Senior Security Engineer · Penetration Testing & VAPT · Protecting Critical National Infrastructure at NIC — MeitY, Govt. of India
Security professional with 5+ years breaking into systems — ethically. From enterprise VAPT engagements to now securing the digital backbone of India's e-governance infrastructure at NIC (MeitY), I stay one step ahead of attackers so critical systems stay protected.
I break into systems — so the bad guys can't.
I'm Vaibhav Sanwa — a cybersecurity professional who walked into this field driven by curiosity, stayed for the impact, and keeps pushing deeper every day. My academic roots lie in Computer Science at Guru Jambheshwar University, Hisar, where I learned to think in systems, question assumptions, and break things down to understand how they truly work.
I break into systems — so the bad guys can't. Over the past 5+ years, I've built my career at the intersection of offensive security and critical infrastructure protection — from uncovering vulnerabilities in enterprise applications to now securing the digital backbone of India's national government systems at the National Informatics Centre (NIC), MeitY.
I've conducted VAPT engagements across web, mobile, network, and API attack surfaces, delivered ISO 27001 compliance reviews, firewall audits, and security policy frameworks — and translated every technical finding into actionable intelligence for C-suite and senior leadership.
Active bug bounty hunter and CTF competitor — I think like an attacker because I am one (ethically). Every CVE I find, every pentest report I write, and every policy I harden is a door I'm closing before someone else opens it.
Full-spectrum offensive security — web to cloud to government infrastructure
End-to-end security integration within product development lifecycles.
Vulnerability assessment and penetration testing across web and API surfaces.
Active researcher on Bugcrowd, HackerOne, and independent programs.
Ethical reporting to global organizations with clear impact documentation.
Deep understanding of OWASP Top 10, authentication flaws, and injection vectors.
Identifying IDOR, broken access controls, and logic flaws in API architectures.
Offensive security methodology with a disciplined, research-driven approach.
Network analysis, packet inspection, and infrastructure assessment.
Custom tools, Burp extensions, and automated detection pipelines.
Threat detection, monitoring, and intelligence-driven security operations.
Template-driven vulnerability scanning and automated reconnaissance.
Industry-standard tooling for testing, exploitation, and traffic analysis.
Milestones that define the journey
5+ years across government, enterprise, and research
Open-source security tools built for the community — recon, exploitation, and automation. More dropping soon.
A free, structured learning path from absolute beginner to job-ready security professional — built from 5+ years of real-world experience.
Networking fundamentals, Linux basics, how the web works, HTTP/HTTPS, DNS, and your first security lab setup.
Start Learning →OWASP Top 10 deep dives, Burp Suite mastery, hands-on labs for XSS, SQLi, IDOR, SSRF, and API security testing.
Start Learning →Active Directory attacks, lateral movement, privilege escalation, cloud security, and full red team operation methodology.
Start Learning →300+ curated interview questions across Networking, Web AppSec, Linux, Cloud, and Behavioral — with detailed answers.
Start Preparing →Which certifications to get and in what order — CEH, eJPT, CRTP, OSCP and beyond. Includes study resources and tips.
View Roadmap →How to get started in bug bounty hunting — recon methodology, target selection, writing reports, and getting your first bounty.
Start Hunting →