Karthik Reddy

→ Managing a group of 6 peoples in infosec and working closely with CISO and Business units to conduct Risk Assessments, DevSecOps Implementation and analysis of in-house security tech stacks. → Finding security gaps in cloud environment, IAM, DLP & onboarding new tools/vendors. Migrated On-Premises AppSec & CI/CD Infrastructure to GCP cloud. → Implemented DevSecOps process & Security Stacks like Code Quality Analysis, SCA – Sonatype Nexus Lifecycle, SAST - FortifySCA, DAST - WebInspect, IAST – Contrast Security, RASP – Imperva & vulnerability management tool – FortifySSC. → Implemented AI/ML Security Assessments on ML Models, track down the Open-Source Security Components using Nexus Lifecycle, NB-Defense, Rebuff and ModelScan – AI/ML and saved $1.6 billion in potential losses. → Implemented GCP DevOps to automate the Security stacks. → Developed and customized Docker files to integrate DevSecOps security stacks, automating the deployment through CI/CD pipelines and managing the hosting of these stacks within an OpenShift environment. → Handling Internal & External stakeholders on Delivery Management (Application & Cloud Security). Also, responsible for hand-on training on DevSecOps tools, Process. → Recognition with the 'DevSecOps Trailblaze of the Year' award from Sonatype’s Elevate Awards

Lead a group of 9 members in the InfoSec - DevSecOps team and was Responsible for continuous End-to-End Security Integrations, Deployments, Releases, Monitoring, and Feedback. ⇢ Collaborated with client product specialists to analyze and document business requirements and data specifications for enhancing the DevSecOps Process and handle Idea Sheet, FRI/RFP, VMO, and POC to Onboard the tools to utilize in Alshaya's Environment. Evaluated and recommended a standard software toolset for team members to enhance productivity. A representative from infosec for all the Digital Transformation Initiatives and handling project management of 63 initiatives. ⇢ Coordinated project activities across multiple departments (QA, Development, Customer Support, and Documentation) across multiple geographical locations (Mena, Russia, and India). Created dedicated development, QA, UAT, and staging environments. Implemented DevSecOps framework and follows the same to all projects, Created pipelines to integrate the security tools and follows the ShiftLeft process from planning, Coding phase, and analyzing security vulnerabilities at the early stage to mitigate them. ⇢ Implemented, and integrated the security tools into the CI/CD pipeline of GitLab Using SonarQube, Snyk, Sonarlint, Fortify-SCA, CheckmarX, WebInspect, Appscan, Contrast Security IAST + RASP, Datadog ASM, for tracking used JIRA, configured the End-to-End pipeline for all projects to automate the process. Provided troubleshooting in the event of any errors and unpredicted behavior. ⇢ Perform Internal, External vulnerability assessments to scan the Internal Servers, and cloud servers (AWS, Azure, Aquia, and Oracle) and Analyzed Technologies and Applications using tenable.io, tenable.sc, Qualys to identify weaknesses and provide solutions to improve Security. Using ArcSight for Continuous Monitoring, Incident Response, and Log Management.

Lead a group of 4 members in the InfoSec - DevSecOps team and was Responsible for continuous End-to-End Security Integrations, Deployments, Releases, Monitoring, and Feedback. ⇢ For the cybersecurity ratings, compliance control, and Probable finance loss used Blackite for Continuous Automated Red Teaming (CART) and Attack Surface Management (ASM) used Firecompass. ⇢ Working with NewRelic for APM (Application Performance Management), and Datadog ASM for including all applications and cloud/on-premise services, ArcSight for Log Management to monitor all the logs of Servers, Applications & Cloud Native Services, and POS. For “End-Point Detection & Prevention” – XDR using SentinelOne, Microsoft Defender for Cloud. For Mobile Security Using Zimperium, and Intune for Hardening. ⇢ Perform the penetration testing of mobile (Android and iOS) applications, specifically, APK reverse engineering, traffic analysis, manipulation, and dynamic runtime analysis. ⇢ Installation/upgrade of the ArcSight solution components and formation of content-specific queries, templates, reports, rules, alerts, dashboards, and workflows. Integrate data and event feeds with ArcSight solution. Troubleshoot log source integration issues on servers and active directory, Analyze and resolve complex and Real-time monitoring. ⇢ Working on tasks associated with being the Software Build Approver that required running various tests and an associated pre-build check on submitted problem resolution items. Consistently improved the quality of the product by proactively raising and fixing the issues/bugs, rigorously. Involved in the migration process from on-premise to Azure Cloud.

✔Implemented Cloud Native DevOps (AWS) and Managed GitHub repositories, and permissions, including branching and tagging/Versioning. ✔Create and maintain fully automated CI/CD pipelines for code Build and Deployment using Jenkins and AWS to reduce human effort and speed up production processes ✔Install, Configure tools needed for DevOps and Worked on the configuration part of Jenkins Jobs, Nodes, and plugins to integrate ✔Coordinating with developers and testers for Github and SonarQube-related issues  ✔Built and deployed Docker containers to break up the monolithic app into micro-services, improving developer workflow, increasing scalability, and optimizing speed ✔Actively Manage, Improve, Docker Containers and Monitoring Successfully with Kubernetes, scaling and using AWS EC2 instances ✔Successfully integrated Security tools like OWASP ZAP, Burpsuite, SonarQube, Checkmarx and analyzed reports ✔Integrating Security Practices in CI/CD pipeline for achieving secure deployment of applications ✔Creating a pipeline for different Java, Python, and C# applications ✔If the build or Deployment fails, a Roll-Back plan is followed to make the previous changes reflect ✔Deploy, configure, and manage test runtime environments ✔Troubleshooting and resolving issues in DEV, UAT, and Test Environment ✔Handling different AWS services like Infrastructure as Code (Cloud Formation), VPC, ElasticBeanStalk, lambda, SNS, S3, etc. ✔Monitoring and Visualization of the Application’s metrics and graphs using ELK Stack, Nagios, Splunk, etc. ✔Implements and maintains Splunk platform infrastructure, configuration, and integration with external systems. Undertakes day-to-day operational and user support. Scopes project requirements and executes new projects as well as data and user onboarding. Assist users on Splunk platform system-related issues. ✔Supporting Onsite deployment at onsite from off-shore  ✔Managing Windows, Linux, and PowerShell or Unix shell

✔Worked on Creating Azure Automation Accounts, Certificates, and Users in Active Directory. ✔Creating Azure PowerShell Runbook scripts to automate the complete process for the VMs. ✔Resizing the VMs for Vertical & Horizontal Scaling using PowerShell scripts. ✔After successfully resizing the VM and the admin will get the output status through an email notification about the VM’s working status. ✔Handling Application Deployments into Azure EKS. Scanning the Docker file using Fortify, Anchore for Image/Container security, and “Kube Hunter” for Kubernetes security. ✔Creating schedules to trigger the RunBooks periodically. ✔Performing application security, penetration testing, and vulnerability assessment with tools such as Nmap, Wireshark, Nessus, OWASP ZAP, Metasploit, Burp Suite, etc ✔Performed host, network, and web application penetration tests ✔Prepare audit reports that identify technical and procedural findings with the help of the Tenable Nessus tool ✔Performed network security analysis and risk management for designated systems ✔Analyze vulnerability test reports and suggest remediation/mitigation plans. Includes the ability to prioritize process and reporting enhancements ✔Discovered and communicated two reflective cross-site scripting vulnerabilities and two unprotected directories while performing an external web security assessment ✔Experience with Unix and Windows platforms ✔Strong work ethic and ability to effectively multi-task in a fast-paced support environment ✔Knowledge of PCI-DSS, Risk Assessment, ISO-27001, ISO-27005, and ISO-27034

 Perform Application Security Assessments on more than 150 applications  Perform Automated Source Code Review with HP-Fortify and eliminate false positives.  Conducted infrastructure scans/tests on Networks and Servers using Nessus.  Preparing reports for the application security assessments with vulnerability explanation, risk analysis, and remediation process.