Mahesh T.
Bengaluru, Karnataka · Cloud Security Specialist · Crayon
AVSCET
2 followers
About
Experienced technology professional with over 13 years of expertise in cloud security, IT infrastructure, and risk management. Skilled in securing cloud environments on AWS and Azure, automating incident response, and conducting in-depth vulnerability assessments to safeguard critical assets. Proven ability to implement advanced threat intelligence solutions, optimize security policies, and enhance organizational readiness against evolving cyber threats.
Specialties
- Bug Bounty
- Cloud Security
- Ethical Hacking
- Penetration Testing
- Web Application Testing
Skills
- AWS
- Azure
- CIS Benchmark
- AWS Security Hub
- Azure Security Center
- CloudSploit
- Qualys
- Alert logic
- Burp Suite
- Netsparker
32 skills in total
Licenses & Certifications
-
CompTIA SecurityX
CompTIA
Issued Jan 2025
-
Licensed Penetration Tester
EC-Council
Issued Jan 2024
-
Certified Penetration Testing Professional
EC-Council
Issued Jan 2024
7 certifications in total
Experience
-
CLOUD SECURITY SPECIALIST
Crayon
Aug 2022 — Present
Bengaluru
-
SR. SECURITY ENGINEER
Tangoe, Inc.
Mar 2019 — Jul 2022
Bengaluru
-
SECURITY ANALYST
Unocoin Technologies Pvt Ltd
Jul 2017 — Mar 2019
Bengaluru
7 experiences in total
Education
-
AVSCET
Bachelor of Technology, Electronics and Communications Engineering
Unknown — May 2011
Recent posts
[celebration:new_certification]Has successfully verified **Certified Penetration Testing Professional** (EC-Council) and **Licensed Penetration Tester** (EC-Council)
Most expensive breaches don't start with an exploit. They start with a design decision nobody challenged in a meeting.
Pentest reports, DAST scans, bug bounties — all of it finds problems after they ship. Threat modeling is the one practice that catches them while they're still a whiteboard drawing. It's also the practice most organisations perform rather than actually do.
I spent the last week writing a three-part series on this:
𝟭. 𝗧𝗵𝗿𝗲𝗮𝘁 𝗠𝗼𝗱𝗲𝗹𝗶𝗻𝗴 𝗘𝘅𝗽𝗹𝗮𝗶𝗻𝗲𝗱 — what it actually buys you, and how to tell whether your org does it or just has a slide that says it does.
𝟮. 𝗕𝘂𝗶𝗹𝗱𝗶𝗻𝗴 𝗮 𝗣𝗿𝗼𝗴𝗿𝗮𝗺 𝗧𝗲𝗮𝗺𝘀 𝗔𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗥𝘂𝗻 — the technique is well understood; programs fail on the operating model around it. What has to be true for threat modeling to survive contact with a delivery schedule.
𝟯. 𝗧𝗵𝗿𝗲𝗮𝘁 𝗠𝗼𝗱𝗲𝗹𝗶𝗻𝗴 𝗳𝗼𝗿 𝗖𝗹𝗼𝘂𝗱 — cloud breaches are rarely exotic. They're identity and configuration decisions. Your risk concentrates in different places, and your control budget should follow it.
All three links in the first comment.
If your last threat model lives in a document nobody has opened since the review meeting — start with part two.
#ThreatModeling #CloudSecurity #CISO #ApplicationSecurity #SecurityLeadership
Part 1 — Threat Modeling Explained: https://maheshtata.com/writing/threat-modeling-explained/
Part 2 — Building a Program Your Teams Actually Run: https://maheshtata.com/writing/how-to-perform-threat-modeling/
Part 3 — Threat Modeling for Cloud: https://maheshtata.com/writing/threat-modeling-for-cloud-applications/
[celebration:new_certification]Has successfully verified **CompTIA SecurityX** (CompTIA)
[celebration:new_certification]Has successfully verified **Certificate of Cloud Security Knowledge** (CSA), **AWS Certified Security (Specialty)** (AWS) and 2 more certifications