Aseem Shrey

Built and shipped internal security automation systems, including: • Vulnerability Management System • Dynamic Application Security Scanner (Go backend, Next.js frontend) • Security Leaderboard to drive security ownership across teams • Source code reviews across multiple products to identify security flaws early in the SDLC • Threat modeling exercises to proactively uncover design-level risks • Security awareness sessions and secure coding workshops for engineering teams • Interviewed and evaluated security engineering candidates

As a Senior Security Engineer at Gojek, I worked in ProdSec team, working on : Compliance as Code  • Designed and built a compliance automation framework from scratch in Go  • Executed automated CIS benchmarks across 250+ GCP projects  • Auto-remediated non-compliant cloud resources  • Deployed on Google Cloud Run; running in production for 5+ months with zero downtime Android & Web Application Pentesting  • Performed security testing for feature releases across GoJek’s web API backend and Android application  • Identified high-risk vulnerabilities before production release Code & Design Reviews  • Conducted security-focused code and architecture reviews for backend and mobile features  • Embedded security early in the SDLC to reduce production risk Red Teaming  • Led adversarial testing across the GoJek ecosystem  • Identified critical vulnerabilities and privilege escalation paths to uncover systemic security gaps

Joined as the 2nd member of the security team shortly after its formation; helped shape early security foundations and processes DNS-as-Code   • Designed and built an automated Terraform pipeline to manage DNS across Cloudflare and Route53   • Implemented failover capability to switch seamlessly between DNS providers   • Standardized DNS provisioning and reduced manual configuration risks   • Built using: Terraform G-Shield Security Bot (Shift-Left Initiative)   • Built a modular GitHub security bot to embed security directly into developer workflows   • Scans every PR for hardcoded secrets, insecure code patterns, vulnerable Docker images, sensitive mount points, and more   • Architected modular design enabling easy extension by other team members   • Built using: Python, Celery, GitHub APIs Temporary Database Credentials   • Integrated Vault with databases and GitHub teams to enable on-demand temporary DB credentials   • Reduced long-lived credential exposure and improved access governance Cognito Integration   • Collaborated with multiple teams to integrate AWS Cognito into legacy APIs   • Enabled improved authentication flows including Google OAuth and OTP-based login OAuth Proxy Implementation   • Integrated OAuth Proxy with GSuite authentication to improve access control and compliance for internal applications

DevOps intern. I worked on integrating health check into applications, whose metrics were further populated on kibana dashboards for easy management of the services.

Graduate student at MSIT-PE program with Prof Norman Sadeh as the program advisor.

Completed my 12th education from here