Ethical hackerBengaluru, India6+ years in security

SUDHANSHUJHA.

Cybersecurity expert and Lead Security Engineer.

I break systems before attackers do, then help teams fix them for good. Penetration testing, cloud security, threat modelling, and privacy compliance for products that handle real people's data.

Hire me for a security reviewDownload resume

Currently into cloud VAPT, threat modelling, AI-driven security

Sudhanshu Jha, cybersecurity expert, in a black suit with a city skyline behind him

01 / About

Security is a necessity now, not an inconvenience.

I'm Sudhanshu, a security engineer with the mindset of an ethical hacker. I protect the assets of clients and stakeholders by securing systems so thoroughly that an intruder cannot extract anything useful, even after exhaustive attempts.

Colleagues describe my approach as direct and collaborative. I connect deep technical work with clear communication, so engineers know what to fix and leaders know why it matters. My work spans penetration testing, threat modelling, cloud security, digital forensics, and privacy compliance, including India's DPDPA Act.

“Torture the data, and it will confess to anything.”

Read my security blog at statechecksecurity.com

Sudhanshu Jha reviewing code on a laptop in a dark room
0
years in security
0
security domains covered
0
enterprise roles
0
compliance frameworks

02 / Expertise

What I test, secure, and certify.

Offensive security

  • Dynamic application security testing (DAST)
  • Static application security testing (SAST)
  • IoT VAPT
  • API documentation review and VAPT
  • Web application penetration testing
  • Network penetration testing

Cloud and infrastructure

  • Cloud security and VAPT
  • Threat modelling
  • Digital forensics
  • Vulnerability assessment
  • Security posture analysis

Regulatory compliance

  • DPDPA Act (India), Digital Personal Data Protection
  • GDPR
  • PCI DSS assessment
  • CCPA
  • Cookie compliance audit
  • Privacy assessment and documentation

03 / Experience

Where I've done the work.

  1. Lead Security Engineer

    FIS Global

    Leading security engineering: driving architectural security decisions, overseeing penetration testing programmes, and mentoring security teams in enterprise environments.

    LeadershipArchitecturePentestingCompliance

  2. Senior Security Engineer

    Hewlett Packard Enterprise

    Delivered security assessments across cloud and enterprise infrastructure. Ran threat modelling, VAPT engagements, and privacy compliance audits for global products and services.

    Cloud securityVAPTThreat modellingPrivacy

  3. Senior Security Engineer

    HCLTech

    Four years across DAST and SAST, IoT VAPT, API security, digital forensics, and compliance assessments (GDPR, CCPA, PCI DSS) for global clients.

    DAST / SASTIoT VAPTGDPRForensicsAPI security

04 / Achievements

Tools I've built.

Non-public applications engineered for the companies I've worked with. They are proprietary, so the source code is not public.

Proprietary · Web application security

ADAST Scanner

A scanner for web applications that finds system-specific vulnerabilities so findings can be triaged properly, instead of drowning teams in generic noise. It adapts its test cases to the target's technology stack and behaviour, which makes each finding easier to validate and prioritise.

High-level test coverage

  • Injection: SQLi, command, SSTI, XXE
  • Cross-site scripting: reflected, stored, DOM
  • Broken authentication and session handling
  • Access control: IDOR / BOLA, privilege escalation
  • SSRF and open redirects
  • Security misconfiguration and header analysis
  • JWT, CORS and API weaknesses
  • File upload and deserialisation flaws
  • Business-logic abuse checks

Proprietary · AI-driven security

AI-Engineered Threat Modeler

An AI-powered threat modelling platform. It takes a set of questionnaires and data flow diagrams (DFDs), and a built-in DFD generator produces the diagrams, then enumerates high-level threats. AI agents can later take those threats and triage them into concrete vulnerabilities.

How it works

  • Questionnaire-driven system profiling
  • Automated DFD generation
  • High-level threat enumeration from DFDs
  • Iterative modelling rounds that refine the result
  • Multiple AI models supported for better coverage
  • Threat-to-vulnerability triage by AI agents

05 / Services

What you can hire me for.

Security assessment

DAST, SAST, IoT VAPT, API VAPT and threat modelling, with clear and reproducible findings.

Compliance audit

DPDPA, GDPR, CCPA and PCI DSS assessments, cookie compliance audits and privacy assessments.

Threat remediation

Source code vulnerability fixes, security components, cookie banners and compliant privacy implementation.

Security consultancy

Security posture reports, vulnerability assessments and compliance recommendations for your leadership.

06 / Education

Academic credentials.

07 / Contact

Let's secure what you're building.

Tell me about your product, your timeline, and what worries you. I read every message personally.