Open to opportunities

urvashi godumalani

@urvashigodumalani

Message

I secure cloud applications through DevSecOps automation, threat modeling, and penetration testing.

United Kingdom

Message

What I'm looking for

I'm looking to secure enterprise applications through secure SDLC, threat modeling, manual web and API testing, DevSecOps automation, and AWS/GCP cloud hardening.

I've reduced recurring application security vulnerabilities by 30% at Tenderd by establishing secure code review protocols and leading cross-functional remediation work. I also embedded SAST, DAST, and Snyk dependency scanning into every CI/CD build, achieving 100% Secure SDLC coverage.

My work combines secure design reviews, threat modeling, manual web and API penetration testing, and cloud hardening across AWS and GCP. I built Python automation that improved vulnerability detection workflows by 40% and performed least-privilege IAM audits to remove privilege-escalation paths.

In independent AppSec engineering and research, I've open-sourced a STRIDE/DREAD threat-modeling engine and built Docker- and LocalStack-based secrets governance tooling. I've also created DevSecOps pipelines with GitHub Actions, automated SAST/DAST scanning, Jira ingestion, and security reporting.

Before focusing on application security, I delivered enterprise full-stack software, led client implementations, mentored five junior engineers, and built APIs and cloud systems with Java, Spring Boot, Node.js, React, Django, AWS, GCP, and Firebase.

Experience

Work history, roles, and key accomplishments

Current

Independent Application Security Engineering & Research

Current

Independent

Oct 2024 - Present (1 year 10 months)

Engineered and open-sourced custom AppSec tools, including a STRIDE/DREAD threat modeling engine and a local secrets governance pipeline. Built CI/CD DevSecOps pipelines using GitHub Actions to automate containerized SAST/DAST scanning and Jira backlog ingestion.

Python Docker LocalStack GitHub Actions SAST DAST Threat Modeling STRIDE Model DREAD Secure Code Review JavaScript Java OWASP Top 10 API Security AWS

Software Engineer (Application Security)

Tenderd

Feb 2022 - Jan 2024 (1 year 11 months)

Reduced recurring application security vulnerabilities by 30% by establishing secure code review protocols and driving cross-functional remediation teams. Achieved 100% Secure SDLC coverage across CI/CD pipelines by embedding automated SAST and DAST security gates alongside Snyk dependency scanning.

Secure SDLC SAST DAST Snyk OWASP Top 10 Burp suite Threat Modeling Python GCP IAM CI CD

Software Engineer

ICS Inara Consultancy

Oct 2021 - Feb 2022 (4 months)

Architected and delivered enterprise-grade full-stack applications from requirements through production deployment. Improved system stability and development velocity by resolving legacy technical debt and recurring production issues.

Full Stack Developer Technical Debt Stakeholder Management Agile Jira

Full Stack Developer

Greycell Labs

Mar 2020 - Oct 2021 (1 year 7 months)

Mastered Java and Spring Boot to deliver core product features ahead of schedule. Acted as primary technical liaison for enterprise clients, achieving a 97% client satisfaction rating. Engineered a scalable AWS S3-based file-processing subsystem.

Java Spring Boot AWS S3 Grafana Client Management

Senior Programmer

Skara Technologies

Jun 2018 - Feb 2020 (1 year 8 months)

Managed and mentored a team of 5 junior engineers, overseeing performance reviews and code quality standards. Delivered 10 enterprise-grade client projects, leading 5 end-to-end implementations and serving as Technical Project Lead for the rest.

Team Leadership Mentor React TypeScript Django GCP Firebase API Development