For most Class 12 students, finding a job before finishing school is unusual. For Rylen Anil, 16, it came after he flagged vulnerabilities in the National Testing Agency (NTA)’s NEET re-examination portal and the JEE Advanced website managed by IIT Roorkee in June, prompting authorities to act on the security flaws.
Within weeks of his disclosures, Anil was approached by IIT Kanpur and offered a role at its cybersecurity innovation hub, C3iHub. He received the offer letter on July 1 and joined about a month ago as a junior cyber security engineer, working remotely from Dubai in the UAE. At 16, he is also the youngest person to be hired by an IIT, according to IIT Kanpur director Manindra Agrawal.
“After seeing Rylen Anil’s work and abilities, the IIT Kanpur team approached him. Our engineers interacted with him and found that he has strong skills in cybersecurity and related areas, following which we decided to engage him. Since he is based in Dubai and is currently studying in Class 12, he is working remotely as a consultant and cannot work full-time. His primary responsibility is security analysis of various web portals,” Agrawal told HT.
The engagement took nearly a month to complete because Anil is a minor. His father Anil Abraham has signed the contract as his guardian and co-obligor, covering obligations relating to confidentiality, data protection, information security and intellectual property. His work is restricted to supervised, non-hazardous educational, research and skill-development activities.
{{/usCountry}}The engagement took nearly a month to complete because Anil is a minor. His father Anil Abraham has signed the contract as his guardian and co-obligor, covering obligations relating to confidentiality, data protection, information security and intellectual property. His work is restricted to supervised, non-hazardous educational, research and skill-development activities.
{{/usCountry}}“Since he is 16 and therefore a minor, we had to ensure that all government rules and regulations governing his engagement were followed. It took us nearly a month from the beginning of our discussions with him in June to complete the process. He is the youngest person to be hired across the IITs,” Agrawal said.
It all began in the first week of June, when Anil identified a vulnerability in the NTA’s NEET-UG re-examination portal that allowed him to bypass authentication controls and access functionality intended for a super administrator.
“From there, the account appeared to have highly privileged capabilities, including managing examination centres and accessing information relating to observers,” Anil said.
He also found that cloud storage associated with the JEE Advanced portal had been improperly exposed. It contained documents including candidate admit cards and results, potentially exposing candidates’ personal information.
Also Read: Cert-In asks teen researcher to hold off public vulnerability disclosures
Anil reported the NEET portal’s vulnerabilities through the appropriate channels, including to CERT-In before discussing it publicly on social media platforms, and said the issue was addressed within about a day.
In the JEE Advanced case, he identified a public cloud-storage misconfiguration that allowed unauthorised access to candidate data, including admit-card PDFs and result records. IIT Roorkee, which was managing the portal at that time, promptly fixed the configuration and later clarified that the storage was read-only, meaning the data could not be altered or deleted. Anil also clarified that he had found no evidence of a large-scale data leak and had downloaded only a small number of files to verify the vulnerability before deleting them.
His approach, he said, is to stop testing once there is enough evidence to establish a vulnerability, rather than attempting to obtain maximum access.
“The objective should always be to make the system safer, not to prove how much access you were able to obtain,” he said. “I avoid accessing more information than is necessary, do not download or retain sensitive data unnecessarily, and never make changes to a production system simply for demonstration purposes.”
Originally from Mannar, near Thiruvalla in Kerala, Anil was born and brought up in Dubai, where he studies Class 12 at JSS Private School, a CBSE-affiliated school. His father, who moved to Dubai in 1999, is general manager of IT at Al-Futtaim, focusing on IT infrastructure and security operations. His mother is a physiotherapist.
Anil said his interest in hacking began young, partly influenced by fictional hackers in Hollywood movies The Matrix and Mr. Robot. He started “seriously learning to code” in Class 8 and found his first real website vulnerability in Class 10, in the website of startup Grubby.ai, which he reported responsibly.
“That experience was probably the point at which cybersecurity went from simply being an interest to something I could genuinely imagine dedicating my career to,” he said.
At C3iHub, his work will not be limited to government or examination portals. He hopes to gain experience in vulnerability research, threat analysis, application and infrastructure security, and AI in cybersecurity.
“I am getting exposure to real-world cybersecurity problems and working alongside people with significantly more experience than me,” he said.
Joining IIT Kanpur has accelerated, rather than replaced, his education plans. Anil intends to pursue a bachelor’s degree in cybersecurity or a related field and is considering institutions in India, including IIT Kanpur and IIT Madras, as well as universities in the US.
His long-term ambition is to become a Chief Information Security Officer (CISO) or Chief Technology Officer (CTO), possibly of a company he builds himself. He also wants India to develop clearer legal frameworks and stronger vulnerability-disclosure programmes for ethical hackers.
“I think encouraging these researchers rather than making them afraid of reporting what they discover could ultimately make India’s digital infrastructure significantly more resilient,” he said.
For now, he is balancing school with his first professional cybersecurity role.
“It feels amazing, and at times it still feels slightly surreal,” Anil said. “At the same time, I try not to think of it as having ‘made it’. I am still at the very beginning of my career and there is an enormous amount that I still have to learn.”