Cyber Security Specialist — WAF & ASM
Securing apps. Blocking threats. Not today, hacker.
I'm Vineeth Tunk, a Cyber Security Specialist focused on WAF & ASM at Bristol Myers Squibb.
I started with bug bounty hunting and web development freelancing, then moved through managed security services into enterprise security. That means I've seen both sides of the firewall.
My work spans WAF governance, attack surface management, vulnerability assessment, security automation, and investigation workflows.
Languages: English, Hindi, Telugu
Community & Conferences: BSides Ahmedabad, AWS Community Day, The Hackers Meetup
Career narrative: Vendor side (MSSP at Indusface) → enterprise side (BMS) — 'both sides of the firewall.'
Browser automation that bulk-retests high-severity ASM findings; survives virtualized lists, dynamic selectors, and rate limits with resumable + dry-run mode.
Concurrent endpoint-exposure checks across AWS API Gateway, DNS-failure detection, app crawling with risk-signal scoring, and automated Excel/Word reporting.
ModSecurity WAF environment for internal testing: rule engineering, attack simulation, and real-time traffic analysis versus OWASP Top 10.
Practical AppSec, SSL/TLS, API security, and WAF lessons explained with humor, memes, and real production context.
Understand the domain validation methods behind modern SSL/TLS certificate automation.
Cert lifetimes are heading from 1 year to 47 days — automate renewals before it hurts.
Why SSL is legacy language, TLS is the modern protocol, and TLS 1.3 is where teams should be.
The confusion matrix, minus the confusion — Peter Griffin triggers every alert type so you don't have to.
Your site's invisible bodyguards — stop clickjacking and XSS with zero code changes.
Understanding rate limiting, throttling, and automated bot mitigation.