Mukesh Kumar

Directed end-to-end product security for both hardware and software development, ensuring a robust security posture from design through deployment.

Managed the entire Application Security program, driving the adoption of best practices and continuous improvement across the product lifecycle.

Utilized a diverse toolkit including Snyk, SonarQube, GitHub Advanced Security, Proxmark3, Kali Linux, Flipper Zero, and HackRF for comprehensive security assessments and threat mitigation.

Collaborated with cross-functional product teams, leveraging AWS, Jira, and Confluence to embed security early in the development process.

Led the Application Security function, implementing secure SDLC best practices across IKEA's product development lifecycle.

Collaborated with product teams to embed security, conducting threat modeling, SAST, DAST, and SCA to proactively identify and mitigate vulnerabilities.

Utilized a comprehensive suite of security tools including GHAS, Polaris, SonarQube, BlackDuck, and InsightVM to manage and remediate security flaws.

Integrated security processes within GitHub, GCP, Azure, and Jira environments to ensure continuous security monitoring and compliance.

Directed application security and secure SDLC for public-facing web applications, significantly enhancing security posture for private clients.

Optimized SOC operations by configuring SIEM alerts and crafting bespoke use cases in Splunk and ArcSight, improving threat detection accuracy.

Executed comprehensive AppSec tasks, including SAST/DAST/RASP, OSS, WAF implementation, and manual penetration testing.

Leveraged a wide array of security tools such as Fortify SCA, Coverity, Veracode, AppScan, Burp Suite, Akamai/Imperva WAF, and Jenkins for robust security assurance.

Led comprehensive vulnerability assessments and penetration testing (VAPT), significantly enhancing the security posture of key applications and systems.

Developed and implemented robust application security measures, ensuring critical software applications remained secure against evolving threats.

Oversaw network security protocols and data protection strategies, achieving compliance with industry standards.

Directed mobile application security initiatives, identifying and mitigating risks to user privacy and data integrity.

Conducted thorough API security testing, safeguarding integrations and data exchanges between systems.

Implemented DevSecOps practices, reducing vulnerabilities by embedding security into the development lifecycle.

Executed proactive threat modeling and utilized tools like Fortify, Nessus, and Qualys for real-time security flaw identification and remediation.

Ensured adherence to FIPS 140-2, US-CERT, and HIPAA standards, bolstering organizational compliance and trust.

Managed critical security operations within a Security Operations Center (SOC), ensuring robust defense for organizational assets.

Monitored, analyzed, and administered SIEM solutions (ArcSight, Splunk Enterprise), enhancing threat detection capabilities by 15%.

Developed and implemented tailored use cases, improving vulnerability addressal and overall security posture.

Conducted quarterly VAPT with Fortify and AppScan, proactively identifying and addressing security weaknesses.

Managed defenses against DDoS attacks, suspicious spikes, and insider threats, utilizing preventive and detective tools to maintain system integrity.

Oversaw DLP using SecureSync and Mimecast, safeguarding Personal Identifiable Information (PII) and ensuring data privacy.

Ensured compliance and patching of servers and network devices, strengthening the overall cybersecurity framework.

Integrated Web Application Firewall (WAF) Imperva with Splunk, improving web threat monitoring and response capabilities.

Streamlined quarterly re-certification of over 300 global access points, ensuring proper authorization and compliance.

Managed worldwide user access via ZScaler, maintaining secure connectivity and consistent policy enforcement.

Oversaw physical security operations through ArcSight, supervising IronKey encrypted USB drives and RSA tokens for secure authentication.

Participated in internal audits and monitored organizational social media, proactively identifying potential compromises.

Maintained strict role-based access controls, reducing unauthorized usage and security risks across systems.

Supported business continuity planning during crises, conducting vulnerability scans on over 3000 servers and sites using QualysGuard.

Actively managed incidents, phishing investigations, and malware analysis, contributing to a strengthened security culture.