Offensive Security * AI Red-Team * Security Engineering
Anjan Kunduru Breaking systems to make them defensible.
Security engineer at the rare intersection of hands-on offense and applied machine learning -- full-scope pentesting, red-team tooling, and AI/LLM red-teaming.
M.Eng Cybersecurity, University of Maryland. I turn security work into code so finding and fixing vulnerabilities scales instead of depending on one specialist by hand.
Austin, TX * open to relocationWork-authorized (F-1 OPT)Available immediately
// about
Offense that scales, backed by ML depth
I work across the full offensive-security lifecycle -- reconnaissance, web/API/network/cloud exploitation, privilege escalation, lateral movement, and post-exploitation -- and I write the Python and Bash automation that makes that repeatable. On top of classic offense I have genuine AI/ML-security depth: adversarial ML, ML-pipeline attacks, and LLM attack-surface analysis, plus a 97%-accuracy anomaly-detection pipeline built from scratch.
Before graduate school I owned information security end to end for an LPG distributor protecting the data of roughly 30,000 customers -- hardening endpoints and networks, and detecting, investigating, and remediating real incidents. I own problems from first recon to prioritized, CVSS-scored remediation, and I translate findings into fixes engineers can actually ship.
PythonBashCRustGoJavaSQLJavaScriptOWASP * PTESMITRE ATT&CKNIST * ISO 27001 * SOC 2
// credentials
Education & certifications
M.Eng, Cybersecurity
University of Maryland, College Park * Jan 2024 - Dec 2025
B.Tech, Electronics & Communication Eng.
Sreenidhi Institute of Science & Technology * 2019 - 2023
Google Cybersecurity Professional Certificate
Google
Cisco CCNA: Introduction to Networks
Cisco
Cisco Python Certification
Cisco
Palo Alto Networks Cybersecurity
Virtual internship
AWS Cloud Virtual Internship
AWS
AWS AI/ML Virtual Internship
AWS
// selected work
Featured projects
Shipped security tooling plus hands-on red-team, ML-detection, and forensics work. The open-source tools below are public on GitHub with tests and CI; the rest each shipped an artifact -- a report, a pipeline, or a recovered payload.
// security engineering
Six tools built to close a specific gap rather than to demo a technique. Each is public, tested, and reports what it cannot do as plainly as what it can.
ascent
PythonAWS IAMDetection engineeringMITRE ATT&CK
ProblemCloud scanners list IAM misconfigurations one at a time. None of them prove which findings chain into account compromise, and none hand the defender anything to detect the chain with.
SolutionModel the account as a graph, prove escalation paths against six attack tactics, then emit the paired detection for every proven chain: a Sigma correlation rule and an Athena SQL query over CloudTrail.
Every graph edge carries the policy statement that justified it, so a finding explains itself hop by hop. The tactic files hold the offensive preconditions and the defensive CloudTrail sequence in one place, which makes it structurally impossible to add an attack path without its detection. Validation runs the emitted rules against a synthetic CloudTrail corpus and reports which fire on the attack sequence and which stay quiet on a benign baseline.
ProblemMost detection work in a portfolio is a folder of finished rules. A rule that was never run against benign traffic is a claim, not a detection, and nothing shows whether the author can tune one.
SolutionAuthor a Sigma rule per ATT&CK technique by hand, keep the tuning log showing what each first version missed or over-matched, and ship a harness that runs the rules against a labelled corpus so coverage is testable.
The result deliberately is not a clean sweep. Ten rules fire on benign telemetry and each waiver is argued in writing rather than hidden: one rule ships noisy because installers and an operator packaging a payload use the same binaries to write the same registry key, and the honest fix is a fleet baseline, which is environment data rather than rule logic. The telemetry corpus is synthetic and labelled as such throughout.
644 tests · 18 rules over 12 techniques · 22 scenarios, 847 records
Problem“I reproduced a CVE” usually means a crash was observed. It rarely shows why the bug existed, what the patch changed, or whether the crash is even the CVE in question.
SolutionTake three patched memory-corruption CVEs in C parsing libraries from the vendor patch diff to root cause to an ASAN-demonstrated primitive, in containers with the toolchain and mitigations pinned and justified.
Each chapter runs the identical trigger against the vulnerable and the patched tree, so the writeup shows a heap overflow on one and a clean error on the other. That differential is what separates “something crashed” from “this CVE reproduced”. A fourth chapter documents a 9.8 CRITICAL that was measured and cut: the write never escapes its own allocation, so ASAN stays silent and UBSan catches it, which makes it a lesson in triage rather than a demonstration of impact.
229 tests · 12 reproductions, all exit 0 · 3 CVEs + 1 measured and cut
ProblemAn AI agent treats every MCP server as trusted. A poisoned tool description, or a tool definition that quietly changes after you approved it, reaches the model with nothing in the way.
SolutionA transparent stdio proxy that enforces policy-as-code at the JSON-RPC layer, pins every tool definition on first sight to catch rug pulls, and ships alongside a deliberately vulnerable MCP testbed that measures whether the gate actually holds.
The testbed is the other half of the point: the attacks were built to succeed first, then blocked, so the numbers mean something. Measured across seven scenarios, an unguarded agent meets 7 of 7 attacker objectives; behind the gateway that drops to 2 of 7 while all 6 legitimate user tasks still complete. A deny-everything policy blocks all seven attacks and completes none of the tasks, which is why both axes are reported.
ProblemLLM security tooling tests prompts. Almost nothing tests whether the detection model survives obfuscation, and evasion results are usually published as a single percentage with no baseline and no variance.
SolutionGenerate adversarial variants that provably still belong to their label class, then measure detection before and after with paired bootstrap confidence intervals and a sweep across decision thresholds.
The label-preservation check is the integrity hinge, and an adversarial review broke the first version of it: a payload commented out still counted as “present, in order”, which would have inflated the headline number. Fixing it moved the result and exposed a real false positive inside it. The threshold sweep reports that only 2 of 12 results hold across thresholds, and the 0.5 default is documented as never having been chosen at all.
ML supply chainStatic analysisCI gatingMITRE ATLAS
Problempicklescan and modelscan answer “is this file dangerous”. A CI pipeline needs a different question answered: should this model be allowed in, and what changed since the last time we pulled it?
SolutionStatic opcode analysis that never deserializes what it scans, a structural fingerprint that survives benign re-serialization but not added capability, and a diff between versions that catches a rug pull, with exit codes for a CI gate.
Severity keys on which callable the opcode stream actually reaches and whether it is invoked, not on which opcodes appear, because a benign torch checkpoint is full of REDUCE and GLOBAL. The never-deserialize rule is enforced by a test that greps the source tree and fails the suite if pickle.load, joblib.load or torch.load ever appear. Known gaps are named in the README rather than left for a reader to find.
578 tests · static analysis only, never deserializes · CI exit codes
A coherent IoT and firmware security toolkit, one tool per language, tracing the workflow from a raw image to a live device. Each is public, tested, and passing CI.
firmscan
RustFirmwareStatic analysis
Static security auditor for extracted firmware root filesystems. Flags insecure permissions, hardcoded secrets, telnet and weak SSH config, outdated components, and embedded keys, sorted by severity with JSON output for CI gating. Tuned against a real OpenWrt image to cut false positives.
Sliding-window Shannon entropy scanner. Locates encrypted or compressed regions and embedded keys inside a binary by byte offset, with a terminal sparkline. Dependency-free C11 built on a rolling-window histogram.
MQTT broker security probe. Checks for anonymous access, plaintext transport, wildcard and $SYS topic exposure, and retained-message leakage, then reports findings by severity with a JSON mode. Verified end to end against live mosquitto brokers.
IoT device discovery and fingerprinting over SSDP, mDNS, and banner grabbing, mapping responses to device types. Table and JSON output; the parsers are covered by unit tests.
Led a 3-person red team from recon and OSINT through post-exploitation across a simulated enterprise (Windows, Ubuntu, AWS). Exploited services, dumped and cracked credentials, escalated privileges, moved laterally to domain admin, and exfiltrated data from a misconfigured S3 bucket.
Engineered an automated detection pipeline (Isolation Forest + LSTM Autoencoder) over user-activity logs on the CERT Insider Threat dataset, with no labeled attack data. Proposed SHAP explainability and federated-learning privacy mitigations.
97% detection accuracy, unsupervised
Digital Forensics & IR Investigation
WiresharkCyberChefVolatilityVeraCrypt
Reconstructed a full attack timeline: captured live C2 HTTP traffic, decoded a Base64 encryption key, and used a file-signature mismatch to uncover a VeraCrypt container disguised as an .mp3 -- then decrypted it to recover the payload.
Scored 30/30
Malware Binary-Diffing Engine
Assembly n-gramsMurmurHash3Protobuf
Built a malware-similarity engine using assembly n-grams, MurmurHash3 feature hashing, and Jaccard similarity over Protobuf-parsed disassembly to cluster and classify related binaries.
Assembly-level family classification
Binary Exploitation Toolkit
GDBx86/ARM asmROP
Developed exploits across buffer overflow, format-string, and ROP-chain classes with custom shellcode, and hardened the same targets with SELinux -- practicing both sides of memory-corruption defense.
Exploit dev + hardening, end to end
Network IDS via Clustering
Approximate Agglomerative ClusteringPCA
Applied approximate agglomerative clustering with PCA dimensionality reduction to the KDD Cup network dataset to surface anomalous traffic clusters for intrusion detection.
20 anomalous clusters isolated
// timeline
Experience
Mar 2026 - present
Security Engineer
Sports Excitement * Remote
Assess applications and APIs for OWASP Top 10, authN/authZ, and insecure-crypto flaws via testing and source-code review; partner with engineers to fix issues directly.
Write Python and Bash automation for vulnerability discovery, replacing manual review with repeatable, scalable checks.
Integrate SAST, DAST, SIEM, and dependency scanning into a SOC 2 / ISO 27001-aligned workflow; triage SIEM alerts and logs.
Support threat modeling and risk assessments for new features and third-party software.
2021 - 2023
Security Analyst
Tapojwalan Gas Agencies (HP Gas authorized distributor) * Karimnagar, India
Owned information and IT security org-wide for a distributor serving ~30,000 customers -- protecting endpoints, networks, and large volumes of sensitive customer PII through access controls and hardening.
Implemented preventive and detective controls; detected, investigated, and remediated multiple security incidents.
Served as primary security point of contact, advising staff on safe data handling and phishing awareness.
Jan 2024 - Dec 2025
M.Eng, Cybersecurity
University of Maryland, College Park
Coursework: Penetration Testing, Network Security, Secure Operating Systems, Cloud Security, ML for Cybersecurity, Digital Forensics & IR, Information Assurance.
// hack the box
Machines & writeups
Writeup public (retired)Solved * writeup locked (active)
🔒 Responsible-disclosure policy. Hack The Box permits public solutions for retired content only. Active machines below show that I solved them -- full writeups stay private until each machine retires, in line with HTB rules. No flags, commands, or exploit chains are published for active content.