Skip to content

Open to application security roles

Application securityComplianceSecure development

Hi, I'm Samir Alam.

I assess application risk, engineer the controls that reduce it, and automate the testing that proves they work.

Application security and compliance engineer at Shell. I assess enterprise applications, test the controls that protect them and work with developers to close what I find. CEH v12 certified, and I build full-stack applications myself.

View my work Let's connect
LinkedIn GitHub samiramrullah@gmail.com Bengaluru, India
example-finding.diffHIGH
// Hard-coded credential in source code- const apiKey = "sk_live_9f2a71c4";+ const apiKey = process.env.API_KEY;
Fixed Retested Evidence logged
3+ years
Security assurance and AppSec at Shell
30%
Faster audit closure through automation
CEH v12
Certified Ethical Hacker, EC-Council
OWASP Top 10
Remediated with development teams
Samir Alam working on a laptop

About

I see the risk, and the code behind it.

Three years in security and risk assurance at Shell, and a developer before that.

More about me

Projects

Explore all
Delivered

Compliance Gate

EU AI Act compliance checker

EU AI ActAI governanceWeb application
Delivered

Domz.com

A domain name marketplace

Next.jsMarketplaceWeb application
Delivered

TUSA

An online store for car accessories

ShopifyE-commerce

Skills

  • Application security
  • Security and risk
  • Cloud security (AWS)
  • Frameworks and standards
  • Programming
  • Databases and data
All skills

Experience

  1. IDT Assurance Analyst

    Shell, Feb 2025 – Present

  2. Security & Compliance Analyst

    Shell, Aug 2023 – Jan 2025

  3. Software Security Intern

    Futurescape Technology, Jan 2022 – Jul 2022

Full journey

Contact

Get in touch

Hiring for application security, or want to talk through a finding? I usually reply within 24 to 48 hours.

Get in touch

What I do

Security work that ends in a fix

From the first risk review to the evidence that proves the issue is closed.

Control design and testing

I design the controls that bring a risk down, then test that they work in practice and not just on paper.

Control designControl testingAudit-ready evidence

Sample control review5 controls

  • AuthenticationEffective
  • AuthorizationEffective
  • Data protectionGap found
  • Input validationEffective
  • Logging and monitoringRetest

Risk assessment

I work out what could go wrong with an application, how likely it is and what it would cost, so the biggest risks are fixed first.

ThreatsLikelihoodImpact

Prioritised remediation

CriticalHighMediumLow

Secure development

I build full-stack applications myself, so I can discuss a fix in the developer's own terms.

ReactNode.jsPythonTypeScriptREST APIs

AI security

Assurance reviews of AI applications against the EU AI Act, and security testing of an AI assistant I am building: prompt injection, data leaks and agents with too much access.

EU AI ActLLM securityThreat modelling

Cloud security on AWS

Identity, compute and storage, reviewed and deployed with security in mind.

AWS IAMEC2S3TLS/SSL

How I work

From first review to closed finding

  1. Assess

    Understand the application, its data and where the real risk sits.

  2. Test

    Read SAST, DAST and pen test results, then test the controls behind them.

  3. Fix

    Work with developers to remediate, from OWASP Top 10 issues to access control.

  4. Evidence

    Track findings to closure and produce audit-ready proof with SQL and Power BI.

Security playbook

How I explain common risks

Six common application risks, each in three layers: how it happens, what it costs and how to fix it.

Broken access control

How it happens
A user changes an ID in a request and reads someone else's record, because the server never checks who owns it.
Impact
Data exposed across accounts, or actions taken with another user's rights.
Fix
Check ownership and role on the server for every request. Deny by default.

SQL injection

How it happens
User input is joined straight into a query, so the input is run as part of the SQL.
Impact
An attacker can read, change or delete what is in the database.
Fix
Parameterised queries, input validation and a least-privilege database account.

Cross-site scripting (XSS)

How it happens
The app puts user input into a page without encoding it, so a script runs in another user's browser.
Impact
Stolen sessions and actions performed as the victim.
Fix
Encode output for its context, add a Content Security Policy and use HttpOnly cookies.

Hard-coded secrets

How it happens
API keys or passwords are committed to source code, where anyone with repository access can read them.
Impact
Direct access to whatever system the secret protects.
Fix
Environment variables or a secrets manager, secret scanning in CI, and rotation of anything exposed.

Security misconfiguration

How it happens
Default credentials, open storage buckets, verbose error pages or missing security headers.
Impact
Easy entry points and information that helps an attacker plan the next step.
Fix
Hardened baselines, reviewed infrastructure settings and regular configuration checks.

Vulnerable components

How it happens
An outdated library with a publicly known vulnerability ships inside the application.
Impact
Attackers reuse exploits that are already published.
Fix
Dependency scanning, an inventory of components and a routine for patching.

AI security and governance

Securing and governing AI systems

AI applications bring new ways to be attacked and new rules to follow. I work on both: testing an AI system the way an attacker would, then showing it meets the frameworks a regulator or auditor will ask about.

See the full work
Delivered

Compliance Gate

A tool I built that tells a business what the EU AI Act requires of it, what to do to comply, and the one-time and ongoing cost.

Open the checker

Frameworks covered

  • OWASP Top 10 for LLM Applications
  • MITRE ATLAS
  • NIST AI RMF
  • ISO/IEC 42001
  • EU AI Act
  • GDPR and India's DPDP Act

In progress now

An enterprise AI assistant that I threat-model, red-team, secure and then assess against these frameworks.

Follow the build

Enterprise AI assistant: where I attack it

Built on made-up company data, so every result can be published.

  1. User prompt

    Prompt injection

  2. Login and roles

    Broken access control

  3. Document search (RAG)

    Poisoned or leaked documents

  4. Language model

    Sensitive data disclosure

  5. Agent and tools

    Excessive agency

  6. Logs and monitoring

    Undetected misuse

Frameworks and standards

The rulebooks I work with

OWASP Top 10
The reference list I use to classify and remediate web application risks.
Secure SDLC
Security checks built into each stage of development, not added at the end.
ISO 27001
Information security management and the controls I test against.
ISO 31000
Risk management principles behind risk-based assessments.
EU AI Act
Risk categorisation and assurance reviews for AI-enabled applications.
Privacy by design
Data protection from the first design decision, including data localisation.

Certifications and achievements

Proof, not just claims

All achievements

  • Certified Ethical Hacker

    CEH v12

    EC-Council

  • Security & Compliance

    Nanodegree

    Udacity

  • Special Mention Award

    STGI Hackathon, Panchkula

    Award
30%

Reduction in audit closure time, by automating security validation workflows.

  • Recognized for strong stakeholder engagement across engineering and security teams.
  • Identified and remediated critical security control gaps in enterprise applications.
  • Prioritized remediation of high-risk vulnerabilities from SAST, DAST and penetration testing.
  • Designed Power BI dashboards for leadership visibility into vulnerability trends.