I’m Suvendu Dash, an offensive security engineer, penetration tester and bug bounty hunter from Dhenkanal, Odisha, working with clients in Bhubaneswar, across India and worldwide. Most recently I was Senior Principal Security Engineer at INDmoney, where I spent five years securing a fintech platform.
My mindset revolves around thinking big and challenging the current belief systems. I’m passionate about delving into cutting-edge technologies and have a keen interest in researching and identifying security loopholes within applications.
Over the course of my career, I’ve made a significant impact, reporting security issues to more than 30 companies worldwide, including Apple, Microsoft and OpenAI.
My expertise spans various industries, including banking, finance, trading, health care, e-commerce, and more. I've demonstrated my prowess in:
- Web Application Security
- Mobile Application Security (Android & iOS)
- API Security
- Network Security
- Cloud Security (AWS)
- Vulnerability Assessment & Penetration Testing
- DevSecOps
- Bug Bounty
I keep learning, because attackers do.
I work with companies that want a senior, hands-on tester rather than an automated scanner report. I cover web, API, mobile and cloud (AWS) security, and every engagement ends with clear findings, real exploitation paths and practical fixes your developers can act on.
My Services
I work as an independent security consultant, mostly with product companies that want a hands-on tester rather than an automated scan.
Security consulting: Advice on security architecture, priorities and process, drawing on five years of securing fintech products and work across banking, trading, healthcare and e-commerce.
Penetration testing: Manual testing of web applications, APIs, mobile apps, networks and AWS cloud environments.
Vulnerability assessment: A structured review of your systems for known weaknesses, with each finding prioritised by real risk.
Secure code review and DevSecOps: Finding flaws in source code and building security checks into your CI/CD pipeline.
Training: Bug bounty and web security training for individuals and teams.
Bug bounty hunting: I have reported vulnerabilities to more than 30 companies, including Apple, Microsoft and OpenAI, through HackerOne, Bugcrowd, YesWeHack and private programs.
What you can expect
Clear communication, testing only within the scope you approve, and a report that explains what I found, how it can be exploited, how serious it is and how to fix it. Whether you are a startup or a large company, the standard is the same.
Get in touch
Want to know how secure your product really is? Contact me to discuss your project.