Hardikkumar Patel

I am a Security Engineer with hands-on experience across offensive security, enterprise security engineering, Governance, Risk & Compliance (GRC), and AI security. My career has progressed from application security and VAPT into broader enterprise security, governance, and secure AI initiatives.

I began in VAPT, performing black-box and gray-box web application security assessments, API testing, reconnaissance, and vulnerability validation. I identified critical application security issues including IDORs, directory traversal, XSS, vulnerable third-party libraries, concurrent session vulnerabilities, and exposed sensitive resources, using Burp Suite and other security testing tools. I produced detailed findings with risk context, CVE/CWE references, and remediation recommendations.

At Sigmoid, I gained experience across GRC and enterprise security engineering, including ISO/IEC 27001 control assessments, asset and security hygiene, policy reviews, incident response, vulnerability assessment, and Third-Party Risk Management (TPRM). I contributed to 30+ client TPRM questionnaires under senior guidance and collaborated with cross-functional teams to establish IAM governance across 9+ SaaS and cloud platforms.

In my current role, I have been involved in building and formalizing security capabilities, giving me hands-on exposure to implementing security processes rather than only operating within an established program. My work spans security governance, security infrastructure, third-party risk, AI governance, incident investigation, and security automation.

A key focus has been applying AI to practical security problems. I designed and developed an internal RAG application using LangChain, LangGraph, and Ollama that indexed 50+ organizational security policies to streamline repetitive client TPRM questionnaire responses. I also incorporated security controls and evaluation using Promptfoo, NVIDIA NeMo Guardrails, and Garak to address risks such as prompt injection, hallucination, and unsafe LLM behavior.

I have also contributed to enterprise AI governance by evaluating Generative AI applications, identifying Shadow AI risks, defining approved AI usage, and developing secure AI usage guidelines and guardrails.

My technical interests include Product Security, Security Engineering, Application Security, AI/LLM Security, AI Safety, AI Red Teaming, Security Automation, GRC, Cloud Security, and secure AI systems.

I am particularly interested in product-focused organizations where I can solve meaningful security problems, work closely with engineering teams, build security capabilities from the ground up, and grow at the intersection of cybersecurity and AI.