Offensive instinct, turned into preventive design.
Break
I started in offensive security. A VAPT internship at HackersVilla Cybersecurity — live vulnerability assessments, penetration testing and network reconnaissance against real systems, with remediation reports engineering teams acted on. Alongside it, 175+ TryHackMe labs through privilege escalation, Active Directory and OWASP web exploitation, to the top 2% globally.
Understand
That work trains a specific instinct: not just where a vulnerability is, but why it matters and what it costs. Most people entering GRC or AI security arrive from compliance frameworks or machine learning. I arrived from watching systems actually fail.
Build
So I build the other side of it. Dharma treats compliance as an engineering problem — evidence mapped to controls by a local AI model that never sends data off-site, hash-chained so no record can be quietly edited. VaultIQ starts from the position that AI security is architecture, not filters: files are encrypted in the browser, and the model that scans them for AI-generated content is one I trained and measured at 98.3% accuracy.
You can't govern risk you've never actually seen exploited. I've seen it. Now I want to build the systems that prevent it.
Aug 2023
Started B.Tech, Computer Science (Cybersecurity)
Enrolled at Navrachana University, Vadodara — chose the cybersecurity specialization deliberately, not by default.
Mar 2024
VAPT Intern at HackersVilla Cybersecurity
Live vulnerability assessments, penetration testing, and network reconnaissance on real systems — writing remediation reports engineering teams acted on.
Three systems, built end to end.
Two turn offensive knowledge into preventive architecture. The third is the offensive work they came from.
Private repository — walkthrough available on request
Runs on local AI — sensitive data never leaves the org
Compliance that can prove no one tampered with the evidence.
Multi-container platform (Next.js, tRPC, PostgreSQL + pgvector, MinIO, Redis/BullMQ) that maps evidence to controls with a local Ollama model, so documents never touch a public AI API. Evidence is hash-chained — alter one record and the signature chain breaks — with multi-tenant workspaces and Stripe billing in development.
Encrypt documents in the browser, then catch AI-written submissions with 98% accuracy.
React 19 / Node / Python-FastAPI platform on AWS S3. Files are AES-256 encrypted in the browser with SHA-256 integrity checks; a hybrid detector — fine-tuned RoBERTa plus a calibrated logistic-regression model over 20 linguistic features — flags AI-generated text from GPT-4, Claude and Gemini, with Apache Spark running the analytics.
Offensive tooling — the practice behind the defensive work
The reconnaissance phase of a real engagement, scripted.
Python wrapping Nmap for TCP/UDP port discovery, with DNS resolution and traceroute mapping, exposed as quick and full scan modes that emit one consolidated report.
Not a list of tools. The offensive base is where I started; GRC and AI security are where it is going; the engineering underneath is what lets me build these systems rather than only test them.
Capability arc: offensive security is the base, and it feeds upward into two directions — GRC and AI security. All three stand on a substrate of software engineering and cloud infrastructure.
Where I started — VAPT & Offensive Security
Vulnerability Assessment & Penetration TestingLive engagements at HackersVilla Cybersecurity