Experience
Jun 2025 — Present
Co-Founder & CTO
CRIS InfoTech · Hyderabad
Own the company's technical direction and delivery for VAPT/WAPT, SAST, secure code review and AI security engagements.
- ⟩Set up the VAPT practice: methodology on OWASP WSTG, MASTG, API Top 10 and PTES, report standards and a 4-member freelance tester bench.
- ⟩Lead web, Android/iOS and API pentests end to end — scoping, exploitation, reporting and retesting.
- ⟩Built in-house AI tooling: an automated attack agent and an LLM security scanner that speed up delivery.
- ⟩AI/LLM, MCP server and AI-generated code reviews mapped to OWASP Top 10 for LLMs and MITRE ATLAS.
- ⟩Technical pre-sales, threat modeling (STRIDE) and client walkthroughs with engineering and leadership.
Projects in this role · click to open
Web · API · Mobile · Code5 findingsVAPT, SAST & Secure Code ReviewAccess-control & IDOR flaws · Injection · Auth & session weaknesses +2 more+
What I found
Scope · Tools
Web apps & admin panels · REST / GraphQL APIs · Android & iOS apps · Source code (SAST + manual)
Outcome · 100+ VAPT, SAST and code review projects delivered on one OWASP WSTG / MASTG / PTES methodology, every report peer-reviewed and retested.
AI security4 findingsAI / LLM & MCP Security AssessmentsPrompt injection (direct & indirect) · Sensitive data leakage · Insecure output handling +1 more+
What I found
Scope · Tools
Chatbots & RAG apps · AI agents · MCP servers · AI-generated code
Outcome · Findings mapped to OWASP Top 10 for LLM Applications and MITRE ATLAS, with guardrail fixes re-tested automatically.
Design review3 findingsThreat Modeling & Architecture ReviewsDesign-level access-control gaps · Unsafe data flows · Missing trust boundaries+
What I found
Scope · Tools
Web, mobile & API designs · AI-powered applications · Data-flow diagrams
Outcome · Design risks caught before testing began — cheaper to fix than after release.
Research · content3 findingsVulnerability Write-ups & Client AwarenessWordPress misconfigurations (WPScan) · Exposed admin & debug endpoints · Outdated plugins and themes+
What I found
Scope · Tools
Anonymised findings from real tests · LinkedIn posts for CRIS InfoTech and HackWithSKR
Outcome · Clients learn what attackers look for — and CRIS InfoTech builds credibility with real, anonymised research.
Jan 2025 — May 2025
Cybersecurity Specialist
Freelance · IT & OT VAPT, SOC, Malware, AI security, GRC
Detection engineering, SOC triage, malware analysis and threat intelligence for client organisations.
- ⟩Built SPL, KQL and Sigma detections mapped to MITRE ATT&CK; tuned SIEM rules to cut false positives.
- ⟩L1/L2 alert triage across SIEM and EDR; automated phishing triage and IOC enrichment with SOAR + Python.
- ⟩Reverse engineered ransomware, RATs and info-stealers; wrote YARA rules; ran dark web monitoring.
- ⟩OT security and IT network VAPT with Tenable.io — black, grey and white-box pentests, audit support and remediation retesting.
- ⟩AI / LLM security testing for chatbots and AI-enabled workflows.
Projects in this role · click to open
OT / ICS5 findingsOT Security VAPTWeak IT–OT segmentation · Default or shared credentials on OT assets · Insecure industrial protocols without authentication +2 more+
What I found
Scope · Tools
OT / ICS networks — HMIs, PLC segments, engineering workstations · IT–OT segmentation and remote access · Asset discovery and vulnerability assessment · Passive-first, safe testing in production OT
Outcome · Prioritised OT hardening plan — segmentation, credential and remote-access fixes — without disrupting operations.
IT infrastructure4 findingsIT Network VAPTUnpatched critical CVEs · Exposed services and admin panels · Weak credentials +1 more+
What I found
Scope · Tools
Corporate networks and servers · Internal and external attack surface · Authenticated vulnerability scans
Outcome · Risk-ranked findings with clear fixes, validated by re-scan and retest.
AI security4 findingsAI / LLM Security TestingPrompt injection · System prompt and data leakage · Unsafe output handling +1 more+
What I found
Scope · Tools
LLM chatbots and assistants · AI-enabled workflows · AI-assisted SOC and malware analysis
Outcome · AI features tested against the OWASP Top 10 for LLM Applications, with guardrail and process fixes.
Threat intelligence4 findingsMalware Analysis, Threat Intel & Dark Web MonitoringLeaked credentials & exposed data · Threat-actor chatter about clients · C2 infrastructure & IOCs +1 more+
What I found
Scope · Tools
Ransomware, RATs, droppers, info-stealers · Leak sites, forums, Telegram (passive, lawful) · Phishing campaigns
Outcome · IOCs, YARA rules and intel reports that fed SOC triage and blocking.
VAPT · GRC3 findingsPentesting, Hardening & Audit SupportExploitable vulnerabilities with PoCs · Weak server & network baselines · Control and evidence gaps+
What I found
Scope · Tools
Black, grey & white-box pentests · Secure configuration reviews · Internal & external audits
Outcome · Risk registers, control mappings and remediation validated by re-testing; RCA and IR support for incidents.
SOC3 findingsL1/L2 Alert Triage & InvestigationCredential-stuffing and brute-force alerts · Suspicious process and PowerShell activity · Benign noise worth tuning out+
What I found
Scope · Tools
SIEM and EDR consoles · True / false positive classification · Escalation and case notes
Outcome · Every case documented and escalated correctly, with noisy rules fed back for tuning.
Email security3 findingsPhishing & Email Threat InvestigationsSpoofed senders failing SPF / DKIM / DMARC · Credential-harvesting pages · Malicious redirect chains+
What I found
Scope · Tools
Reported phishing emails · Malicious URLs and attachments · Email headers and sender authentication
Outcome · Attack sources identified and blocked, with steps to stop repeat campaigns.
Jan 2020 — Jan 2025
Cybersecurity Analyst
BERRY9 IT Services Pvt Ltd · Hyderabad
Five years of VAPT, API and mobile security testing alongside SOC monitoring and incident investigation.
- ⟩Discovered and validated 300+ vulnerabilities — RCE, SSRF, SQLi, IDOR, auth bypass, business logic flaws.
- ⟩Deep API testing (JWT, OAuth, BOLA, mass assignment) and Android/iOS testing with Frida, Objection and MobSF.
- ⟩SOC monitoring and threat hunting with Splunk, AlienVault USM and EDR tooling.
- ⟩Purple team exercises and mentoring junior analysts.
Projects in this role · click to open
Web9 findingsWeb Application VAPTSQL injection · XSS · IDOR +6 more+
What I found
Scope · Tools
Customer & admin web apps · Black / grey-box testing · Re-testing after fixes
Outcome · Part of 300+ validated vulnerabilities — reported with CVSS, PoC evidence, root cause and fixes, then re-tested.
REST & GraphQL7 findingsAPI Penetration TestingBOLA (object-level authorization) · JWT handling flaws · OAuth flow weaknesses +4 more+
What I found
Scope · Tools
REST & GraphQL APIs · JWT & OAuth flows · Rate limiting
Outcome · Attack chains like account takeover and data leakage proven, then fixed.
Mobile5 findingsMobile App Security (Android & iOS)Hardcoded secrets · Insecure local storage · Weak cryptography +2 more+
What I found
Scope · Tools
Static (SAST) & dynamic (DAST) analysis · Reverse engineering · Runtime manipulation
Outcome · Mobile findings fixed before release and validated on retest.
Infrastructure4 findingsNetwork, Endpoint & Cloud Workload VAPTExploitable services · Misconfigurations · Privilege escalation paths +1 more+
What I found
Scope · Tools
Internal networks · Endpoints · Cloud workloads
Outcome · Clear remediation steps with vulnerability counts and exploitation evidence.
Human layer2 findingsPhishing & Social Engineering AssessmentsSusceptible users & departments · Spoofable sender configurations+
What I found
Scope · Tools
Phishing campaigns · Email header analysis · Awareness
Outcome · Reduced human-layer risk and stronger security awareness.
Exploitation4 findingsExploit PoC & Attack-Chain DevelopmentAccount takeover chains · Privilege escalation · Sensitive data leakage +1 more+
What I found
Scope · Tools
Proof-of-concept exploits · Chaining low-severity bugs into real impact · Business-risk write-ups
Outcome · Stakeholders saw real business risk — not just a list of scanner findings — and prioritised fixes accordingly.
Vulnerability management3 findingsRe-testing & Remediation ValidationIncomplete fixes · Regressions after releases · Issues fixed on one endpoint but not others+
What I found
Scope · Tools
Re-tests after fixes · Continuous assessment cycles · Closure evidence
Outcome · Findings closed for real, with evidence — not just marked done.
Ongoing
Lead Cybersecurity Trainer
Hacktr Technologies · HITEC City, Hyderabad
Classroom and live online training across Offensive (VAPT), Defensive (SOC) and AI & LLM Security tracks.
- ⟩4000+ students trained, with resume help, interview prep and mentoring into cybersecurity roles.
- ⟩Designed a lab-based curriculum aligned with CEH v13 — web, API, mobile, bug bounty, OSINT, malware and GenAI security.
- ⟩Building Hacktr Technologies AI — the institute's AI career portal.
Projects in this role · click to open
Curriculum design4 topicsCEH v13-Aligned Lab CurriculumWeb, API & mobile pentesting · Bug bounty & OSINT · Malware analysis +1 more+
Topics covered
Scope · Tools
Offensive (VAPT), Defensive (SOC) and AI & LLM Security tracks · 80% hands-on labs
Outcome · 4000+ students trained on practical, job-ready skills.
Lab engineering4 topicsAttack & Defense Lab EnvironmentsReverse shells & RATs · Persistence mechanisms · IOC extraction +1 more+
Topics covered
Scope · Tools
Virtual labs for ethical hacking and red team · Malware analysis & reverse engineering labs · SOC & SIEM practice
Outcome · Realistic attack and defense scenarios students can practise 24/7.
Product3 topicsHacktr Technologies AI Career PortalJob-readiness tracking · Resume optimisation · Interview preparation+
Topics covered
Scope · Tools
Course access & progress tracking · Job listings · ATS resume builder · AI mock interviews
Outcome · Students go from course to job applications in one place.
Awareness content3 topicsPhishing Awareness Video SeriesSpotting malicious links · Checking URLs with VirusTotal · Reporting phishing safely+
Topics covered
Scope · Tools
Short-form videos for students and the public
Outcome · Simple, shareable lessons that make people harder to phish.
Career support4 topicsStudent Mentoring & Placement SupportResume reviews · Interview preparation · Career path guidance +1 more+
Topics covered
Scope · Tools
Resume and LinkedIn optimisation · Technical and HR mock interviews · 1:1 mentoring
Outcome · 4000+ students supported into cybersecurity careers.
Let's Work Together
VAPT engagements, SOC consulting, AI/LLM security assessments, incident response or training at Hacktr Technologies — tell me what you're protecting and I'll reply within one working day.
1. Scoping call
30 minutes on what you need — apps, APIs, SOC, AI or training.
2. Proposal
Clear scope, rules of engagement, timeline and price.
3. Test, report, retest
Findings with PoC and fixes, then a free retest.
Security projects
CRIS InfoTech · Co-Founder & CTO
VAPT, SOC, AI/LLM security, forensics, incident response
contact@crisinfotech.comTraining & courses
Hacktr Technologies · Lead Trainer
Batches, corporate training, career & placement help
info@hacktrtechnologies.comTalk to me directly
Sudhakar Reddy · LinkedIn
Speaking, collaborations, mentoring — message me on LinkedIn
Message on LinkedIn