Problem
Signature-based firewalls only catch known attacks.
Approach
Reverse-proxy with rule-based filtering + LightGBM model to catch novel SQLi, XSS, and OWASP Top 10 attacks.
🔍 Live Threat Assessment
I find what's broken
before someone else does.
B.Tech in Cybersecurity. Hands-on VAPT across web apps, Linux, and enterprise networks. I build full-stack apps — so I know where the vulnerabilities hide.
root@nandalal:~ $
➜Initializing security scan…
➜Target: Nandalal Patil (Cybersecurity Analyst)
➜
Burp SuiteNessusOWASP ZAPNmapWireshark
MetasploitKali LinuxAzureIriusRiskMS Threat Modeling Tool
ReactNode.jsPythonMongoDBDocker
Burp SuiteNessusOWASP ZAPNmapWireshark
MetasploitKali LinuxAzureIriusRiskMS Threat Modeling Tool
ReactNode.jsPythonMongoDBDocker
About
From fixing computers to breaking them on purpose.
I didn't start out chasing cybersecurity — I started out fixing other people's computers. Two years in IT support taught me how systems actually break in practice: bad configurations, weak passwords, forgotten patches, a user who clicks the wrong link. That ground-level view stuck with me.
From there I moved into full-stack development, building applications with the MERN stack, and started noticing how much of what I was learning in security classes showed up in the code I was writing — and in code I wasn't writing carefully enough.
That's what pulled me fully into security. I've since tested real web applications and networks for vulnerabilities, built STRIDE threat models for healthcare and IoT systems, and built WAFGuard, a web application firewall that pairs rule-based detection with a machine learning model — because I wanted to understand both sides of the fight.
I completed my internship at eInfochips (An Arrow Company) in August 2026, working across VAPT, threat modeling, and secure SDLC. I've since joined Knights Eye LLP as a Junior System Engineer, where I support systems administration and infrastructure security while continuing to build toward a full-time role in offensive security.
Experience
Seven roles, one direction.
Each step added a layer — infrastructure, then code, then how to break both on purpose.
Junior System Engineer — Knights Eye LLP
SEP 2026 — PRESENT · REMOTE
- Administering and hardening Windows/Linux systems and network infrastructure, applying secure-configuration and least-privilege principles learned through VAPT work.
- Monitoring systems for vulnerabilities and anomalies, and supporting patch management and access-control reviews.
- Bridging systems engineering with a security-first mindset — documenting configurations and flagging risks before they become incidents.
Cybersecurity Intern — eInfochips (An Arrow Company)
JAN 2026 — AUG 2026 · AHMEDABAD
- Tested 20+ web applications, Linux systems, and enterprise networks with Burp Suite, Nessus, Nmap, Wireshark, and Metasploit.
- Built STRIDE-based threat models for 5+ healthcare and IoT systems using Microsoft Threat Modeling Tool and IriusRisk.
- Folded threat modeling and security testing into Secure SDLC instead of bolting it on at the end.
Software Engineer Intern — Bluestock
MAY — JUN 2025 · REMOTE
- Built and shipped React.js features backed by Node.js and MongoDB.
- Worked across the stack — REST APIs, database logic, reusable components — which sharpened how I think about where application vulnerabilities actually originate.
Cybersecurity Intern — Hacktify
FEB — MAR 2025 · REMOTE
- Manually tested web applications for SQL injection, XSS, and authentication weaknesses.
- Ran network reconnaissance with Nmap to map attack surfaces ahead of deeper testing.
Technical Team Member — CyberSecurity Club, SCET
JUL 2024 — PRESENT · SURAT
- Ran workshops and hands-on sessions on ethical hacking and networking for other students.
- Organized security-awareness events for the college community.
Full-Stack Developer — Webstack Academy
JUL — AUG 2024 · BENGALURU
- Built end-to-end MERN applications, from database schema to UI.
IT Support Specialist — Proskill Engineering
JAN 2023 — MAY 2024 · VADODARA
- Configured and secured 20+ Windows/Linux workstations and resolved day-to-day infrastructure issues — the practical starting point for everything that came after.
Projects
Built to be attacked. On purpose.
Each one exists to answer a specific security question, not to fill a portfolio slot.
Problem
Real-time chat apps are prime targets for broken auth and injections.
Approach
JWT, MFA, encrypted communication, RBAC enforcing least privilege — hardened against OWASP Top 10.
Healthcare & IoT Threat Models
Problem
Connected medical devices expand the attack surface beyond IT security.
Approach
STRIDE-based models for 5+ systems using MS Threat Modeling Tool and IriusRisk.
Note
Internal engagement — details available on request.
Skills
Grouped by what they're for, not alphabetized.
Security
VAPTThreat Modeling (STRIDE)Secure SDLCRisk AssessmentOWASP Top 10Application Security
Networking
TCP/IPNetwork ReconFirewallsSegmentationWireshark
Cloud & Systems
Microsoft AzureLinux (RHEL SA1/SA2)Kali LinuxWindows
Tools
Burp SuiteNessusOWASP ZAPNmapMetasploitIriusRisk
Development
React.jsNode.jsExpress.jsMongoDBPythonJavaScriptSQL
Working Style
Analytical ThinkingClear DocumentationTime ManagementContinuous Learning
Certifications
Formal training behind the hands-on work.
Google Cybersecurity Professional Certificate
Completed
CompTIA Security+
Training completed
CompTIA Network+
Training completed
Certified Ethical Hacker (CEH)
In progress
RHEL Administration — SA1 & SA2
Completed
Contact
Let's talk about your team.
I'm currently a Junior System Engineer at Knights Eye LLP, and open to Cybersecurity Analyst, Security Engineer, Application Security Engineer, or VAPT Analyst roles. If your team is hiring, I'd like to hear about it.
Email
nandlal.patil2004@gmail.com
Phone
+91 70419 00392
LinkedIn
linkedin.com/in/nandalalpatil
GitHub
github.com/nandalalpatil
Location
Gujarat, India — open to relocation