M Santhosh Rao

About M Santhosh Rao

Senior Application Security Engineer | DevSecOps | Penetration Testing | Secure SDLC | Threat Modeling I’m a security engineering professional with over 10 years of hands-on experience securing modern applications and infrastructure across cloud-native and on-prem environments. I specialize in application security, product security, DevSecOps, and penetration testing, with a strong track record of embedding security throughout the software development lifecycle. Throughout my career, I’ve led end-to-end security assessments using SAST (e.g, Fortify, Checkmarx), DAST (e.g, Burp Suite, ZAP), and manual penetration testing techniques. I’ve conducted in-depth security reviews for web and mobile applications, APIs, microservices, and cloud infrastructure (AWS, Azure), helping teams uncover vulnerabilities and remediate them at scale. Key strengths include: Static & Dynamic Application Security Testing: Automated SAST/DAST in CI/CD, false-positive tuning, and secure code remediation guidance Manual Penetration Testing: OWASP Top 10, business logic testing, API fuzzing, and authentication/authorization testing Network & Infrastructure Security: Internal/external network pentests, firewall & segmentation reviews, misconfiguration audits Threat Modeling & Secure Architecture Reviews: Integrated STRIDE-based threat modeling with product teams to proactively identify risks DevSecOps & Security Automation: Integrated security controls in DevOps pipelines (GitLab, Jenkins, GitHub Actions), enabling shift-left security Security Champion Program & Developer Enablement: Built and trained cross-functional security champions to scale security awareness I work closely with engineering, product, and compliance teams to balance security and usability—transforming security from a blocker to a business enabler. My approach is proactive, risk-driven, and focused on long-term resiliency. Looking to connect with professionals and organizations committed to building secure, scalable, and trustworthy systems. If you’re working on something exciting in the product or cloud security space, let’s talk.

Experience

1. Cyber Security Consultant

   Capgemini

   Jan 2021 — Present · Hyderabad, IN