BASED IN BENGALURU

Chirag Arora

Cybersecurity Professional

VAPT · Application Security · Security Engineering

Finding the vulnerability is the easy part. Translating it into business risk — and getting it fixed — is the job.

security-session — zsh

150+

Applications & APIs Tested

500+

Findings Identified & Closed

20+

Projects Delivered

3

Professional Certifications

4+

Years in Security Consulting

About

Security is a decision problem before it's a technical one.

A vulnerability report is only useful if someone acts on it. Over four years across consulting engagements in Finance, Healthcare, and Government, that’s been the throughline — running the full VAPT and vulnerability management lifecycle, then making sure the result lands as a decision a client can act on, not a PDF they file away.

That means going deep technically — network, OS configuration, and web application testing, much of it inside PCI DSS-scoped, on-site engagements — and translating it upward into executive summaries and risk reports that hold up in a room with people who don’t read CVE identifiers for a living. It also means running the engagement itself: planning, resourcing, and governance across concurrent assessments, not just the testing inside them.

What I Do

01

Web Application VAPT

Vulnerability assessment and penetration testing across authentication, session, and business-logic layers.

02

Network & Infrastructure Security

Network security reviews and OS configuration hardening assessments.

03

Compliance-Driven Assessment

PCI DSS-scoped engagements run on-site, aligned to regulatory and audit requirements.

04

Engagement Governance & Reporting

Executive summaries and risk reports that turn technical findings into decisions clients can act on.

05

Resource & Program Management

Workforce planning, OKR-driven backlog management, and delivery across concurrent engagements.

Education

  • M.S., Cyber Security and Forensics

    Southern New Hampshire University

    Aug 2024 - Oct 2026

  • MBA, Information Technology

    Lovely Professional University

    Nov 2022 – Aug 2025

  • B.E., Computer Science

    BMS Institute of Technology and Management

    Jul 2018 – Sept 2022

Recognition

  • Best Client Recognition
  • CyRAACS - Top Performer
  • Top 10% on TryHackMe

Experience

From hands-on testing to leading the engagement.

A vertical record of the roles that built the way I work today.

Associate Manager

Jul 2026 – Present · Bengaluru
  • Provide technical and managerial leadership for cybersecurity engagements, overseeing end-to-end VAPT activities, project planning, resource allocation, quality, and timely delivery.
  • Lead and mentor security teams, ensuring effective utilization, capability development, performance management, and adherence to organizational processes and standards.
  • Manage client and stakeholder relationships, facilitating technical discussions, requirement alignment, escalations, reporting, and remediation coordination.
  • Drive process improvement, security governance, automation, and operational excellence, while providing management with actionable insights through security metrics and performance reporting.

Team Lead

Jul 2025 – Jun 2026 · Mumbai
VAPT Program GovernanceExecutive ReportingResource Management
  • Enabled strategic decision-making by providing clear, actionable executive summaries and risk reports to clients.
  • Accountable for the planning, execution, and governance of large-scale VAPT initiatives, ensuring compliance with regulatory standards and business risk posture.
  • Drove resource management and workforce planning, ensuring optimal team utilization, skill alignment, and proactive risk mitigation across concurrent engagements.

Senior Consultant - Information Security and Compliance

Jul 2023 – Jun 2025 · Mumbai · On-site
PCI DSSNetwork SecurityOS Configuration ReviewWeb Application Review
  • Partnered closely with Information Security and Compliance stakeholders on PCI DSS-scoped projects, driving on-site assessment activities, engagement closure, and remediation support.
  • Led vulnerability and security assessments including Network, OS Configuration, and Web Application reviews; coordinated quarterly OKR planning, security backlog management, resource allocation, and reprioritization.
  • Developed project deliverables and reports, supported clients with remediation efforts, and collaborated on defining step-by-step operational procedures.

Consultant - Technical Services

May 2022 – Jun 2023
Web Application VAPTFinanceHealthcareGovernment
  • Conducted comprehensive Web Application Vulnerability Assessments and Penetration Testing (VAPT) across Finance, Healthcare, and Government sectors, identifying attack vectors and vulnerabilities using industry-standard tools and methodologies, and recommending effective remediation strategies.
  • Prepared detailed security reports and project deliverables, supported clients through remediation efforts, and communicated complex technical findings to non-technical stakeholders while contributing to step-by-step operational procedures.

Expertise

Skills & Competencies

Professional and technical skills developed through hands-on experience and continuous learning.

Professional Skills

Leadership & Management

  • Team Leadership
  • Mentoring
  • Project Management
  • Resource Planning
  • Strategic Planning

Professional Skills

  • Microsoft Office Suite
  • Risk Assessment
  • Stakeholder Management
  • Technical Documentation
  • Report Writing

Compliance & Governance

  • PCI DSS
  • ISO 27001
  • Regulatory Compliance
  • Risk Management
  • Security Auditing

Technical Skills

Programming Languages

  • Python
  • JavaScript/TypeScript
  • Bash/Shell

Web & Backend

  • React
  • Node.js
  • MongoDB
  • REST APIs

Operating Systems

  • Linux
  • Windows
  • Kali Linux

Engineering

Tools I Built

Security engineering projects that improved team efficiency, training, and vulnerability management.

VAPT Ticket Auto-Assignment Portal

Intelligent ticket routing and assignment system for vulnerability assessments across web, mobile, API, network, and payment gateway tracks.

Problem Solved

Manual ticket assignment was time-consuming and prone to bottlenecks, slowing down vulnerability validation and remediation cycles.

Impact

  • • Reduced manual assignment overhead by 70%
  • • Saved 2+ hours per sprint in administrative work
  • • Serves 18+ concurrent team members

Stack

ReactNode.jsPostgreSQL

Infra VAPT Tracking Portal

Centralized vulnerability management and tracking system with automated SLA calculations and activity monitoring.

Problem Solved

Infrastructure vulnerability data was scattered across multiple systems, making it difficult to track remediation progress and calculate service-level compliance.

Impact

  • • Centralized data hub for all infrastructure assessments
  • • Automated SLA tracking and calculation
  • • Single source of truth for vulnerability management

Stack

ReactNode.jsPostgreSQL

MasterCTF

Cyberpunk-themed CTF and hacking simulation platform with RPG-style progression, hands-on challenges, and adaptive difficulty.

Problem Solved

Junior testers needed structured training environment to develop practical security testing skills through real-world scenarios.

Impact

  • • Trained 20+ junior security professionals
  • • 2000+ challenge attempts across the platform
  • • Gamified learning approach increased engagement

Stack

ReactNode.jsMongoDB

Capability Map

Security Toolkit

The tools behind the methodology, grouped by where they're used.

Application Security

  • Burp Suite Pro
  • OWASP ZAP
  • Postman
  • SQLMap

Network & Infrastructure

  • Nmap
  • Nessus
  • Wireshark
  • Nipper

Mobile Security

  • MobSF
  • Frida

Certifications

Credentials

Contact

Let’s secure something.

Whether you’re looking for

Security AssessmentApplication SecuritySecurity EngineeringConsultingCollaboration

Let’s talk.