Mushahid BhatCPENT: Certified Penetration Testing Professional, EC-Council

Mushahid Bhat

Offensive Security & Vulnerability Researcher

Software Engineer at Centre for Railway Information Systems (CRIS) · PhD Scholar at Indian Institute of Technology (IIT) Delhi

I break things so they can be fixed. Over 5 years I have led security assessments of 270+ web and mobile applications for Indian Railways, spanning web, API, mobile, network, cloud and AI/LLM systems, and reported them against OWASP Top 10 / ASVS and CVSS.

Alongside security, I build: AI/ML and machine learning systems, mobile app security research, and web-based applications, and I deploy and fine-tune LLMs.

At the Centre for Railway Information Systems (CRIS), I work under Chief Information Security Officer Aishwarya K. Tiwari. I am also a PhD scholar in Computer Science & Engineering at IIT Delhi, advised by Prof. Vireshwar Kumar, researching network security with machine learning, and mobile app security. I am part of the Security and Privacy Research Innovation Group (SPRING) at IIT Delhi.

Contact meInternship openingsBook a callCertificate CourseLab access

Experience

Software Engineer: Cybersecurity, VAPT & DevSecOpsCentre for Railway Information Systems (CRIS), Indian RailwaysNov 2022 – Present+

Centre for Railway Information Systems (CRIS), Indian Railways · New Delhi

  • Conducting comprehensive VAPT of 270+ Indian Railways websites and web applications, covering OWASP Top 10, business logic flaws, authentication bypass and injection vulnerabilities.
  • Performing end-to-end mobile application security testing for Android and iOS, including SAST, DAST, APK/IPA reverse engineering and advanced Android analysis using AppKnox.
  • Discovered, reproduced and responsibly disclosed critical vulnerabilities including SQL Injection, SSRF, IDOR, broken authentication and insecure API endpoints across railway-facing platforms.
  • Producing client-ready vulnerability reports with CVSS scoring, risk classification, proof-of-concept exploits and prioritized remediation guidance; conducting post-fix re-testing and patch validation.
  • Designed and provisioned AWS infrastructure from scratch (EC2, VPC, IAM, S3, Route 53, Security Groups) following least-privilege and cloud security best practices.
  • Integrated HCL AppScan 360 (SAST & SCA) into Jenkins CI/CD pipelines for automated, shift-left security testing.
  • Deployed and managed Wazuh SIEM/XDR across 1,200+ endpoints and Nessus Tenable across 1,500 endpoints for threat detection and vulnerability management.
  • Built Grafana monitoring dashboards integrated with Prometheus and CloudWatch for application, endpoint and infrastructure visibility.
  • Performed network security assessments using Nmap, Nessus, Wireshark and Nipper for firewall/router configuration audits and device hardening.
  • Deployed the CRIS GRC Automation Platform and MotaData ITSM, and developed an internal website for the cybersecurity team.
  • Deployed IP DNS networking/DNS infrastructure to improve resolution reliability and network performance.
  • Deployed Forcepoint DLP and DSPM across 1,400+ endpoints, fine-tuning rules to reduce false positives.
  • Implemented AI models within automated VAPT tooling to reduce false positives and improve triage efficiency.

Education

Certifications

Projects

Mobile App Security Automation+
Automated Android and iOS application security testing, covering static and dynamic analysis and reporting.
Web Security using LLMs+
LLM-assisted web vulnerability testing, including AI models in VAPT tooling to cut false positives and speed up triage.
Malware Detection using Machine Learning+
ML-based classifier to identify and categorize malware families from behavioral features.
Securing Large-Scale Networks using Machine Learning+
Anomaly-detection system for intrusion detection in enterprise networks.
Real-Time Face Mask Detection (Deep Neural Networks, MobileNetV2)+
High-accuracy model deployed on embedded systems.
Smart Vehicle Tracking System+
IoT-based GPS tracking solution with a real-time web dashboard.

Technical Implementation

Web & API VAPTNetwork penetration testingExploit developmentAI / LLM red teamingMobile app securityMITRE ATT&CKOWASP Top 10 / ASVSCVSS reporting

Licensed

DNS (EfficientIP)

DNS & IP

Efficient IP and DNS infrastructure for reliable name resolution and network performance.

Innspark SIEM

SIEM

Seceon

SIEM

Tenable Nessus

Vulnerability scanner

Vulnerability management across 1,500+ endpoints.

Forcepoint

DLP & DSPM

Deployed across 1,400+ endpoints, with rules tuned to cut false positives.

Recorded Future

Threat intelligence (TIP)

Palo Alto SOAR

Security automation

Palo Alto Firewall

Network security

Trellix

Endpoint security

Deployment and monitoring across 1.2 lakh (120,000) endpoints.

Skyhigh Web Gateway

Secure web proxy

HPE iLO

Server management

HPE server management through iLO.

OpenVMS

Operating system

Operating system running the railway databases of CONCERT (Country-wide Network of Computerised Enhanced Reservation and Ticketing).

VMware

Virtualization

VM deployment.

RHEL

Red Hat Enterprise Linux

RHEL VM deployment.

Whitehats Technologies

GRC automation

Deployed the CRIS GRC Automation Platform.

Trinetra

C-DOT

C-DOT integrated cybersecurity platform: SIEM, SOAR, DLP and UEBA.

AIOps by Motadata

AIOps

Motadata

ITSM & patch management

Deployed ITSM for the organisation.

beSOURCE

Source code scanning

Static source code analysis (SAST).

Picus Security

Breach & attack simulation (BAS)

Breach and attack simulation to test security controls.

Codebashing

Secure coding training

OX Security

SCA

Software composition analysis (SCA) of third-party dependencies.

HCL AppScan 360

SAST & SCA

Integrated into Jenkins CI/CD for automated shift-left testing.

Google Cloud

Cloud

Deployment on Google Cloud.

Microsoft Azure

Cloud

Deployment on Azure.

AWS

Cloud

Provisioned from scratch: EC2, VPC, IAM, S3, Route 53, Security Groups, CloudWatch.

Burp Suite Pro

Web testing

Acunetix

Web scanner

Nipper

Firewall audit

Protectt.ai

Mobile app protection

Deployed on the Rail One Super App for Indian Railways.

Appknox

Mobile app security

Mobile app security testing on 60 mobile apps, Android and iOS.

Open source

Zabbix

Server monitoring

Wazuh

SIEM / XDR

Deployed and managed across 1,200+ endpoints.

Squid Proxy

Proxy

Jenkins

CI/CD

Pipeline design for automated security testing.

Grafana

Dashboards

Monitoring dashboards for applications, endpoints and infrastructure.

Prometheus

Monitoring

Docker

Containers

OWASP ZAP

Web testing

Metasploit

Exploitation

Nmap

Network scanning

Wireshark

Packet analysis

Frida

Mobile instrumentation

MobSF

Mobile app security

Research & Conference

Awards

Internship openings

Vacancies on real CRIS projects. Work on live applications alongside the team in one of these tracks.

Development / AI & ML

Build and improve real applications used within CRIS projects, from full stack features to ML-assisted tooling.

Apply by email →

GRC

Governance, risk and compliance work: automation, policy mapping and risk assessment on live programmes.

Apply by email →

Mobile App Security

Android and iOS application security testing on real applications: static and dynamic analysis, reporting.

Apply by email →

Web Security / Network Security

Web, API and network vulnerability assessment on real applications and infrastructure, against OWASP Top 10, with remediation guidance.

Apply by email →

LLM Deployment & Fine-tuning

Deploy and fine-tune large language models for real use cases, including RAG-style tools that speed up everyday work.

Apply by email →

Contact

General

mushahid@mbhat.in

Centre for Railway Information Systems (CRIS)

bhat.mushahid@cris.org.in

IIT Delhi

csz258525@cse.iitd.ac.in

LinkedIn

linkedin.com/in/mushahid-bhat-7872621b8
Send a messageBook a callCertificate CourseLab access