Shradha Karhekar
Cyber Security Consultant | VAPT | Penetration Tester
10 years securing web, mobile, API, and infrastructure — from pentest to DevSecOps.
Pune, India · Dubai
10+
Years in AppSec
5
Organizations
BFSI
Banking delivery
CEH
Certified
About
Summary
Application Security Consultant with 10 years across penetration testing, vulnerability management, SAST/DAST/SCA, and DevSecOps — reducing risk for enterprise and banking clients while partnering with global teams.
Hands-on delivery spans web, mobile, and API assessments, secure-development enablement, and vulnerability management programs for BFSI and product organizations.
Known for clear risk communication, remediation follow-through, and mentoring engineers so security becomes part of how teams ship — not a last-minute gate.
Open to opportunities
Hybrid / Remote-friendly · Based in Pune, India & Dubai
Inspiration
Favourite quotes
Security is not a product, but a process.
Bruce Schneier
Fix the root cause, not just the finding — that is how AppSec earns trust.
Shradha Karhekar
Highlights
Selected work
Banking AppSec delivery
Led application and API security assessments for a top-tier UAE bank across Agile change requests, with remediation and revalidation.
Vulnerability management at scale
Owned end-to-end VM with Rapid7 and Nessus, improving remediation SLA tracking and governance reporting.
Secure development enablement
Authored client secure-dev guidelines and mentored junior AppSec engineers on pentest and triage.
Breaking In: Pentester’s Voice
Featured guest on AppSecWarrior — career path, pentest craft, and lessons from a decade in AppSec.
Listen / read episode
Experience
Career path
Start → education → roles → next — tap a milestone for details.
Start
Career start
Entered cybersecurity · hands-on testing path
Edu
Education
B.E. IT — University of Mumbai
Next
Ready for next challenge
Open to impactful AppSec work
-
01 Jan 2026 – PresentProduct Security Engineer
- Web application penetration testing, SAST, SCA, and DAST for enterprise apps and APIs.
- SBOM analysis on open-source and third-party components; security advisory support.
- Risk-prioritized reports with remediation guidance and revalidation testing.
-
02 Apr 2023 – Jan 2026Associate Consultant / Cyber Security Consultant
- Web application pentest, DAST, and SAST assessments; supported critical/high/medium remediation.
- Owned vulnerability management with Rapid7 InsightVM and Nessus; improved remediation SLA compliance.
- Built trend and compliance dashboards for monthly governance reviews.
-
03 Apr 2022 – Mar 2023Security Consultant
- Application and API security assessments for a top-tier UAE bank across Agile change requests.
- Risk ratings, remediation guidance, retesting, and risk-exception workflows.
- Log reviews and AWS cloud configuration reviews for misconfigurations.
-
04 Apr 2020 – May 2022Security Consultant
- Penetration testing on web applications and RESTful APIs.
- Authored client-specific secure development guidelines.
- Mentored junior AppSec engineers on testing and vulnerability management.
-
05 Jan 2016 – Mar 2020Sr. Security Analyst
- Pentest across web, Android, thick-client, and API surfaces for BFSI and enterprise clients.
- Detailed security reports presented to client stakeholders.
- Enhanced testing checklists aligned to industry frameworks.
Skills
Focus areas
Web / API / Mobile Pentest
SAST · DAST · SCA
DevSecOps
Vulnerability Management
Mentorship
Toolkit
Tools & frameworks
Web
Burp Suite · OWASP ZAP · SQLmap · Acunetix · Nmap · InsightAppSec · WebInspect
Mobile
MobSF · Drozer · JD-GUI · ADB · APKTool · JADX
API
Postman · SoapUI
SAST
Checkmarx One · Fortify · GitHub Advanced Security · JFrog Xray
SCA / Container
Aqua Security · Sonatype Lifecycle
VM
Nessus · Rapid7 InsightVM
Frameworks
OWASP Top 10 · SANS Top 25 · NIST · CWE
Recognition
Achievements & education
Achievements & certifications
- Certified Ethical Hacker (CEH)
- OSCP (appearing Oct 2026)
- Award for Excellence in Project Delivery — Paladion Networks
- Award for Best Agile Delivery Support — Emirates NBD Bank
- Featured guest — AppSecWarrior Breaking In: Pentester’s Voice podcast
Education
- Bachelor of Engineering (B.E.) in Information Technology — University of Mumbai
Next step
