Mahendra Navale

About Mahendra Navale

Application Security Professional with 7+ years of hands-on experience in securing web applications and APIs. Specialized in penetration testing, static application security testing (SAST), dynamic application security testing (DAST), and API security assessments. Expert in using industry-standard tools such as Burp Suite, WebInspect, Checkmarx, Fortify, and OWASP ZAP to identify and mitigate vulnerabilities. Adept at developing security policies and standards, performing risk assessments, and managing vulnerability remediation efforts. Strong communicator and team collaborator with a solid understanding of cryptography, identity management, threat modeling, and vulnerability management. Hands on experience with information security tools such as enterprise SIEM solution QRadar, Burp Suite, Appscan, MicroFocus WebInspect, Checkmarx, Nmap, F5 ASM, Incapsula Imperva, Acunetix, HP Fortify.

Experience

1. Cyber Security Analyst

   Deloitte

   Jun 2022 — Present · Pune, IN

   Lead Web, Mobile, and API security assessments to identify vulnerabilities and provide remediation guidance using Burp Suite, Fortify, WebInspect and Checkmarx. Develop, implement, and maintain Web, API security policies and standards, ensuring alignment with industry best practices for World’s no.1 Fintech Bank. Conducted static and dynamic security testing on web applications and APIs, using tools such as Fortify, Burp Suite, Micro focus WebInspect, BishopFox. Collaborated with development teams to integrate security into the software development lifecycle (SDLC), enhancing security practices for development and deployment. Performed vulnerability assessments and risk assessments for new applications, identify security risks, and provide recommendations for remediation. Use and evaluate new SAST, DAST tools to recommend and update application security policy and procedures to keep up with the security trends and new requirements Report findings and remediation steps to technical and non-technical stakeholders through clear, concise reports and presentations Evaluating risks associated with vulnerabilities in container images and orchestration tools Regularly scanning the container images, registries, domains for known vulnerabilities using automated tools like Prisma Cloud, Cortex Xpanse, BitSight Ensuring that overall risk score of client application comply with the relevant regulations and security standards

Education

• Savitribai Phule Pune University

  BE - Bachelor of Engineering

  2014 — 2018