Open to opportunities

Yash Gautam

@yashgautam

Message

Security Engineer building AppSec, DevSecOps, cloud security, and AI/LLM security programs that ship safely.

India

Message

What I'm looking for

I want to build security programs that scale—owning Secure SDLC, cloud vulnerability management, and application security—while modernizing detection/response and applying AI/LLM security practices to reduce real-world risk.

I’m a Security Engineer with 6+ years building and scaling security programs from zero across cloud-native, healthcare, and enterprise environments. I focus on application security, Secure SDLC, DevSecOps, cloud security posture, and AI/LLM security.

At a Series-A startup, I built the entire security function as the sole hire—driving ISO 27001, GDPR, and SOC 2 Type II certification in 7 months. I led control definitions, risk assessment, threat modeling, and external audit coordination, so teams could move fast without losing security rigor.

Most recently, I’ve been leading Secure SDLC and multi-cloud vulnerability management, plus supply chain risk initiatives. I consolidated security visibility across multiple cloud environments and workstation fleets, reprioritized tens of thousands of findings by exploitability and business impact, and drove Semgrep rollout with PR-blocking and automated ticketing.

I also build and operationalize detection and response workflows—automating SOC processes with Windmill and Python, managing SentinelOne EDR triage, and running phishing simulations to reduce risk behavior. Alongside this, I’m developing NETRA, an open-source AI-assisted cybersecurity platform for threat detection, vulnerability management, and compliance tracking.

Experience

Work history, roles, and key accomplishments

Current

Sr. Security Analyst

Current

TeleVox Healthcare (West Technology Group)

Jun 2025 - Present (1 year 1 month)

Consolidated vulnerability management across multiple cloud environments and workstations, reprioritizing 37,000+ findings to reduce Azure vulnerabilities, supply-chain noise, and fully manage OCI vulnerabilities. Led Secure SDLC/Semgrep rollout with PR-blocking, managed SentinelOne EDR triage, and ran phishing simulations to reduce click rates.

Sr. Security Engineer

ThinkSys Software Pvt. Ltd.

Oct 2024 - Jun 2025 (8 months)

Built SOC automation workflows using Windmill and Python to reduce manual analyst effort and accelerate case handling. Led threat investigations using Splunk/SentinelOne telemetry, mapped findings to MITRE ATT&CK, and drove SOC 2 Type II, GDPR, and ISO 27001 audit readiness by standardizing IR playbooks.

SOC Automation Windmill Python Slack Jira Google Workspace Threat Investigation Splunk SentinelOne SOC II GDPR ISO 27001 Incident Response Audit Readiness

Security Engineer

VuNet Systems

Apr 2023 - Oct 2024 (1 year 6 months)

Joined as the first and sole security hire and built the security function from scratch, including policies, processes, tooling, and compliance coordination. Achieved ISO 27001, SOC 2 Type II, and GDPR certifications, embedded Semgrep and container scanning into CI/CD, and built a Python-driven vulnerability monitoring and automated patching workflow.

ISO 27001 SOC II GDPR Threat Modeling DevSecOps Semgrep SAST DAST SCA Container Scanning Docker CI CD Python

InfoSec Consultant

AKS IT Services

Aug 2020 - Apr 2023 (2 years 8 months)

Executed VAPT and external penetration testing for enterprise and government clients using Nessus, Nexpose, and Metasploit. Conducted ISO 27001 and SCADA audits with gap assessments, designed DLP/IDS/IPS and patch management infrastructure, and mentored security trainees through VAPT methodologies.