Principal Penetration Testing Consultant — Offensive Security & Application Security
- 👤 Name — Dheeraj Kumar Jayaswal
- 🌍 Location — Dublin, County Dublin, Ireland
- 💼 Role — Principal Penetration Testing Consultant | VikingCloud (previously Technology Lead – Offensive Security, Infosys Limited)
- 🎯 Primary Focus — Web Application & API Security — Offensive Security Consulting
- 🏆 Experience — 16+ Years in IT | 9+ Years in Offensive Security
- 🔎 Edge — Started as a full-stack developer (ASP.NET / SQL Server) — I think like a developer and attack like a hacker
- 🎓 Pursuing — OSWE — OffSec Web Expert (OSCE3 track)
- 🏢 Domains — Income Tax · Banking · Retail · E-commerce · Freight Logistics · Education
- 📝 Sharing — Enterprise pentest field notes, methodology, and practical write-ups across the repos below
| Repository | What's in it |
|---|---|
| ⭐ From-Dev-To-Attacker | My flagship field journal — 67 original write-ups on vulnerability patterns, written from a developer's lens, with enterprise domain-impact framing across Income Tax, Banking, Retail, E-commerce, Freight Logistics, and Education |
| ⭐ CICD-Goat-Vapt-Writeup | Full VAPT writeup against OWASP CICD-Goat — 16 findings including CVE-2024-23897, mapped to the OWASP Top 10 CI/CD Security Risks, with PoCs and interview-ready summaries |
| 🌱 From-Pentester-To-Red-Teamer | My structured 24-month roadmap for transitioning from Web/API pentesting into Red Teaming — phases, labs, certifications, and progress tracked openly as I work through it |
| ⭐ AppSec-From-The-Trenches | Pentest tools & methodology reference — how I actually use Burp Suite, Nmap, Metasploit, Hydra, Hashcat, and more, plus my WAPT methodology |
| ⭐ API-From-The-Trenches | Deep-dive API security series — OWASP API Top 10 coverage, BOLA, JWT attacks, GraphQL testing, full methodology |
| 🚀 Bug-Bounty-Hunting-Companion | Real, publicly-disclosed bug bounty reports broken into reproducible checklists |
| 🚀 DarkWeb-From-The-Trenches | Threat intelligence & dark web OSINT methodology — credential leak monitoring, ransomware tracking, pre-engagement TI |
| 🚀 .pcap-Arsenal | Packet captures organized by protocol, for Web/API/Network-layer analysis and learning |
| 🌟 Pentest-Engagement-Playbook | Consultant-grade scoping, ROE, severity rationale, and executive reporting templates — the client-facing operational playbook behind an engagement |
⭐ Core original write-up series · 🌱 Currently in progress — my next chapter · 🚀 Reference & companion resources
CI/CD & DevSecOps Security — Jenkins, GitLab CI, GitOps pipeline attack surfaces, OWASP CI/CD Top 10
"The best security professionals think like developers first and attackers second. If you understand why systems are built the way they are, you will always find more than any scanner ever will."
I approach every engagement in three phases: understand before you attack (read the app, use it as a real user, learn the business logic first) → manual first, tools second (the interesting bugs are found by thinking, not scanning) → report like a developer (a finding the dev team can't reproduce is a finding that never gets fixed).
💼 Total IT Experience 16+ years
🔒 Offensive Security 9+ years
🐛 Critical/High Findings 200+ across enterprise engagements
🏢 Domains Tested Income Tax · Banking · Retail · E-commerce · Freight Logistics · Education
📚 Public Write-ups 9 active repositories, 100+ original articles and references
| Certification | Issuer | Status |
|---|---|---|
| Certified Ethical Hacker (CEH) | EC-Council | ✅ 2021 |
| AWS Certified Solutions Architect – Associate | Amazon Web Services | ✅ 2022 |
| AWS Certified Cloud Practitioner | Amazon Web Services | ✅ 2022 |
| Executive Certificate in Cyber Security | IIT Kanpur | ✅ 2026 |
| OSWE — OffSec Web Expert (OSCE3 track) | OffSec | 🔄 In Progress |
Future direction — Red Teaming: OSCP → CRTO → OSEP, CRTP, CRTL, CRTE
Open to consulting, collaboration, and security discussions.
Security is not a product. It is a mindset built one vulnerability at a time.
#WebSecurity · #APISecurity · #PenTest · #OffensiveSecurity · #AppSec