Head of Security Engineering @ Zepto
Review Board Member, OWASP AppSec Days Singapore and BSides Vizag
I joined Zepto as the first security hire with a blank slate and a mandate: build it. No team, no program, no playbook. Three roles and 2.5 years later, I lead the full cybersecurity function across AppSec, Cloud Security, Infrastructure Security, and Incident Response across 250+ microservices and 3M+ daily orders, as Zepto moves toward the public markets.
I am a builder first. I architect and ship alongside the teams I lead.
Optimus — Zepto's internal AI-native security platform. Multi-agent system built on Claude tool-use APIs and Bedrock embeddings. Covers SAST, SCA, secrets scanning, IaC, SBOM-powered zero-day detection, AI-assisted threat modeling (STRIDE-DP), auto-fix PRs, WAF explorer, data classification, API inventory, and natural-language querying over security data. Replaces $1M+ in commercial tooling annually.
Supply chain security — Real-time SBOM graph across 250+ microservices with sub-15-minute MTTD on newly disclosed CVEs. Responded to Axios, Trivy/TeamPCP, LiteLLM PyPI poisoning, and TanStack worm incidents.
Agentic system security — MCP audit tooling to discover unauthorized MCP servers across engineering. Security rules embedded into Cursor, Claude Code, and Copilot org-wide. Internal policy on AI agent access and zero-data-leakage requirements.
Cloud security — Unified CSPM across AWS via Wiz, PingSafe, and Prisma Cloud. IAM human user cleanup from 600+ to zero in production. SCP rollout. SentinelOne CNAPP onboarding.
Security Analyst, Spice Money (2017) Secured UMANG — Government of India's unified citizen services platform — solo, as first security hire.
Security Engineer / Senior Security Engineer, Spice Money (2018-2021) Built security from zero across RBI, UIDAI, PCI DSS regulated fintech: PPI, B2B lending, AePS, BBPS, UPI.
Senior Security Engineer, Boutiqaat (2021-2022) First international role. Secured one of MENA's largest influencer-driven e-commerce platforms ($500M+ valuation) across cloud, WAF, and DevSecOps.
Senior / Lead Security Engineer, Slice (2022-2024) Founding security engineer. Built program from zero across UPI payments, PPI wallet, and B2C lending under RBI and PCI DSS oversight.
Lead Security Engineer / Engineering Manager / Head of Security Engineering, Zepto (2024-Present) First security hire. Built team, program, and Optimus. Now leading the full cybersecurity function at IPO-track quick commerce scale.
Review Board Member, OWASP AppSec Days Singapore Review Board Member, BSides Vizag
eWPTXv2 | eCPPT | ITIL 4 Foundation
LinkedIn | X / Twitter | emgaurav.github.io
Security is not a product, it is a program. You build it, you earn it, and you never stop.