Looking for a job

Shivangi Rai

@shivangirai2

Application security engineer at Wayfair who helped expand GitHub Advanced Security to 8,000 repositories and built AI-assisted dependency reachability analysis.

India

Message

At Wayfair, I helped expand GitHub Advanced Security scanning to 8,000 repositories and designed a proof of concept that connects ArmorCode findings to required GitHub checks. I also built Python-based reachability analysis for critical CVEs, using AI-assisted code context to assess whether vulnerable functions could be reached.

At Wayfair, I review architecture, code, and threat models for platform services, APIs, GraphQL subgraphs, and webhooks, and work with engineers on remediation. Before that, I led product security assessments and design reviews at MOENGAGE, and performed penetration testing and secure code reviews at Aujas Networks, TECH MAHINDRA, and HAPPIEST MINDS.

Experience

Work history, roles, and key accomplishments

Current

Senior Development Engineer III, Product Security

Current

Wayfair

Jan 2025 - Present (1 year 10 months)

Designed a proof of concept for CI/CD security gates using ArmorCode findings and expanded GitHub Advanced Security scanning to 8,000 repositories. Triaged SCA findings and built Python-based reachability analysis for critical CVEs using AI-assisted code context.

SAST SCA DAST CI CD Github Advanced Security CodeQl Dependabot ArmorCode Reachability Analysis Python AI Security Threat Modeling API Security GraphQL Kubernetes Istio Kong JWT OIDC Burp suite HackerOne

Product Security Lead

MoEngage

Jul 2021 - Dec 2024 (3 years 5 months)

Led application, API, and SDK security assessments and design reviews, and introduced SCA practices for dependency vulnerabilities and license issues. Delivered secure-development training to engineering teams.

Application Security API Security SDK Security Design Reviews SCA Secure Development Training

Security Consultant

Aujas Networks

Dec 2019 - Jul 2021 (1 year 7 months)

Performed web, mobile, network, and Active Directory penetration tests, and created an OWASP Top 10/WASC assessment framework. Documented attack paths and remediation plans.

Penetration Testing Web Security Mobile Security Network Security Active Directory OWASP WASC

Security Analyst

Tech Mahindra

Jul 2019 - Dec 2019 (5 months)

Performed SAST, DAST, and secure code reviews for Singapore government websites, and validated bug-bounty reports. Coordinated fixes with developers.

SAST DAST Secure Code Review Bug Bounty

Senior Engineer, IMSS

Happiest Minds

Oct 2016 - Jun 2019 (2 years 8 months)

Assessed web, mobile, thick-client, and API environments, including 50+ web applications, and conducted cloud reviews against CIS benchmarks. Validated remediation.

Web Security Mobile Security API Security Cloud Security CIS Benchmarks