application Security
Resume:
Swetha Vasantham Munirathnam
Indianapolis IN ******************@*******.***
Skype ID: swethaba
Summary
EC council certifications; Certified Ethical Hacker - version 8; ITIL Certified; AIX administration.
8.3 years of experience in IT industry as an information security consultant performing vulnerability assessment; application, web services, network and DB penetration testing. Also, was a Technical TL/SME for IAM security risk management and compliance team(s) (SARM).
Proficient with various approaches to Gray, white & Black box application security testing.
Proficient with manual and automated scanner techniques assessment.
Proficient with web applications in the areas of Insurance, e-Commerce, retail, cosmetic and pharmaceutical environments.
Provided comprehensive report on vulnerabilities and action plan to mitigate the identified vulnerabilities and VAPT process.
Evaluation of threats and risk to business operations resulting in security solutions that appropriately balance cost and risk mitigation.
Vulnerability Assessment Tools: Nessus, DB Visualizer and Qualys WAS.
Web Vulnerability Tools: Burp Suite and IBM App Scan.
Penetration Testing Tools: Nmap, Kali Linux and Wireshark.
Automation tools: WhiteHat Security services.
Web Applications: Web Services, Tomcat, JavaScript (jQuery).
Extensive experience in developing test plan, test strategy.
Implemented OWASP Top 10, CWE/SANS Top 25 for security checks.
Working knowledge in Unix, Mac and Windows environments
Knowledge of PCI compliance, CI/CD process, HIPAA compliance.
Ability to coordinate and work in a team environment/independently to achieve objectives & reach deadlines.
Active involvement in defect review meetings/calls and weekly status updates with QA/Development team and clients.
Compliance and lead audit focal for various Internal and external Audit boards like KCO, BCR, SOX, PWC as per the standard checklist for IAM projects.
Technical TL/SME for three different IBM project (period of 2 years).
Employment
Vulnerability Risk Management Consultant
Eli Lilly, Indianapolis
May 17’ – July 17’
Understanding of Vulnerability Management identification, analysis, metrics and reporting tools as well as processes enabling proper governance, risk and compliance.
Data analysis and problem resolution. Integrate and correlate large amounts of data to identify complex patterns and trends.
Make good risk based judgment to complex problems.
Evaluation of threats and risk to business operations resulting in security solutions that appropriately balance cost and risk mitigation.
Responsible for managing all aspects of the Vulnerability Risk Management Program including vulnerability identification, analysis, remediation coordination and reporting.
Assessing the risk of a proposed solution, escalating appropriately and driving to closure.
Responsible for internal Qualys WAS services and WhiteHat Security scans.
Initiation, coordination and Implementation of WhiteHat Security services tool project at end client’s network zone along with architectural view and analysis.
Conduct web application vulnerability scans for internal and DMZ facing applications of Eli Lilly.
Was associated with IIHS teams to analyze the architecture of the network to install WhiteHat security services to scan the systems, network, applications, devices of Eli Lilly.
Prepared technical and system overview, process of implementing a third-party tool, risk and management process documents for WhiteHat security; standardizing and finalizing the RACI matrix.
Tools used: Qualys WAS, WhiteHat Security services.
Information Security Consultant
Rodan and Fields, San Ramon
Feb 17’ – Mar 17’
Worked as a single point of contact for security assessment and risk management for the team.
Was associated with devOps team, architects and project management to understand the client requirement to implement security.
Web application security assessment including black box, grey box and white box testing was conducted on the storefront application of R+F.
Worked on hybris / eCommerce web application.
Tested all the application functionality based on the OWASP standards and a threat profile prepared specifically for the application.
Proposed remediation strategies for remediating vulnerabilities.
Developed security assessment plan, report, questionnaire, rules of engagement.
Prepared security checks for payment integration.
Conducted both manual and automated scanners to test the application based on client requirement(s).
Prepared combined reports of level of risks, their trend and frequency to the development team and client.
Prepared detailed documentary / technical report to the development team which consists of vulnerability lists, their causes and mitigation or suggestions to over each of them and steps as to where the flaw was identified.
Analyzing the software applications supporting the application like Hybris, Mule soft, SAP ECC (earlier called ERP) and APCERA and their integration related to each section of the application.
Good understanding of JavaScript’s, SQL statements, PHP, HTML to perform the test on the applications.
Performed complete store front, and other web applications and basic network assessments.
Automate and integrate security into agile development processes and CI/CD pipelines.
At high priority, critical and high priority vulnerabilities were reported to the development and devOps team using JIRA tracking system with history of the issue, also used for tracking the remediation issues.
Tools used: - Burp Suite, Nmap, Nessus.
Security Operation Engineer
eBay, San Jose
Jun 16’ – Sep 16’
Worked as an individual contributor for Red Team, completed 8 projects (internal and external clients of eBay).
Test the application functionality based on the OWASP standards and a threat profile prepared specifically for the application.
Proposed remediation strategies for remediating system vulnerabilities to the development teams.
Critical and high priority vulnerabilities were reported to the development and devOps team using JIRA tracking system with history of the issue, also used for tracking the vulnerability and remediation issues for medium and low findings.
Implemented OWASP Top 10, CWE/SANS Top 25 for security checks.
Developed security assessment plan, report, questionnaire, kick off calls with clients and development team and exit brief templates.
Good understanding of JavaScript’s, SQL statements, PHP, HTML to perform the test on the applications.
Working knowledge in Unix, Mac and Windows environment.
Conducted both manual and automated scanners to test the application based on client requirement(s).
Prepared detailed documentary to the development team which consists of vulnerability lists, their causes and mitigation or suggestions to over each of them.
Performed web application, DB management, Unix management security checks, ESXI server API integration security, sail point application and VMware - V Sphere server assessments.
Tools used: - Burp Suite, Nmap, Zap, D B visualizer, Nessus, HxD.
Web application security assessment
IBM, Bangalore
Jan 15’ – Jan 16’
Performed security assessment on an insurance based web application.
Implemented OWASP Top 10, CWE/SANS Top 25 for security checks.
Provided comprehensive report on vulnerabilities and action plan to mitigate the identified vulnerabilities.
Involved in the complete execution of the project, starting from threat profiling to delivery of the project.
Informed security vulnerabilities identified and recommendations proposed to fix the same: SQL Injection, Cross-site scripting, HTML Injection, Parameter manipulation, information disclosure, directory traversal, banner grabbing, default username/passwords etc.
Have good knowledge of implementing all the tools used for carrying out Web Application Vulnerability Assessment like IBM App scan, Burp suite, Nmap.
Conducted both manual and automated scanners to test the application based on client requirement(s).
Prepared detailed documentary to the development team which consists of vulnerability lists, their causes and mitigation or suggestions to over each of them.
Executed Network Penetration vulnerability assessment on Client’s external network to check out for the various vulnerabilities in the existing network and ensured to communicate the correct mitigation for the existing vulnerabilities to the client.
Scanned and analyzed port scan results, manually verified the vulnerabilities related to the ports of the system.
Provided comprehensive report on findings and action items to fix the identified vulnerabilities
Informed security vulnerabilities identified and recommendations proposed to fix the same: FTP related vulnerabilities, information disclosure, banner grabbing, default username/passwords etc.
TL/SME IT Specialist
IBM, Bangalore
Apr 11’ – Jan 15’
CNA Insurance Project – 4 (IBM)
Lead team of 56 Security Delivery Specialists.
The team was responsible to perform IAM and ISIM support activities for CNA insurance company - Chicago, on various platforms like Windows, Unix, Linux, Solaris, OKTA, lotus notes administration, ATT and Mainframes.
Communicate progress, success, and risks within the IAM space to the IT leadership team.
Tracking the Noncompliance issues and remediating the violations.
Develop and implement training of the CNA user admin and security team on key topics such as access requests, access certifications, work load management and password management. Also, provide guidance to carry out plans and procedures, ensuring schedule attainment, product development process adherence and performance.
Provide escalation support for operations and support teams, including root cause analysis and preventative analysis.
Interacting and mediating sensitive situations at all levels of the organization and with client and auditors.
Assist in development of roadmaps and participate in the process standards for IAM solutions.
Pro-actively monitor the problem and change process, manage problem and change issues.
Participate and assist team during various external and internal audits such as Key Control Operation, PWC, BCR, PMR, corporate audit, BCG, client audit, etc. Drive the tracking and resolution of Identity-related Audit findings and remediation activities.
Understand a variety of IAM-related product suites and tools to make critical operational decisions. Example products include: ISIM (IBM Security Identity Manager), Active Directory, Mainframes, Unix, Linux.
Manage, develop and mentor teams of IAM professionals, contractors, vendors and services providers.
Handling and coordinating multiple global projects like Undeleted ID project, User revalidation.
Manage day-to-day operations of access control team, in addition to providing governance and input into multi-year IAM project and associated team members.
Ensure SLAs are met by the team as per clients expected levels and manage any backlogs in queues.
Recruit, train and mentor all IT staff members, developing teams and leaders to ensure that business value is maximized and IT goals are achieved.
Create and develop performance report, delivery method, scope of work, and general duty records.
Go to clients for project briefing, consultation, installation and closeout reviews.
Help in managing customer demands to ensure maximum satisfaction, and to maintain quality over quantity.
Engage in the negotiation of customer job demands and specifications about to labor and material; and assist in creating comprehensive technical documents.
Supervise activities between internal and external resources, and facilitate smooth workflow for service delivery.
Evaluate project data for accuracy, and take the lead in setting project targets and priorities.
Resolve disputes between team members and management; assist in addressing issues amongst team members to avoid unacceptable behaviors.
Give training and mentorship to team members to make them better on the job.
Be up to date with current field practices to enhance service standards and delivery.
Attend technical training to acquire more knowledge of technical procedures and applications, and other job demands.
Remain knowledgeable of current technology and carry out research to identify new trends that can be used to achieve maximum results.
Update regular associates RAG (Red, Amber, Green) status; discuss the Red cases on the immediate basis with the project manager to help the manager in the attrition management.
Update sprint tracker with accurate information to identify the risk and issues proactively at the sprint level.
Conduct project risk identification and mitigation action planning with the PM at the project level.
Conduct FIR; Process check master – to make sure that his team is following all the listed procedures.
Constantly looking for ways to increase the team’s velocity/productivity by eliminating the waste.
People management & Technical management.
Help PM in the annual and mid-year appraisal process.
Assist project manager in the project coordination/management.
Promptly escalate issues to the reporting manager, track and resolve issues.
Target - Zero surprises; proactively react to the surprises with the detailed written explanation.
Always targeted zero dependency in the team.
Tools: - Sail point, IBM HIPA compliance, OKTA, Mainframes, TSRM, ITIM, UNIX, windows, Linux, DB management, AD, IBM Audit tools, Lotus Notes, CAN insurance management tool.
TL/SME IT Specialist, Thomson Reuters (Client) Project – 3 (IBM)
Lead team of 34 Security Delivery Specialists (Thomson Reuters).
The team was responsible to perform IAM and ISIM support activities for Thomson Reuters internal client accounts across globe on various platforms like Windows, Unix, Linux, web based AD, security applications, KPI certificates, lotus notes administration and Mainframes.
Responsible for the transition of global SARM projects from TR to IBM, by setting up the accounts as per IBM security and risk compliance standards.
Periodical update of procedures and policies as per requirement which is cascaded to the team in daily\weekly\monthly meetings.
Queue status monitoring and escalating it to the relevant authorities on daily basis sending SOD & EOD reports.
Responsibilities include Log review and email monitoring, Information Protection and Control (IPC).
Perform security administration for more than 80 security applications. Played an important role in the migration of these applications from Business Areas to Group Service Centre (TR to IBM).
Creation of home folders for the users locating the correct home server, give remote access to the users working remotely through Citrix ICA Client.
Worked for Logs and recertification team where handled projects on recertification for users across Global Banking & Market traders and teams.
Managing of NT/2003 users, groups, organization units by creating configuring and troubleshooting the domain errors production issues.
Performed access control functions and level Root Account Password Management.
Granting necessary access levels to users based on requirement ensuring Audit & Compliance (ex: Remote / VPN / Citrix / Internet access).
Documentation of procedures and updating where necessary with signoffs from Business areas.
Security Delivery Specialist, ‘UNIXSUP’ Argentina Project – 2 (IBM)
Lead team of 13 Security Delivery Specialists.
The team was responsible to perform IAM and ISIM support activities for Argentina IBM internal client accounts across globe on various platforms like Windows, Unix, Linux, AD, legacy applications, certifications, lotus notes administration and Mainframes.
Global transition focal of SARM projects from Argentina to India.
Create and maintain project schedule and database documentation, and act as liaison between all departments.
Reduced labor costs 5% by restructuring teams, suggestions to the manager in converting the contactor positions to employee status.
Design new innovative systems with advanced technology utilizing internal resources, external software, independent contractors and third party consulting firms.
Determine all IT policies and procedures with oversight for administration of user permissions, security levels and technical accountability.
Acted as single point of contact for multiple vendors, business units, and Information Technology partners during transition of global accounts, technical trainings.
Tools:- Lotus Notes and Domino Administrator, TSRM - Tivoli Service Request Manager, ITIM - IBM Tivoli Identity Manager, IBM Access Management tool, Web application data base – UATOOL and UAWEB tool management, CIRAT database, Change requests (TSRM), Scripting to perform Mass process on web application tools, Audit Compliance database tool.
Security Delivery Specialist, IGA Canada Project – 1 (IBM)
Unlock ID / Password reset / Accounts Disable (Reasons: LOA, Termination, QEV/CBN).
Work on SUDO Groups, Group Administration, Non-Loggable/Non-Expiring IDs, Renaming AIX Ids, Transferring IDs, Admin tool Requests, Creating/Deleting Local IDs on Profit Machines.
Mass deletion on a Single System, modify UID/GID, changing User ID Attributes (Home Dir, Shell, etc).
Participate and assist team during various external and internal audits such as KCO, PMR, CTP, corporate audit, BCG, client audit, etc. Drive the tracking and resolution of Identity-related Audit findings and remediation activities. User ID and group management in Active Directory.
Creating Multiwin userids on "IBMUS ID requests" dB (Review Overdue), Resetting standalone servers userid passwords on Legacy and Access Services DBs, perform change requests.
Report Generation of the invalid IDs for LN and Domino Administrator.
Troubleshooting of the technical aspects of the ID in LN.
Create and Modify ID, Archive DB/NSD Storage dB/Password dB (as required) in LN.
Modify IBMC NAB (as required), create suspension/Deny groups in admin group manager.
Document and track Severity 1 and 2 issues and resolutions. Monitor User ID security and permissions.
Process the task of audit request for the account at monthly and quarterly review.
Modification and tracking of mail files of the users and generic IDs at the domino servers.
Monitoring of intel server like daily heath checkup report.
Conducting work load audits to make sure no failures.
Ensure timely communication on all issues both within pool management and outside (Sending GEO, account team & customers).
Control reworks & misroutes-% of duplicate work orders.
End to end management of all incoming work requests (incident, change, SR's)
1.Fulfilling service requests.
2.Using Lean work order application.
3.Accessing service work order application.
4.Reviewing work order details.
5.Updating plan, schedule and completion details.
6.Assigning and managing tasks.
7.Updating parameters.
Infosys Pvt Ltd, Bangalore
Process Executive
Jun 09’ – Apr 11’
Providing L2 technical support for ING applications like ING DB, Unix, applications, outlook, web tools supported by ING and active directory.
Creation/resetting of user accounts/groups in active directory.
Updating the SMTP email address in AD.
Troubleshooting the mailbox of client.
Granting and revoke file share permissions.
Tracing the log file and handling the client report daily / tracking and mapping the errors in log file.
Effective in interacting with the client and resolving user access issues through email and telephone communication.
Experience in active directory, windows 2003/2007, Sybase and IM.
Various client specific application supports / Web applications through Share Point.
Back up and restoring of the data.
Effective in training new process executives.
Responsible for the adherence to TURN AROUND TIME for all the transactions.
Responsible for the adherence to fulfill the request with in the SLA period.
Escalation of production issues to L3 engineers.
Monitoring production system services.
Co-ordination /Interaction with Application/DBA/Testing team/Management.
Realizing and identifying the BEST PRACTISE and sharing the same with the team.
Tools: - AD, Sybase, share point, ING internal security applications.
Extra Miler Award for Extraordinary performance since January to March 2011
Education
BE in Telecommunication Engineering from Belgaum, Karnataka, India – K.S.I.T college - Visveswaraiah Technology University 2007.
Contact this candidate