Who is Kalyan? 🤔

My path into security started the way most do — with curiosity and a Linux ISO. In 2019, during 12th grade, I installed Kali Linux for the first time. I didn't fully understand what I was looking at, but I recognized the core challenge: to operate in this field you have to be part developer, part systems thinker, and part adversary. That framing stuck.

I spent the next few years learning systematically. C first — to understand memory layout, pointer arithmetic, and what 'the stack' actually is. Then Python for automation and scripting. Then web stacks, because web applications are where the majority of real-world attack surface lives. I earned the CEH v10 certification in 2021 and started participating in bug bounty programs on HackerOne, which gave me structured experience reporting real vulnerabilities against live targets.

By 2023 I was teaching at Caddnest — running workshops on ethical hacking, exploit development, and offensive tooling. Teaching forced me to consolidate everything I'd learned into something communicable and precise. That same year I completed my Bachelor of Computer Applications at REVA University, where my final-year project was Bounty Hawk: an automated reconnaissance and vulnerability-assessment framework built on Nuclei, integrated with CI/CD pipelines and Slack notifications.

In 2024 I did a Java Full-Stack Developer internship at Sonata Software, where I worked on enterprise-grade Spring Boot applications. It deepened my understanding of how production backend systems are structured — which directly informs how I assess them for vulnerabilities.

I enrolled in the M.S. in Cybersecurity program at Northeastern University in Spring 2025. The program is research-heavy and hands-on by design. Coursework has covered Security Risk Management, Network Security Practices, Medical Device Security, Database Security (Oracle VPD, Fine-Grained Auditing, DBMS_CRYPTO), and Critical Infrastructure Protection — including a graduate research paper on the Boston Metropolitan Electric Power Distribution Network using complex network analysis, fault tree analysis, and resilience modeling.

In early 2026, I served as Team Lead of Northeastern's NEU-1 (NeuSense) team in MITRE eCTF 2026. We built a bare-metal Hardware Security Module on the TI MSPM0L2228 (ARM Cortex-M0+) in C with no OS. The cryptographic stack used AES-CBC-256 via the AESADV hardware peripheral with DMA-driven crypto, HMAC-SHA256 authentication, and a three-tier HKDF key hierarchy: ROOT_SEED → DEVICE_SEED → ENC_SEED / SESSION_SEED. I also designed the PIN rate limiting logic, a fail-closed permission model, the secure flash filesystem, and replay-resistance via nonce-bound session keys. I audited the LaTeX Technical Design Document line by line against the codebase, resolved cryptographic discrepancies, and cleared all compiler warnings before submission.

In CY5150 Network Security Practices (Prof. Kevin Amorin), I ran two major hands-on labs. First: an MQTT Denial-of-Service attack on a live Mosquitto broker on a Raspberry Pi 4 — three Python-scripted attack vectors (retained flood, wildcard storm, session exhaustion) drove broker RAM from 600MB to 8GB, network traffic from under 1 Mbit/s to 600–700 Mbit/s, and triggered a full outage lasting ~49 minutes. Second: a Snort IDS/IPS lab — deployed Snort in detection and inline prevention modes (NFQUEUE), wrote custom rules detecting SQL injection, CVE-2021-26855 (ProxyLogon), CVE-2022-1388 (F5 BIG-IP RCE), and CVE-2018-7600 (Drupalgeddon 2), and performed PCAP forensic analysis and reverse shell detection.

I co-authored a multi-institution academic paper on the NIST Cybersecurity Framework (CSF 2.0) with collaborators from Boston University and Northeastern — covering the six core CSF 2.0 functions, SP 800-53/171/61/181 control mappings, Zero Trust Architecture, supply chain risk management (C-SCRM), ISO 27001 comparison, and CIS Controls alignment. My graduate critical infrastructure research paper — submitted April 2026 to Prof. Themis A. Papageorge — modeled the Boston Metropolitan Electric Power Distribution Network as an 8-node graph with degree, betweenness, and eigenvector centrality analysis; spectral radius computation; MBRA resilience ranking; and fault tree analysis of the Downtown Distribution Substation under DHS Energy Sector framing.

I currently serve as Technical Director of NUIoTConnect at Northeastern — leading the technical direction of a five-person delegation to DEF CON 34 in August 2026, including managing the sponsorship proposal and coordinating with university stakeholders.

On the research side, I completed a graduate medical device security project analyzing CVE-2016-9355 on the BD Alaris 8015 infusion pump. The deliverables package included a full vulnerability analysis, STRIDE threat model, DFD diagrams, CVSS scoring, exploit chain documentation, and remediation guidance — plus a confirmed new finding: CWE-798 hard-coded default credentials, documented alongside the primary CWE-312/CWE-200 chain.

I'm also building NyxKernel — an offensive security YouTube channel and personal brand targeting practitioners, students, and recruiters in the red team and exploit development space. I authored Beneath the Shell, a book on the intersection of hacking philosophy and technical craft.

Outside of security, I stay sharp through CTF competitions (MetaCTF, MITRE eCTF), competitive programming, chess, and building tools I actually use — from full-stack job trackers to interactive skill maps. I write because teaching is the best compression algorithm for knowledge. I build because shipping things is the only real feedback loop.

The philosophy that drives everything: 'I am motivated by the fear of being average.' It sounds simple. The operational version of it is never stopping when something is 'good enough.'