sahil:~$ whoami

SAHIL
SHAILESH
ZUNJARRAO

Security Engineering · Incident Response · Application Security · Technical GRC

NYU Tandon MS Cybersecurity student with hands-on experience in digital forensics, endpoint IT operations, and security-focused software testing. I contribute to OpenSSF gittuf and work with NYU’s OSIRIS Lab on ROS2/SROS2 security research.

Security Engineering Incident Response Application Security OpenSSF
Explore my work Try incident challenge Contact me
01 // security_timeline

Experience

Security work spanning open-source contributions, academic research, cybercrime investigations, and technical leadership.

Endpoint Team Student Assistant

Sep 2026 → Present
NYU IT Endpoint Engineering · New York University
  • Support endpoint systems through device configuration, troubleshooting, testing, and issue resolution.
  • Document technical findings and support requests in ServiceLink, coordinating escalations with IT teams.

Open Source Contributor

May 2026 → Present
Secure Systems Lab, NYU · OpenSSF gittuf
  • Contribute to gittuf, an OpenSSF project focused on improving the security of Git repositories and software supply chains.
  • Added Go tests for DSSE VerifyEnvelope invalid-threshold and threshold-not-met error paths.
  • Added tests for Lua sandbox RunScript behavior and SSH signer/verifier error paths.

Lab Member

Jan 2026 → Present
OSIRIS Lab · NYU Center for Cyber Security
  • Involved in ROS2 and SROS2 security research exploring security mechanisms and potential attack surfaces in robotics environments.
  • Participate in technical discussions, workshops, and collaborative learning across offensive security, incident response, and internet security.

Cyber Security Analyst

Jun 2024 → Dec 2024
Maharashtra Cyber · Mumbai, India
  • Conducted digital forensic investigations on 30+ evidence samples using Autopsy and FTK across fraud and phishing cases.
  • Managed 15+ cybercrime complaints from triage through response coordination, contributing to an approximately 50% resolution rate.
  • Prepared 5+ technical incident response reports for law enforcement professionals.
  • Analyzed digital impersonation, fraud, and phishing patterns to identify threat actor behavior and common exploitation techniques.
02 // verified_contributions

OpenSSF gittuf

Four merged Go testing contributions to OpenSSF gittuf. Every pull request links directly to its GitHub record.

gittuf-contributor-console
$ gittuf contributions --author Sahil-13082003 --status merged
PR #1457 MERGED ✓

DSSE VerifyEnvelope error-path tests

Added tests covering invalid threshold and threshold-not-met scenarios to strengthen validation of signature-verification behavior.

VIEW PR ↗
PR #1490 MERGED ✓

Lua sandbox RunScript tests

Expanded test coverage around internal Lua sandbox script-execution behavior.

VIEW PR ↗
PR #1555 MERGED ✓

SSH signer/verifier error-path tests

Added tests for malformed SSH signatures, invalid SSH2 key markers, incorrect key types, and malformed public-key material.

VIEW PR ↗
PR #1639MERGED ✓

Policy verification edge-case test

Added a Go test confirming expected error handling when VerifyRefFromEntry starts from a non-reference RSL entry.

VIEW PR ↗
03 // case_files

Security case files

Selected projects showing how I move from vulnerability discovery to analysis, remediation, and validation.

CASE 01 // APPLICATION SECURITY · STATUS: REMEDIATED

Application Security Assessment & Secure Deployment

XSS · CSRF · SQL Injection · Command Injection · Fuzzing · Docker · Kubernetes · GitHub Actions
DISCOVER Reproduced memory-safety failures and web-application vulnerabilities in vulnerable coursework applications.
EXPLOIT Demonstrated XSS, CSRF, SQL injection, OS command injection, and crash conditions with crafted inputs.
REMEDIATE Implemented secure coding fixes, environment-based secret handling, encrypted card data, and Android hardening.
DEPLOY Containerized with Docker, deployed with Kubernetes, and integrated security validation into CI/CD workflows.
CASE 02 // MEDICAL IoT · STATUS: ASSESSED

Infant Incubator Security Assessment & Hardening

STRIDE · Threat Modeling · Python · SQLi · AES · Risk Assessment
  • Built security requirements, asset inventories, trust zones, and STRIDE-based threat models.
  • Identified vulnerabilities including SQL injection, AES nonce/key weaknesses, race conditions, and authentication issues.
  • Implemented fixes including parameterized SQL, environment-based secrets, randomized AES nonces, rate limiting, and thread-safe token handling.
  • Validated security changes through testing of the updated implementation.
CASE 03 // SECURITY AUTOMATION · PROTOTYPE

AI-Assisted Security Analysis Agent

Python · Gemini API · Security Analysis · Automation
  • Built a Python prototype integrating the Gemini API to assist with interpreting potential vulnerabilities and security findings.
  • Explored automated assessment workflows, structured security reporting, and remediation recommendations.
  • Designed as an experimental analysis aid, not a replacement for manual validation.
VIEW PROJECT ↗
04 // analyst_mode

Try a 30-second SOC challenge

A simulated authentication-log triage exercise. Spot the source showing repeated failed logins.

/var/log/auth.log interactive sample
Sep 01 13:01:14 soc-gw sshd[4412]: Accepted publickey for backup from 64.119.30.9 port 4432 ssh2
Sep 01 13:01:19 soc-gw sshd[4414]: Failed password for admin from 185.220.101.42 port 5121 ssh2
Sep 01 13:01:22 soc-gw sshd[4417]: Failed password for root from 185.220.101.42 port 5125 ssh2
Sep 01 13:01:25 soc-gw sshd[4421]: Accepted publickey for deploy from 98.116.44.7 port 4432 ssh2
Sep 01 13:01:28 soc-gw sshd[4424]: Failed password for ubuntu from 185.220.101.42 port 5130 ssh2
Sep 01 13:01:33 soc-gw sshd[4428]: Failed password for test from 185.220.101.42 port 5137 ssh2

Select the suspicious source IP

Look for repeated failed authentication attempts across multiple usernames.

analyst@console: awaiting selection...
05 // capabilities

Security stack

Focused on security engineering, incident response, application security, and vulnerability management.

Security & Investigation

Incident Triage · Digital Forensics · Threat Analysis · Vulnerability Assessment · Risk Assessment

Application & Supply Chain

OWASP Top 10 · Secure Coding · Fuzzing · Go Testing · GitHub Actions · Threat Modeling

Tools

Autopsy · FTK · Wireshark · Burp Suite · Nmap · Splunk · Qualys VMDR

Systems & Frameworks

Python · Go · Bash · Linux · Windows · AWS IAM/S3 · Docker · NIST CSF · MITRE ATT&CK

06 // research_and_credentials

Research & credentials

IEEE PUBLICATION

A Comparative Study of XGBoost and Logistic Regression for Fraud Detection in Online Transactions

ICETET-SIP 2025 · IEEE · September 2025

Research comparing XGBoost and Logistic Regression for fraud detection in online transactions.

VIEW ON IEEE XPLORE ↗
CREDENTIALS

Verified certifications

ISC2 Certified in Cybersecurity (CC) EARNED
Google Cybersecurity Professional Certificate EARNED
Qualys Certified Specialist, VMDR EARNED
EDUCATION

New York University

MS Cybersecurity · Sep 2025 to May 2027 · GPA 3.88/4.0

Relevant coursework: Network Security, Application Security, Information Security & Systems Engineering, Applied Cryptography.

HONORS

1st Place, CFFiene Trip Pan-India Cybersecurity Hackathon

CyberFrat · December 2023

Secured 1st place as part of a four-member team for a controlled EternalBlue SMB vulnerability exploitation project.

07 // connect

Get in touch

Open to full-time cybersecurity roles beginning May 2027.

Interested in Security Engineering, Security Operations, Incident Response, Application Security, and technical GRC opportunities.

Email me LinkedIn GitHub
LOCATIONNew York City Metropolitan Area
EDUCATIONMS Cybersecurity · NYU
FULL-TIMEMay 2027
EMAILsahilzunjarrao03@gmail.com