grc / tprm
Security questionnaire automation
Incoming vendor questionnaires and client security assessments are ingested, parsed question by question,
mapped against our ISO 27001 control set, and matched to the relevant evidence documents. Draft answers are
assembled from those documents — grounded in actual evidence, never invented — and the completed
draft lands with me for review before anything leaves the building.
Ingestquestionnaire intake
MapISO 27001 controls
Draftevidence-grounded
Human reviewapprove / edit
Send
Gate: answers are only as good as their evidence. Anything unanswerable from documents goes back as a named-owner question, not a guess.
offensive security
VAPT pipeline automation
Recon runs as a repeatable pipeline: subdomain enumeration, live-host probing, templated vulnerability
scanning, and structured finding intake. The machine handles the breadth; the interesting part —
manual exploitation, chaining, and business-logic flaws — stays human. Reports are drafted from
validated findings, and retests are tracked until closure.
ReconSubfinder · Amass
ProbeHTTPx · Nmap
ScanNuclei · Burp
Manual validationexploit · chain
Report · retestDefectDojo
Gate: scanner output is untrusted input until a human confirms exploitability. No scanner finding ships without validation.
devsecops
AppSec / DevSecOps automation
SAST, DAST and SCA run inside CI on every pull request so defects surface at code time, not audit time.
Findings sync into DefectDojo, where they are deduplicated, assigned to owners, and tracked against
remediation SLAs. Developers get PR-ready fixes; I get a single tracked workflow from detection to verified closure.
CI scanSonarQube · Snyk · CodeAnt.ai
PR findingsinline fixes
SyncDefectDojo
SLA trackingowners · retest
Gate: false-positive triage stays manual. A scanner does not get to burn developer trust on bad findings.
comms
Email triage & drafting
Inbox automation sorts and labels incoming mail, drafts replies for routine requests, and schedules
follow-ups so threads do not die. Every draft is exactly that — a draft. Nothing sends without a
human reading it first and hitting send.
Triagelabel · sort
Draftroutine replies
Schedulefollow-ups
Human sendsevery message
Gate: no autonomous sending. The automation prepares; the human approves.
content operations
Social media pipeline
A full content pipeline powers my news page: topic research, scripting, image generation, captions and
hashtags, then scheduled multi-post publishing across the day. It runs the Varta Samkara Instagram news
page on a multi-post daily schedule — reels, stories and posts, each with sound design and
8–15 relevant hashtags for reach.
Researchtrending topics
Scriptnarrative · voice
Mediaimages · reels
Captionshashtags
Schedulemulti-post daily
Gate: claim-bearing content is verified against sources before it publishes — no unverifiable claims go out under my name.
and more
Audit evidence & phishing ops
Audit season means collecting the same evidence from the same systems every cycle; that collection is
scripted, with gap reports generated automatically. Phishing simulations run on a managed schedule with
GoPhish — campaign setup, target lists, template rotation, and result dashboards — feeding
straight into awareness training for the teams that clicked.
Collectaudit evidence
Gap checkcontrol mapping
CampaignGoPhish
Reporttraining input
Gate: simulation targets and templates are approved before launch. Phishing is a training tool, not a surprise attack.