buckets > 1000.
All the metrics of the scan were sent to the ELK stack and displayed with Kibana dashboards for easier metric-driven decisions.
I also created automated ticketing based on these checks; if there was a new finding, the framework created tickets on the respective team's Jira queue.
The framework is modular enough so that engineers can write their own checks and schedule them to run when the whole set of checks is run. Or they can mark it to run on only specific GCP projects too.
OmniSec App
Initially built as a React Native app and then translated to a Flutter app that I developed to supply daily security updates to all the app subscribers.
The database was built on Firebase and Cloud Functions to populate the database every 15 minutes. The front end was built on the Flutter framework.
It collected news articles from 30 sources (RSS feeds and web scraping) and collated a unique list of articles every 15 minutes.
The database was built on Firebase and Cloud Functions to populate the database every 15 minutes. The front end was built on the Flutter framework.
It collected news articles from 30 sources (RSS feeds and web scraping) and collated a unique list of articles every 15 minutes.
Top CTF Player and Bug Bounty Researcher
https://aseemshrey.in/blogI've been a CTF player with world finalists three times in a row at NYU's CSAW CTF (India region). I've also been in the top five world finalists for NullCon CTF 2017, sponsored by VMWare and Walmart Labs.
Apart from CTFs, I have reported security bugs and have received similar awards from top companies like Google, Myntra, IBM, Sony, GM, MakeMyTrip, Zoho, etc.
Found a critical bug in the DigiLocker initiative by the Government of India (Hall of Fame - https://developers.digitallocker.gov.in/credits-community-contribution.html)
Ranked amongst the top ten in DRDO CTF organized by the Government of India ( https://blog.mygov.in/result-announcement-of-drdo-cyber-challenge/#:~:text=Pushpender%20Yadav-,Aseem%20Shrey,-Abhishek%20Acharya).
Apart from CTFs, I have reported security bugs and have received similar awards from top companies like Google, Myntra, IBM, Sony, GM, MakeMyTrip, Zoho, etc.
Found a critical bug in the DigiLocker initiative by the Government of India (Hall of Fame - https://developers.digitallocker.gov.in/credits-community-contribution.html)
Ranked amongst the top ten in DRDO CTF organized by the Government of India ( https://blog.mygov.in/result-announcement-of-drdo-cyber-challenge/#:~:text=Pushpender%20Yadav-,Aseem%20Shrey,-Abhishek%20Acharya).
DNS as Code
Created an automated pipeline from scratch using Terraform and Jenkins to create DNS entries in Cloudflare and Route53 with a failover option for easy switching to either of the DNS providers.
This helped our shift-left approach, reducing manual errors and improving the developer experience.
This helped our shift-left approach, reducing manual errors and improving the developer experience.
G-Shield Security Bot
Created from scratch a GitHub bot with the intention of shift-left, bringing security closer to the developer workflow. It scans each PR for common security issues like hardcoded secrets, code smells, vulnerable Docker images, sensitive mount points, etc. The code is modular; new modules have been easily added to it by other team members, e.g., a TFLint module.
GoSecCon - Security Conference Organizer [Evangelization]
Organized the first-ever security conference of GoJek, which included a CTF competition + external and internal speaker talks over a span of two days.
The CTF platform was hosted on Kubernetes and used CTFd as an open source CTF platform.
Challenges were created by myself and my teammates. This included web application challenges, digital forensic challenges, steganography challenges, vulnerable Android application challenges, etc.
The CTF platform was hosted on Kubernetes and used CTFd as an open source CTF platform.
Challenges were created by myself and my teammates. This included web application challenges, digital forensic challenges, steganography challenges, vulnerable Android application challenges, etc.
Education
2015 - 2019
Bachelor's Degree in Computer Science
Indian Institute of Information Technology - Allahabad, India
2012 - 2014
Higher Secondary Diploma in Physics, Chemistry, Math
Delhi Public School - Delhi, India
Skills
Libraries/APIs
OpenID, GitHub API, React, Jira REST API
Tools
GitHub, Google Webmaster Tools, OWASP Zed Attack Proxy (ZAP), Terraform, Jira, Confluence, Chef, AWS CloudFormation, Amazon Athena, Vault, Ansible, Figma, GitLab, GitLab CI/CD, ELK (Elastic Stack), Jenkins, Celery, SonarQube, Google Kubernetes Engine (GKE), Puppet, Docker Swarm, Amazon EKS, Amazon Virtual Private Cloud (VPC), Zapier, Metasploit
Languages
Python, YAML, Go, HTML, JavaScript, Dart, SAML
Paradigms
Automation, Penetration Testing, DevSecOps, Azure DevOps, DevOps, Continuous Integration (CI), Continuous Deployment
Platforms
Kali Linux, Burp Suite, Azure, Amazon Web Services (AWS), AWS Lambda, Android, Google Cloud Platform (GCP), Vanta, Linux, Web, Firebase, Docker, Kubernetes, iOS, Bugcrowd, Webflow, Salesforce, AWS IoT
Industry Expertise
Cybersecurity
Storage
Amazon S3 (AWS S3), Azure Cloud Services, Data Lakes, Database Security
Frameworks
Flutter, React Native
Other
OWASP Top 10, Web Security, Ethical Hacking, Security, Training, IT Security, Security Testing, Static Application Security Testing (SAST), OWASP, Mobile Security, Authentication, Vulnerability Identification, Cloud, APIs, Risk Management, SaaS, Scraping, Data-level Security, Cloud Security, SIEM, OAuth, Intrusion Prevention Systems (IPS), Amazon API Gateway, API Gateways, Amazon RDS, Vulnerability Assessment, Security Analysis, Threat Modeling, Application Security, NIST, Identity & Access Management (IAM), Single Sign-on (SSO), Cloud Architecture, Security Architecture, CI/CD Pipelines, Information Security, Infrastructure Security, Endpoint Security, Cloud Infrastructure, Azure Cloud Security, GitHub Actions, SOC 2, Security Information and Event Management (SIEM), Shell Scripting, Code Review, Source Code Review, Technical Writing, Writing & Editing, Red Teaming, Dynamic Application Security Testing (DAST), Data Protection, Architecture, Data Privacy, Privacy, Managed Security Service Providers (MSSP), eCommerce, Network Architecture, Endpoint Detection and Response (EDR), Networking, Web Development, Cloudflare, Design, Web App Security, English, Physics, IT Automation, Job Schedulers, Burp Proxy, Version Control Systems, Organization, Teamwork, Product Evangelism, Tech Conferences, Infrastructure as Code (IaC), Vulnerability Management, Web Application Firewall (WAF), Secure Containers, Secure Access Service Edge (SASE), Product Security, Integrated Development Environments (IDE), Host Based Security System (HBSS), OpenID Connect (OIDC), Cloud Platforms, Certified Ethical Hacker (CEH), Airtable, AI Security, Cybersecurity Automation
Collaboration That Works
How to Work with Toptal
Toptal matches you directly with global industry experts from our network in hours—not weeks or months.
1
Share your needs
Discuss your requirements and refine your scope in a call with a Toptal domain expert.
2
Choose your talent
Get a short list of expertly matched talent within 24 hours to review, interview, and choose from.
3
Start your risk-free talent trial
Work with your chosen talent on a trial basis for up to two weeks. Pay only if you decide to hire them.
Top talent is in high demand.
Start hiring