Looking for a job

Sunil Bhati

@sunilbhati

Message

Security leader at Junglee Games who built an AI threat modeling tool that generates DFDs and threat models.

India

Message

At Junglee Games, I drove product security across the development lifecycle and owned enterprise security strategy, budgeting, and compliance. I set architecture review gates, threat-modeling standards, and secure-release criteria for new game titles and platform features.

As Staff Security Engineer at Junglee Games, I led development of an AI threat modeling tool that parses PRDs and Git repos to generate DFDs and threat models. I also integrated the OWASP Top 10 for LLM Applications into the SSDLC.

At Connect and Heal – CNH Care, I implemented SAST/DAST scanning across the SDLC and enhanced DevSecOps pipelines using Jenkins, Dependency-Track, and secret scanning. I collaborated with teams on SOC 2, PIMS, and ISO compliance certifications.

Earlier, I worked in product and application security at API Holdings, iSTOX, McAfee, PhonePe, and Swiggy. My vulnerability research has earned recognition in Security Halls of Fame, including at Google, Twilio, Zomato, and others.

Experience

Work history, roles, and key accomplishments

Senior Manager, Security

Junglee Games

Apr 2026 - Sep 2026 (5 months)

Owned product security end-to-end, setting architecture review gates and threat-modeling standards. Managed enterprise security strategy, budget, and compliance targeting NIST CSF 2.0, and led the Shadow AI governance program.

Secure SDLC Threat Modeling Architecture Reviews NIST CSF SOC2 ISO 27001 Shadow AI Mitigation DLP Security Operations Center (SOC)Cyber Insurance

Staff Security Engineer

Junglee Games

Feb 2025 - Apr 2026 (1 year 2 months)

Led security architecture reviews and threat modeling for products and features. Managed external VAPT engagements and drove SSDLC maturity, including development of an AI threat modeling tool and integration of OWASP Top 10 for LLMs.

Threat Modeling Architecture Reviews VAPT SSDLC OWASP Top 10 for LLMs AI Threat Modelling Incident Response ISO SOC2

Engineering Manager, Security

Connect and Heal – CNH Care

Feb 2023 - Feb 2025 (2 years)

Established security processes and led audits to improve organizational security posture. Implemented SAST/DAST scanning and built DevSecOps pipelines using Jenkins, and achieved security compliance certifications including SOC 2, PIMS, and ISO.

SAST DAST DevSecOps Jenkins Dependency Track Secret Scanning Tools SOC2 PIMS ISO Security Audits

Senior Information Security Engineer

API Holdings

May 2021 - Feb 2023 (1 year 9 months)

Led zero-trust and data-exfiltration-prevention initiatives, including an in-house security awareness tool. Leveraged automation and CI/CD integration to improve cloud security posture and embed security into the SDLC.

Zero Trust Data Exfiltration Defense CI CD Cloud Security Threat Modeling Penetration Testing

Product Security Engineer

iSTOX

Jul 2020 - May 2021 (10 months)

Performed manual penetration testing and vulnerability assessments for web and mobile applications, including blockchain/smart contract security testing. Delivered security awareness and secure development training, and monitored security events via SIEM.

Penetration Testing Vulnerability Assessment Blockchain Security Smart Contract Security SIEM Security Awareness

Product Security Engineer

McAfee

May 2019 - Jul 2020 (1 year 2 months)

Managed CVE creation and the HackerOne bug bounty program for McAfee. Uncovered security issues in design and code, guided engineering teams to remediation, and performed manual penetration testing using Nexpose, Black Duck, and Burp Suite.

CVE HackerOne Bug Bounty Penetration Testing Nexpose Black Duck Burp suite Secure Coding

Security Analyst

PhonePe

Nov 2017 - May 2019 (1 year 6 months)

Started and managed PhonePe's Bug Bounty Program. Performed application threat modeling and manual penetration testing for web and mobile applications, and ran infrastructure vulnerability scans using Nessus Pro.

Bug Bounty Threat Modeling Penetration Testing Nessus Vulnerability Scanning Secure Coding

Security Engineer

Swiggy

Aug 2015 - Nov 2017 (2 years 3 months)

Conducted application threat modeling and risk exposure assessments across Swiggy's platform. Performed manual penetration testing and vulnerability assessments using Burp Suite and Metasploit, and created ethical hacking standards and guidelines.

Threat Modeling Penetration Testing Burp suite Metasploit Vulnerability Assessment Secure Coding