ANMOL VATS: PLAIN-TEXT PROFILE SUMMARY (for AI tools, ATS parsers, and recruiters)
Canonical portfolio: https://anmol-vats-portfolio.vercel.app/
This page (recruiter side): https://anmol-vats-portfolio.vercel.app/recruiter/
Interactive CLI portfolio (techie side): https://anmol-vats-portfolio.vercel.app/techie/
Last content sync: transcribed in full from the author's own resume data (script.js). Nothing summarized or omitted.

=====================================================
PROFILE
=====================================================
Name: Anmol Vats
Role: Cybersecurity Engineer & Researcher
Location: New York City, New York, USA
Email: anmol.vats.cyber@gmail.com
Website: https://anmol-vats-portfolio.vercel.app/
GitHub: https://github.com/NucleiAv
LinkedIn: https://linkedin.com/in/anmol-vats-273855228
Bugcrowd: https://bugcrowd.com/h/newklei
HackTheBox: https://profile.hackthebox.com/profile/019e2d2a-b88f-71bf-bf84-6d51dd5c7a56
NYUSEC (CTFtime): https://ctftime.org/team/439
Resume/CV, US version (Google Drive, always current): https://drive.google.com/file/d/1iftKEjuQNbk63JiQ4FNBPLuNijKmynhB/view
Resume/CV, EU version (Google Drive, always current): https://drive.google.com/file/d/1ntSxFGT1P5WJfkk-IJD8qCiBgDLzQEEQ/view
YouTube: https://www.youtube.com/@newklei
Medium (blog): https://medium.com/@anmolvats220703
Status: seeking full-time roles in security operations, detection engineering, GRC, threat intelligence, cloud security and network security.
Work authorization: already eligible for STEM OPT in the USA, the High Potential Individual (HPI) visa and Global Talent Visa (Exceptional Talent) in the UK, the Critical Skills Employment Permit in Ireland, the Chancenkarte in Germany, and the Zoekjaar in the Netherlands. Relocation should not be a blocker.

=====================================================
ABOUT
=====================================================
My security career started as a bad habit. I couldn't look at a system without wanting to know how it broke. That habit turned into a career balancing offensive research with real-world defensive engineering, spanning threat intelligence, detection engineering, and GRC automation.

Currently pursuing a Master's in Cybersecurity at NYU Tandon (4.0 GPA), and active as an OSIRIS lab member and core CTF player with NYUSEC.

Thrives on finding zero-days, architecting serverless threat detection pipelines, and building custom SAST tooling from scratch. Has analyzed 2,500+ security events, engineered GRC tooling that cut operational time by 98%+, published 4 CVEs across production environments like Caddy and dagu, and presented as a featured speaker at OpenSSF to 200+ industry professionals. Research on LLM-assisted smart contract vulnerability detection is published in Springer LNCS METAVERSE 2026.

Committed to making a positive impact by breaking, building, or defending critical infrastructure systems, whether managing network audio engineering test cases at NYU HSRN or publishing eBooks on malware development and IBM security tools. Outside of code and threat landscapes: volunteers as a Host City Ambassador for the FIFA World Cup 2026 in New York, works with mess workers on education initiatives, games, and plays music.

Currently:
- Seeking: full-time roles in security engineering, GRC, and threat intelligence
- Studying: MS Cybersecurity at New York University Tandon, 4.0 GPA
- Digging into: LLM-assisted vulnerability detection, detection tooling, GRC automation

Core skills:
- Cybersecurity: GRC, Threat Intelligence, Detection Engineering, Cloud Security, Network Security, AI Security
- Tools & Platforms: Wireshark, QRadar, Suricata, Snort, Zeek, Wazuh, Splunk, AWS, Wiz, YARA, Sigma, Docker, Kubernetes, Git
- Languages: Python, Bash, C/C++, JavaScript, C#, Solidity, PowerShell, SQL
- Frameworks: MITRE ATT&CK, OWASP, FAIR, STIX 2.1, Flask, Django, Bootstrap
- Certifications: CompTIA Security+, ISO27001, PEH, CNSP, MITRE ATT&CK Defender, IBM CTI

=====================================================
EDUCATION
=====================================================
- MS, Cybersecurity: New York University, Tandon School of Engineering, Brooklyn, NY. 2025-2027. GPA 4.00/4.00.
- BTech, Computer Science: The LNM Institute of Information Technology, Jaipur, India. 2021-2025. GPA 3.16/4.00.
- Class XII: Urmi School. 2019-2021. 95.4%.
- Class X: DPS Vadodara. 2014-2019. 95.6%.
- Ann Mary School, Dehradun. 2006-2014.

Graduate clubs/labs (NYU, active member/mentor): HSRN, OSIRIS, Cybersecurity Club, Gaming Club.
Undergraduate clubs (LNMIIT, active member/mentor): CIPHER (Cybersecurity), GDSC (Web Development), TPC (Training and Placement Cell), NSS (National Service Scheme), Sankalp (MWEP, taught mess workers).

=====================================================
WORK EXPERIENCE
=====================================================
1) Community Ambassador & Contributor, Wazuh. Jun 2026 - Present.
   - Validated Wazuh v5.0 beta2, reverse-engineered JSON-compiled decoder schemas and breaking API changes, modernized 18 integrations (AWS, GitHub, FortiGate, CrowdStrike, etc.) for beta2/beta4.
   - Developed and open-sourced a Caddy web server detection integration for Wazuh v4.14.6/v5.0.0 beta with Suricata/Snort/Zeek integrations.

2) Threat Research, GRC Engineer, Safe Security. May 2023 - Jul 2025 (cybersecurity intern May 2023-Jan 2025, then full-time).
   Received a full-time offer with a highly competitive package but could not accept due to starting MS at NYU. Received a strong LoR from the Director of Risk and Security (https://drive.google.com/file/d/1yxRDvCOq0jveMF8GOxbmn-fXuelqhq7w/view).
   - Engineered GRC automation tooling cutting operational time from 5 weeks to 15 hours (>98% reduction) for Access Recon/Access Check.
   - Reviewed vendor security posture (SOC 2, ISO 27001, CAIQ, SIG, NIST 800-53), informing risk tiering.
   - Spearheaded AI integration for TPRM, boosting AI vendor response accuracy from 0% to 95%.
   - Co-led "TPRM Reimagine" with Directors and the CISO.
   - Executed Q2-2025 company-wide Access Reconciliation for all 3rd-party vendors; automated SSPM controls.
   - Co-deployed/co-maintained a multi-node Wazuh XDR/SIEM on AWS EC2.
   - Built/repaired data ingestion scripts for Halcyon AI, Wiz, JPCERT, CSIRT-IE.
   - Analyzed 2,500+ threat events, mapped IOCs/TTPs via MITRE ATT&CK (certified) and STIX 2.1.
   - Profiled 200+ threat actors (nation-state to hacktivist).
   - Co-designed the company's AI Policy (CISO-level initiative).
   - Documented RiskLens post-acquisition in half the allotted time.
   - Certifications earned on the job: ISO 27001:2022, MITRE ATT&CK.

3) Web Development Intern, LUSIP. Jun 2022 - Aug 2022, Jaipur, India.
   - Led a team of four in Front End Web Development (HTML, CSS).

=====================================================
PROJECTS (17)
=====================================================
1. caddy-detection-rules: Wazuh XDR/SIEM ruleset for Caddy web server, 29 MITRE ATT&CK-mapped rules across Suricata/Snort/Zeek, 26/26 validation pass rate. https://github.com/NucleiAv/caddy-detection-rules
2. Serverless Cloud Threat Detection and Alerting Framework: AWS Lambda/CloudTrail/CloudWatch/SNS pipeline detecting 4 threat categories with Slack alerting.
3. snipe: AI-augmented static analysis VSCode extension (Tree-sitter + LLM), sub-100ms latency. https://github.com/NucleiAv/snipe
4. i4cu, Deepfake Detection: multi-modal (visual/audio/metadata) forensic tool on Cloudflare Workers. https://github.com/NucleiAv/i4cu
5. AutoPauseMiddleware: C# tool auto-pausing games when Cheat Engine is focused. May 2025. https://github.com/NucleiAv/AutoPauseMiddleware
6. Indo-Dutch Cyber Security School 2024 Challenge: 1st place, simulated incident response. Oct-Nov 2024.
7. NetStar: Chrome extension for network performance/CDN analysis. Sept 2024. https://github.com/NucleiAv/NetStar
8. GETDNS: Chrome extension for DNS record queries. Sept 2024. https://github.com/NucleiAv/GETDNS
9. Real-Time System Algorithm Scheduler: C program for RM/DM/EDF schedulability. Sept 2024. https://github.com/NucleiAv/real_time_system_scheduler
10. Adaptive & Fair Resource Allocation Algorithm for Scalable Online Advertising: Python budget management. Aug 2024. https://github.com/NucleiAv/adaptive-ad-budget-allocatorv
11. Cyber Threat Intelligence: introductory eBook. Aug 2024. https://nuclei-av.gitbook.io/cyber-threat-intelligence
12. keylogger: Python keylogger for controlled-environment assessment. Jul 2024. https://github.com/NucleiAv/keylogger
13. Malware Development & Analysis: introductory eBook. Mar-Aug 2024. https://nuclei-av.gitbook.io/malware-handbook
14. Hostel Management and Complaint Registration: full-stack RBAC system. Sept-Nov 2023. https://hostel-management-frontend-plum.vercel.app/
15. Mario Kart: JS endless runner, featured on GitHub, won Sprig console. Jan 2023. https://github.com/NucleiAv/mario
16. FyreFli: Python obfuscation tool, 2nd place LNMHacks 5.0 Open Innovation ($1500 pool). Dec 2022-Feb 2023. https://github.com/DSUnderdogs/FyreFli
17. CCAF: OSINT resource aggregation research project. Aug-Oct 2022. https://sites.google.com/view/ccafcorp/home

=====================================================
RESEARCH & PUBLICATIONS (2)
=====================================================
1. "Securing Metaverse Blockchain Infrastructure: LLM-Assisted Vulnerability Detection on Solana and Algorand Smart Contracts": published, Springer LNCS METAVERSE 2026. DOI: https://doi.org/10.1007/978-3-032-36773-0_3. 24-contract benchmark, 216 LLM experiments (Zero-Shot/CoT/RAG) across GPT-4o, Claude Sonnet 4, Llama-3.3-70B.
2. "A Blockchain-based Privacy-Preserving Authentication for Secure Vehicular Communications": assisted on the technical side. Inter-Platoon Communication Protocol, RSU-less architecture, blockchain-based trust scoring for VANETs.

=====================================================
SECURITY CONTRIBUTIONS / VULNERABILITY DISCLOSURES (17 total, 4 CVEs)
=====================================================
1. CVE-2026-36045 (CVSS 8.8, P1): OS Command Injection in picoclaw (sipeed/picoclaw), via incomplete guardCommand() denylist. Jun 2026.
2. CVE-2026-36044 (CVSS 8.8, P1): OS Command Injection in @pensar/apex npm package. Jun 2026.
3. CVE-2026-31886 (CVSS 9.1, P1): Path Traversal via dagRunId in dagu inline DAG execution (dagu-org/dagu). Mar 2026. https://github.com/advisories/GHSA-m4q3-457p-hh2x
4. CVE-2026-30851 (CVSS 8.1, P1): Header Injection/Privilege Escalation in caddyserver/caddy reverseproxy (first CVE). Mar 2026. https://github.com/advisories/GHSA-7r4p-vjf4-gxv4. PR credit: https://github.com/caddyserver/caddy/pull/7545
5. (P2) Local File Exfiltration via MCP Tool Result MEDIA: directive injection, openclaw/openclaw. Feb 2026. https://github.com/openclaw/openclaw/security/advisories/GHSA-jjgj-cpp9-cvpv
6. (P2) Canvas Host missing security headers, enabling XSS/clickjacking, openclaw/openclaw. Feb 2026. https://github.com/openclaw/openclaw/security/advisories/GHSA-cjv3-m589-v3rx
7. (P2) XML Injection in trailofbits/skills ct_analyzer. Feb 2026. PR: https://github.com/trailofbits/skills/pull/106
8. (P3) Security control bypass in trailofbits/claude-code-config settings.json. Feb 2026. PR: https://github.com/trailofbits/claude-code-config/pull/33
9. (P3) SSRF detection bypass in trailofbits/fickling. Feb 2026. https://github.com/trailofbits/fickling/security/advisories/GHSA-83pf-v6qq-pwmr
10. (P1) Source Code Disclosure via direct file access, www.sgrdimsr.in. Jan 2026.
11. (P2) SQL Injection via vulnerable code pattern, www.sgrdimsr.in. Jan 2026.
12. (P1) Sensitive Personal Data Exposure, student PII disclosure (150+ students), www.sgrdimsr.in. Jan 2026.
13. (P1) Full Account Takeover via MailCatcher instances, State of Maryland VDP, *.md.gov. Jan 2026.
14. (P1) Publicly accessible MailCatcher instance exposing sensitive data, State of Maryland VDP, *.md.gov. Jan 2026.
15. (P5) CSRF: unauthorized shopping cart clearing via GET request, State of Maryland VDP, *.maryland.gov. Jan 2026.
16. (P5) Multiple account enumeration vulnerabilities, State of Maryland VDP, *.maryland.gov / *.md.gov. Jan 2026.
17. (P3) Account enumeration at login portal, *.sourcecode.com. Dec 2025.
Full technical write-ups: https://anmol-vats-portfolio.vercel.app/recruiter/security.html

=====================================================
ACHIEVEMENTS: CTFs & HACKATHONS (27+, since 2022)
=====================================================
DAWGCTF (Apr 2026, UMBC): rank 66/1100+, 9435 pts.
RITSEC CTF (Apr 2026, RIT): #1 US, 14th worldwide/600+, 4077 pts.
SNYK Fetch The Flag (Feb 2026): team rank 54/1600+, 2200 pts, solved 12.
Cyber Quests Winter 2025 (Dec 2025, US Cyber Challenge): alias "j3rry", rank 26 USA, score 94.67/100.
Bugcrowd Student Finale CTF 2025 (Nov 2025): team rank 17, 3250 pts, solved 6/10.
CrateCTF 2025 (Nov 2025, Swedish Defence Research Agency): team rank 27, 6952 pts, solved 23.
H7CTF 2025 (Oct 2025): team rank 45, 18000 pts, solved 13.
BSidesNYC CTF 2025 (Oct 2025): individual rank 12, 900 pts, solved 6/15.
Engima Xplore CTF 2025 (Oct 2025, IIIT Nagpur): team rank 60, 1050 pts.
SunshineCTF 2025 (Sept 2025, UNSW): team rank 57, 3019 pts, solved 33.
K17CTF 2025 (Sept 2025, UNSW): team rank 49, 2953 pts.
Nahamcon 2025 (May 2025): team rank 118, 4316 pts, solved 28/55 (51%). First CTF with NYUSEC.
IDCSS 2024 Challenge (Oct-Nov 2024): 1st place.
GAH 2024 (Aug 2024, DSCI): Top 100 nationally.
UTCTF 2024 (Mar 2024, UT Austin): team rank 374.
picoCTF 2024 (Mar 2024, CMU): team rank 215/7000+, solved 41/47.
HTB Cyber Apocalypse CTF (Mar 2024): team DsUnderdogs rank 1422/6000+ teams.
FetchTheFlag CTF (Nov 2023, SNYK): rank 273.
Apogee BITS Pilani CTF (Apr 2023): team d$Und34dog$s rank 31/412, 2441 pts, solved 17/30.
HTB Cyber Apocalypse CTF (Mar 2023): team DsUnderdogs rank 858, 6025/23125 pts, solved 21/74.
PLINTH's LNMHacks 5.0 (Jan 2023): built FyreFli, 2nd place Open Innovation ($1500 pool).
IIT Jodhpur's Prometeo 2023 CTF (Jan 2023): solved 5/6, AIR 9/110+.
MLH Global Hack Week (Jan 2023): 21 pts, top 9% globally.
Hack Club Sprig (Jan 2023): built Mario Kart game, won Sprig console.
TryHackMe Advent of Cyber 22: completed 30 tasks, overall rank 89445/2.05M+ (top 4%).
MLH Global Hack Week (Dec 2022): 10/13 challenges, top 12%.
Hacker101 CTF: cleared for private bug bounty invites.

=====================================================
CERTIFICATIONS (39 total)
=====================================================
Security & skill certifications (17): AWS Certified Solutions Architect - Associate (SAA-C03) (Amazon Web Services); CompTIA Security+ SY0-701 Plus Series (CompTIA); ISO27001 (Udemy); Certified Network Security Practitioner/CNSP (SecOps); IBM Malware Analysis (IBM); IBM Cyber Threat Intelligence (IBM); Practical Ethical Hacker (TCM Security); eBPF (Isovalent); Tetragon (Isovalent); Postman Student Expert (Postman); MAD, MITRE ATT&CK Defender (AttackIQ); Foundations of AI Security (AttackIQ); Mapping MITRE ATT&CK to CVE for Impact (AttackIQ); OSINT Uncovered; Antisyphon Blue Team Summit 2023; (ISC)2 Candidate; NSE 1 Fortinet Infosec Awareness.

Competition certificates (11): Bugcrowd Student Finale CTF 2025; Nahamcon 2025 (individual + team); HTB Cyber Apocalypse 2024; TryHackMe AOC 2022; CTF Participation Rank 9/110+ (Prometeo, IIT Jodhpur); Winner, Open Innovation CyberSec (LNMHacks); LNMHacks Participation; GAH 2024 (DSCI); HTB Cyber Apocalypse 2023; Apogee BITS Pilani; Hackathon Certificate (MesoHacks).

Work Ex/TA certificates (4): Threat Research, GRC Engineer (Safe Security); Cybersecurity Intern (Safe Security); TA, ISL Lab (LNMIIT); TA, PPS Lab (LNMIIT).

Misc. certificates (7): Volunteer, FIFA World Cup 2026 NYNJ; Volunteer, SPACE 2022 (LNMIIT); Community Service (Sankalp); Beginner Ethical Hacker (SimpliLearn); Introduction to Python (DataCamp); Introduction to Dark Web Anonymity and Cryptocurrency (EC-Council/Code-Red); Android Bug Bounty Hunting (EC-Council/Code-Red).

Full list with verification links: https://anmol-vats-portfolio.vercel.app/recruiter/certifications.html

=====================================================
POSITIONS HELD
=====================================================
- Course Assistant, Network Security (NYU CS-GY 6823, under Prof. Damon McCoy). Jan 2026-Present.
- Network Audio Engineer, HSRN (NYU IT High Speed Research Networks VIP). Jan 2026-Present.
- Vice President, CSC (Cyber Security Club, NYU, part of OSIRIS). Oct 2025-Present.
- Lab Member, OSIRIS (NYU) + NYUSEC CTF player. May 2025-Present.
- Cybersecurity Head, Cipher (LNMIIT): co-founded HacksCTF and team u3fi. Apr 2023-May 2024.
- Teaching Assistant, PPS Lab (LNMIIT, C/C++). Aug 2024-Dec 2024.
- Teaching Assistant, ISL Lab (LNMIIT, Bash/Python). Jan 2024-May 2024.

=====================================================
LETTERS OF RECOMMENDATION
=====================================================
- Mr. Akash Jain, Director Risk and Security, Safe Security.
- Dr. Jayaprakash Kar, Head of CSE Dept, LNMIIT.
- Dr. Vikas Bajpai, Assistant Professor, LNMIIT.
- Dr. Philip Miller, Ex-Professor LNMIIT & Director, Carnegie Mellon University (Software Engineering Institute).
(Links available at https://anmol-vats-portfolio.vercel.app/recruiter/lors.html)

=====================================================
CONFERENCES
=====================================================
- OpenSSF Community Days Korea 2025: Speaker, "Quantum-Proof Your Secrets."
- BSidesNYC (18 Oct 2025): represented NYU OSIRIS Lab, CTF rank 12/100+.
- IDCSS, Indo Dutch Cybersecurity School (14 Oct-4 Nov 2024): full scholarship.
- eBPF Summit 2024 (11 Sept 2024).
- MITRE ATT&CKcon 4.0 (24-25 Oct 2023).
- Antisyphon Blue Team Summit (23-25 Aug 2023).
- LNMHacks (Jan 2023-Present): organizer, OC/PR.
- SPACE 2022 (18-22 Dec 2022): volunteer ops.
- Workshop on Digital Forensics & Cyber Crime (3 Sept 2022).

=====================================================
CONTACT
=====================================================
Email: anmol.vats.cyber@gmail.com
LinkedIn: https://linkedin.com/in/anmol-vats-273855228
GitHub: https://github.com/NucleiAv
Bugcrowd: https://bugcrowd.com/h/newklei
HackTheBox: https://profile.hackthebox.com/profile/019e2d2a-b88f-71bf-bf84-6d51dd5c7a56
NYUSEC: https://ctftime.org/team/439
Resume/CV PDF, US version: https://drive.google.com/file/d/1iftKEjuQNbk63JiQ4FNBPLuNijKmynhB/view
Resume/CV PDF, EU version: https://drive.google.com/file/d/1ntSxFGT1P5WJfkk-IJD8qCiBgDLzQEEQ/view

END OF SUMMARY.