Jan 2026—Present
Vice President, Red Team
MUFG · Singapore
Offensive security
Vivek Mahajan
Vice President, Red Team
I work with organizations to understand how attackers may move through their systems and translate those findings into practical security improvements. My work includes red teaming, application security, cloud, identity, AI security, and adversary-focused research.
Experience
12+ years in offensive security.
Hands-on technical work with practical context for engineering teams and leadership.
Jul 2019—Dec 2025
Principal Information Security Consultant
SEC Consult Singapore Pte. Ltd. · Singapore
- Led complex web, mobile, API, and cloud security assessments across fintech, government, trading, healthcare, and SaaS.
- Directed red team operations that mapped realistic attack paths and produced measurable posture improvements.
- Built custom Burp Suite extensions and assessment tooling to reduce repetitive work and deepen testing.
- Managed multi-project programs while translating technical risk into clear remediation priorities.
2017—2019
Senior Security Consultant
NotSoSecure · Claranet Cyber Security
- Performed exploit-driven web, mobile, and API security assessments.
- Led red team engagements covering intrusion chains, lateral movement, and control validation.
2014—2017
Senior Information Security Analyst
Network Intelligence · Mumbai
- Led social engineering programs and application security assessments for enterprise clients.
- Reviewed network architecture and segmentation controls to reduce practical attack surface.
Field notes
Recent lab writeups.
Walkthroughs covering attack paths, tooling choices, and lessons from controlled lab environments.
Logging
Logging is a single-host Windows AD machine that pivots from a low-priv user to a service account in Protected Users (Kerberos-only), through a shadow-credential attack on a gMSA, into a…
Silentium
Silentium is a Linux box that ladders an unauth Flowise password-reset-token leak into authenticated Flowise admin, then into pre-auth-feeling code-exec inside a Flowise Docker container…
Snapped
Snapped is a Hard Linux machine running Nginx on port 80 with two virtual hosts - a static marketing site on snapped.htb and an Nginx UI admin panel on admin.snapped.htb. The Nginx UI…
Expertise
Areas of practice.
Adversary simulation
Red team exercises focused on realistic attack paths, useful findings, and detection-aware testing.
Application security
Security testing across web, mobile, APIs, and complex authentication or business-logic boundaries.
Cloud and identity
Assessment of cloud control planes, identity systems, and hybrid enterprise environments.
Security research
Exploit validation, focused tooling, and technical documentation intended to remain useful after delivery.
Contact
Contact and collaboration.
Available for focused offensive security engagements, research, and consulting.