Looking for a job

Shasa Salsabila

@shasasalsabila

Security Architect at PT XLSMART Telecom Sejahtera Tbk who established enterprise pentest governance and scaled requests to 18 per week.

Indonesia

Message

At PT XLSMART Telecom Sejahtera Tbk, I established the enterprise penetration-testing governance policy and built its Power Automate intake system, scaling throughput from 4–5 to as many as 18 parallel requests per week. I used utilization analysis to quantify wasted capacity and secure a CISO budget reallocation.

I’m also the system owner of enterprise Saviynt identity governance across the post-merger entity, and I built a User Access Review framework that closed all 14 access audit findings within one quarter, with zero repeats since. Earlier, I established access governance at GovTech Edu, consolidated vulnerability findings at PT GoTo (Gojek Tokopedia), and created PT Bukalapak.com’s first pentest prioritization framework. I’m CISA-certified.

Experience

Work history, roles, and key accomplishments

Current

Security Architect & AI Assurance

Current

PT XLSMART Telecom Sejahtera Tbk

Nov 2024 - Present (1 year 10 months)

Internal security consultant and single cross-domain risk-exception authority; system owner of enterprise IGA; initialized enterprise penetration-testing governance policy and automation, scaling on-demand pentest throughput from 4-5 to 18 parallel requests per week.

Penetration Testing Governance Power Automate SharePoint Planner Saviynt Sailpoint RBAC User Access Review AWS Security Hub AWS IAM Sysdig MBSS CIS Benchmark RFP RFI SOW Drafting Vendor Management Budget Management

Identity & Access Management Analyst

GovTech Edu, PT Telkom Indonesia

May 2023 - Nov 2024 (1 year 6 months)

Sole owner of IAM function, building framework, policy, and automation from scratch; rolled out SSO and MFA across ~30 applications and owned the full access lifecycle.

IAM SSO MFA Google Workspace Slack Automations Access Reviews RFP Security Assessments

Security Assurance & Vulnerability Management

PT GoTo (Gojek Tokopedia)

Sep 2021 - May 2023 (1 year 8 months)

Delivered vulnerability management, security assurance, and third-party assessment across the merged GoTo environment; consolidated findings from seven sources into DefectDojo and project-managed SAST rollout.

Vulnerability Management DefectDojo SAST SCA Rapid7 Secret Scanning Tools Crowdstrike Kandji Google Data Studio ISO 27001 Third Party Risk Assessments

Security Analyst

PT Bukalapak.com

Sep 2018 - Aug 2021 (2 years 11 months)

First-mover in a newly-created security role; built the first pentest prioritization framework and embedded threat modeling into sprint planning across the Marketplace Tribe.

Threat Modeling Penetration Testing XSS CAPTCHA Rate limiting Secure Coding Security Awareness