Ker Xiang Teh

One of the largest privately held companies in the United States. Member of the AppSec team within Digital Security Architecture & Engineering.

• Owned the enterprise DAST program: scanner migration and evaluation, authenticated scanning for Okta-protected applications, and secrets handling for scan credentials via Vault.
• Built and operated core components of the application security program, including vulnerability management pipeline standards, scanning tool integrations, and guardrails that prevent entire classes of defects from recurring across web and cloud applications.
• Led the external, live-testing security review for the externalization of an API gateway, covering WAF bypass and fail-open testing, load testing, payload testing with Burp Suite, container image scanning with reachability verification, and TLS checks. Documented the findings and coordinated with other reviewers on source and IAM-focused reviews to close coverage gaps.
• Led a combined code review and live testing (UAT) security assessment of an internal data self-service portal, and documented findings and prioritized recommendations for the owning team.
• Led application security reviews and threat models for high-impact work across web, backend, and cloud systems, including an internal data platform and a customer-facing web application, documenting risk decisions with clear mitigation plans. Reviewed Python-based Lambda service code and explained remediation to the engineers who wrote it.
• Extended the RapidAST DAST framework with Garak to security-test an internal LLM application endpoint, and documented the implementation and results for the team.
• Responded to security incidents with rapid triage and remediation guidance, including malicious npm supply-chain campaigns, an authentication bypass in a GitLab MCP server (CVE-2026-61560) where Clutch was used to identify which users had the affected version installed, and zero-day threat hunting.
• Mentored new AppSec team members on tooling, scanning workflows, and security review practices, and remain their go-to resource for how-to questions.
• Engineered guardrails that scaled beyond the AppSec team: Terraform-managed scanning infrastructure with OIDC authentication and IAM permission boundaries, CI/CD pipeline security checks in GitLab, shared scanning templates with global tuning baselines, and secure-by-default patterns for AWS and GCP workloads.
• Built AI-augmented automation for security finding triage, prioritization with service context, and remediation guidance engineers could act on. Wrote the Python Lambda forwarders, parsers, and webhook receivers that normalized findings from multiple DAST and SCA tools into a centralized vulnerability management platform, and automated retests, drift cleanup, and alerting across AWS (Lambda, S3, CloudWatch) and GCP.
• Drove vulnerability management outcomes by triaging and prioritizing findings from DAST scanning, SAST and SCA (Semgrep), and penetration test results, then partnering with engineering teams to get fixes shipped and verified across services owned by other teams.
• Supported developer teams by resolving 400+ AppSec tickets and rotating on-call for Semgrep, Vault, certificates, DAST troubleshooting, and security platform onboarding, acting as a security champion embedded within engineering workflows and reducing friction in secure software delivery. Authored onboarding documentation, scanning implementation guides, and knowledge base articles that let teams self-serve.
• Improved cloud security posture by investigating and reducing false-positive volume in GCP findings, tightening IAM and RBAC controls, and restricting external GKE control-plane access with least-privilege policies.

• Mentored technicians and led technical issue resolution for enterprise clients in an MSP environment, analyzing server diagnostics and web application issues.

• Provided hardware and software support to remote users, exceeding weekly ticket closure targets by 20% through process improvements.

• Configured Cisco ASA firewalls, IDS/IPS, and NAS systems for enterprise clients. Automated backup processes and supported secure network operations including VPN and access control management.