Ankush Bhaal

About Ankush Bhaal

I specialize in embedding security into the core of product development—from early-stage architecture to deployment and beyond. My expertise spans Application Security, Secure SDLC, and Risk Management, ensuring that security is not an afterthought but a foundational pillar throughout the product lifecycle.In my current role, I lead security initiatives across cross-functional teams, driving secure software development practices at scale while ensuring compliance with industry standards and regulatory requirements. I have extensive hands-on experience in:Security Assessments & Threat Modeling – Identifying, analyzing, and mitigating risks early in the development process.Application Security & Secure SDLC – Implementing secure coding practices, code reviews, and DevSecOps strategies to fortify applications.Vulnerability Management & Penetration Testing – Conducting comprehensive security assessments to uncover and remediate critical vulnerabilities.Security Strategy & Leadership – Collaborating with engineering, product, and leadership teams to define and implement scalable security frameworks.With a deep understanding of security frameworks like OWASP, NIST, and CIS, I am passionate about building secure, scalable, and resilient products that exceed industry security standards. My approach is proactive and strategic, ensuring that security is seamlessly integrated into the development lifecycle from day one.

Experience

1. Senior Manager - Application Security

   ICICI Lombard

   Aug 2023 — Present

   Role and Responsibilities Performed end to end penetration testing assessments of Web, API, and mobile applications,identifying critical vulnerabilities aligned with OWASP Top 10, SANS, and API Top 10. Led the integration of (SAST, DAST, SCA,Secrets Detection,Prisma Defender) in Jenkins DevSecOps Pipeline, reducing manual effort by 50% and accelerating developer feedback by 40%. Spearheaded efforts in software supply chain security, including SBOM and third-party package tracking, to strengthen component-level visibility and compliance. Evaluated, deploy, and tune application security tools such as Checkmarx, SonarQube, Burp Suite,ZAP, Prisma Cloud, and CloudSEK for improved detection accuracy. Performed secure code reviews for 100+ repositories identifying and, triaging 300+ issuesand reducing false positives through rule tuning. Lead threat modeling exercises for product features, reducing post-release vulnerabilities by 40%and guiding secure design decisions. Supported remediation efforts by working closely with developers to reproduce findings, suggest fixes, and validate patches. Monitor the vulnerabilities reported for Organization and Vendors on Attack Surface Monitoring Tool.Analyze report and follow up with respective stakeholders and vendors till closure. Documented security processes, standards, and playbooks to ensure consistent security practices across teams.

Education

• National Forensic Sciences University (NFSU)

  Master of Technology - MTech, Cyber Security

  2021 — 2023

• CHANDIGARH UNIVERSITY

  B.E Computer Science And Engineering