Based in Sydney, Australia
DevSecOps engineer, cybersecurity analyst, change control engineer, security automation.
I build and secure software end to end — CI/CD pipelines, containerised deployments, and the security testing that keeps them honest.
01 // identity
whoami --verbose
I'm a DevSecOps and cybersecurity engineer in Sydney. At NextGen I run change control and releases for 65+ customers across DEV, UAT and PROD. Alongside that I've worked the security side: SOC work and malware analysis at CyberXcel, and vulnerability assessment and penetration testing at HEAPS.ai.
cat mission.txt
I build and secure software end to end: CI/CD pipelines, containerised deployments, and the security testing that keeps them honest. Anything I'd otherwise do twice, I automate in Python or Bash.
cat offline.txt
Off the clock I'm building side projects, from Android apps to self-hosted tools, or playing Invoker in Dota 2. Three elements that mean little alone but combine into ten spells, which is how I think about security, automation and infrastructure.
Sarvesh Pandit
DevSecOps · Cybersecurity
02 // the loop
The loop I work in, from a commit landing to an alert firing. Delivery and security aren't separate jobs; each stage feeds the next.
Source control across GitHub and Bitbucket, with branching and review before anything builds.
Bamboo and Jenkins builds, with configs kept in step as requirements change.
Nessus scans and Burp Suite testing, with findings ranked by real risk.
Change-controlled deploys of code and database scripts through DEV, UAT and PROD.
Grafana dashboards that catch problems early. Downtime down 22%.
Splunk and Sentinel alerts, CrowdStrike and Defender EDR, worked through IR playbooks.
03 // field operations
NextGen · Sydney, Australia · Full-time
CyberXcel · Australia · Internship
HEAPS.ai · Hyderabad, India · Full-time
04 // operations
A command-line tool for triaging phishing emails. It parses .eml files for sender, recipient and subject metadata, pulls out attachments, and hashes them for malware lookups, so an analyst has the facts in seconds.
Connected Microsoft Sentinel to Log Analytics, wrote custom KQL detections, and automated a response that blocks IP addresses linked to threats.
An automated reconnaissance tool that maps subdomains, open ports and likely vulnerabilities in one run, built to speed up VAPT and bug bounty work.
Machine learning models that diagnose lung cancer, skin disease and heart disease from a single interface. The research was published in IJIRSET in 2020.
Enhanced the security of healthcare records by developing blockchain-based solutions, improving information security standards.
05 // arsenal
Tools I reach for and would happily be tested on.
Inflectra Hall of Fame
Reported a cross-site scripting vulnerability.
Tidepool Hall of Fame
Thanked by Tidepool's security team for finding a CSRF vulnerability.
Acknowledged for reporting clickjacking vulnerabilities.
Incident Handler
cPanel Professional (CPP)
Practical Ethical Hacking
Certified Ethical Hacker (CEH)
NSE 1 Certified Associate
Red Hat Linux Fundamentals & Advanced Server Configuration
Master's, Computer Science: Network & Information Security
Bachelor's, Computer Engineering
Diploma, Information Technology
06 // secure channel
Happy to talk DevSecOps, security operations, automation, or whatever you're building.