Rajganesh Pandurangan
Security Architect · Author · 25+ Years in Cybersecurity
My career started in software development. Understanding how things are built made me better at finding where they fall apart. That perspective led me into offensive security, where I spent over 15 years leading penetration testing and red team engagements, finding and exploiting vulnerabilities across thousands of applications, infrastructure environments, and wireless networks. I've published exploits on Exploit-DB and built WAED, an open-source web attack and exploitation distro used by security professionals for training.
For 8 years, I worked as a Qualified Security Assessor (QSA), assessing hundreds of organizations for PCI DSS compliance across retail, finance, and healthcare. That experience gave me a deep understanding of how regulatory frameworks translate into real-world security controls, and where most organizations struggle to close the gap.
I then moved into presales and security strategy, helping position security products for enterprise customers and translating complex technical capabilities into business outcomes. That combination of hands-on technical depth and customer-facing experience shaped how I think about security architecture today.
Most recently, I spent 4+ years at AWS as a Security Specialist, working with some of the largest enterprises in the world on cloud security, identity architecture, and governance at scale. IAM, SCPs, Control Tower, Landing Zone Accelerator, Zero Trust, and everything in between.
Today, I'm focused on the next frontier: AI and agentic security. How do you secure AI agents that make decisions and take actions on behalf of users? How do you govern which models your organization can deploy? How does identity and authorization work when the "user" is an autonomous agent? These are the questions I'm researching and writing about. I write about security the way I wish someone had explained it to me: from first principles, no jargon, one concept building on the last.
Offensive Security
15+ years leading penetration testing and red team engagements. Secured thousands of applications, infrastructure, and wireless environments. Published exploits on Exploit-DB. Created WAED (Web Attacks and Exploitation Distro).
Compliance & Risk
8 years as a Qualified Security Assessor (QSA). Assessed hundreds of organizations for PCI DSS compliance across retail, finance, and healthcare. Deep understanding of regulatory frameworks and how to operationalize them.
Cloud Security
4+ years at AWS as a Security Specialist, helping top enterprises secure cloud migrations, design identity architectures, and implement governance at scale. IAM, SCPs, Control Tower, Landing Zone Accelerator.
AI & Agentic Security
Currently focused on securing AI agents, model governance, and the intersection of identity and AI. Researching agentic authorization, Cedar policies, and post-quantum cryptography.