Sahil Ahamad

I'm a cyber security enthusiast with 10+ years of cybersecurity experience and 8+ years specialising in application security, vulnerability research, and bug bounty and security programs management.

I've worked with companies including Nykaa and Zomato, leading the security engineering function at Zomato with a strong focus on application security and security program development. For the past 5 years I've also worked on Meta's Bug Bounty program: improving root-cause analysis workflows across its product and service surfaces, including AI-assisted analysis, and driving a shift-left approach to mitigation that reduces time to mitigate and resolve. I also run privacy evaluations across products, services and features, which feed issue prioritisation during triage.

AI security is where most of my work sits now: the agentic attack surface, prompt injection and the rest of the OWASP agentic top 10, and the mitigations that actually hold up under pressure. Input filtering is rarely the useful lever — what matters is constraining what a compromised agent can reach, and what it can do with the access it already has. I work at the model layer as well as the application wrapped around it: transformer behaviour, where fine-tuning and alignment leave gaps, and why prompt-level guardrails keep failing in production.

I work closely with engineering teams to embed security early in the development lifecycle and help ship secure products at scale.

Away from work, I'm a proud dad to a daughter. Weekends usually mean woodland walks, cycling the canal paths around London, or travelling somewhere with the family. Otherwise: non-fiction, or a few rounds of CS:GO.