Hi, my name is
Shivam Saraswat.
I build things for the security.
I’m a security engineer (R&D) specialized in building exceptional security solutions. Currently, I’m focused on building dev-centric security products (using shift-left approach) at PayPal.
About Me
Hello! My name is Shivam. As a Security Engineer at PayPal, I engineer and implement innovative security solutions to protect the company’s web and API assets.
Accomplished DevSecOps and Cybersecurity professional with 3+ years of expertise in architecting enterprise-grade security solutions and driving cloud-native implementations. Demonstrated ability to build and optimize secure pipelines for large-scale environments, develop innovative in-house security tools, and implement cloud security best practices.
Proven track record of reducing security risks, streamlining compliance processes, and enhancing developer productivity through innovative tools and workflows.
Committed to bridging the gap between development and security teams to create resilient, scalable, and efficient systems.
Here are a few technologies I’ve been working with recently:
- SSDLC
- Application Security
- DevSecOps
- Cloud Security
- Security Automation (Python, Bash)
- Vulnerability Management
- Github Actions, GitLab CI/CD, Harness CI/CD
- Burp Suite, Nmap, Wireshark, Nuclei, Nessus
- MongoDB
- Docker, Kubernetes
- Google Cloud, AWS
- Swagger, Postman
Where I’ve Worked
Senior Product Security Engineer @ PayPal
April 2025 - Present
- Built an org-wide supply chain firewall that blocks malicious/vulnerable packages before they reach Artifactory.
- Deployed container security across 3,100+ CI/CD pipelines, improving vulnerability detection by 50%.
- Standardized container vulnerability policy enforcement to 100% compliance org-wide.
- Built a CVE/package/version deduplication system that cut alert fatigue and improved patch efficiency by 30%.
- Prototyped an AI-powered SCA system for reachability analysis, safe-version recommendations, and fix suggestions across Maven & npm.
- Detected and neutralized the Shai-Hulud self-replicating worm and similar supply chain attacks before credential theft or spread.
- Built an automated third-party vendor image scanning pipeline with a Slack AI bot for on-demand scans.
- Authored container security ADRs and guides that cut developer onboarding time by 40%.
Some Things I’ve Built
Featured Project
PYrevDNS
PYrevDNS is a simple tool for performing reverse DNS lookups on IP addresses. Available on PyPi and Docker Hub.
- Python
- DNS
- Docker
![PYrevDNS]()
Featured Project
Certify - SSL/TLS Certificate Security Analysis Tool
Certify is a powerful and easy-to-use tool designed to check the security of SSL/TLS certificates. Available on PyPi and Docker Hub.
- Python
- TLS
![Certify - SSL/TLS Certificate Security Analysis Tool]()
Featured Project
Refinements in Zeek IDS
Designed and implemented custom scripts for improving the logging capability of the Zeek IDS. Also, published a paper in the IEEE Conference on the topic – Refinements in Zeek Intrusion Detection System.
- Zeek
- IDS
![Refinements in Zeek IDS]()
Other Noteworthy Projects
view the archivePYrevDNS
PYrevDNS is a simple tool for performing reverse DNS lookups on IP addresses. This tool is useful for network administrators and security professionals to identify the domain names associated with IP addresses.
Certify - SSL/TLS Certificate Security Analysis Tool
Certify is a powerful and easy-to-use tool designed to check the security of SSL/TLS certificates.
PGrab
PGrab is a banner grabber tool used to gather information about a remote server or device, specifically the banner or header information that is sent when a connection is made.
crt.sh Domain Finder
It can retrieve all the domains and the subdomains associated with a domain using crt.sh. It can also be used in conjunction with other tools (such as httpX) to know the active domains.
WebXCrawler
WebXCrawler is a fast static crawler to crawl a website and get all the links. It is useful for web developers and security professionals to identify the links present on a website. It is built using Python and BeautifulSoup.
SSH Bruteforcer and Bruteforce Detector
It is a tool for brute-forcing the SSH service, allowing for testing and analysis of SSH security measures, and it also comes with option to detect brute-force attacks on the SSH service.
What’s Next?
Get In Touch
My inbox is always open. Whether you have a question or just want to say hi, I’ll try my best to get back to you!
Say Hello