DevSecOpsAppSecCI/CD
Why Shifting Security Left Actually Fails (and how to fix it)
Most 'shift-left' programmes add tools to CI/CD and call it done. Here's why that's not enough, and what a real security-integrated pipeline looks like.
4 min read
Senior AVP — Information Security Group · EXL · Noida, India
Animesh
Shaw
I secure software that the world depends on — embedding AppSec, AI Security, and DevSecOps into the DNA of engineering.
10+
Years in AppSec & Cloud Security
35%
Avg. Vulnerability Reduction Delivered
4×
Enterprise Security Programs Led
70+
Bug Bounty Reports Triaged Annually
500+
Students Trained/Mentored
Expertise
Where I operate
Application Security
SAST, DAST, threat modelling, and secure code review woven into engineering delivery — not bolted on after.
AI Security & Governance
Securing Agentic AI architectures, researching LLM vulnerabilities, and building frameworks for Responsible AI and governance.
Quantum Security
Researching Post-Quantum Cryptography (PQC) integration paths and building tools to manage the impending cryptographic transition.
DevSecOps
Security gates that developers trust. Pipeline-native controls that ship faster, not slower.
Security Leadership
Building security-first cultures at Atlassian, VMware, Citrix, and EXL — from onboarding to board-level risk reporting.
Writing
Ideas worth reading
Work with me
Building secure products?
Let's talk.
I mentor security engineers, consult on DevSecOps strategy, and advise on AI security programmes. Book time directly.