Headline

Staff Security Engineer at JioHotstar | Product Security | Content Security | OSCE | ir2re.fyi

About

An experienced Offensive Security Engineer with expertise in application security, vulnerability research, exploit development, and security automation. He specializes in penetration testing, manual source code review, cloud security, reverse engineering, static/dynamic analysis, fuzzing, and developing tools for automating reverse engineering. Having worked across platforms like enterprise file sharing, API gateways, collaboration tools, and OTT platforms and scaled security programs with secure-by-design principles. Passion & Hobby: As an OSCE-certified Security Researcher, spend a lot of time in reverse-engineering proprietary software like DRM and antivirus systems to uncover vulnerabilities and secrets. I have built open-source tools to automate reverse engineering using techniques such as binary instrumentation, static and dynamic analysis, taint analysis, and symbolic execution.

Location

Greater Bengaluru Area

AI stack

claude code

claude

codex

langchain

langgraph

opencode

Work experience

Staff Security Engineer at JioHotstar, Nov 2025 - Present · 10 mos, Remote, Lead Product and Content Security initiatives to reduce piracy and security risk across large-scale streaming platforms. Define and enforce Secure SDLC practices, lead architecture and design reviews, and govern security sign-off for critical features. Serve as the security SME for high-risk, business-critical deliverables in collaboration with CISO, CTO, and architecture leadership. Scale org-wide security programs through OKR planning, on-call improvements, and security process maturity. Strengthen playback security and content protection across multi-CDN

Senior Security Engineer at JioHotstar, Nov 2024 - Present · 1 yr 10 mos, 1. Leading Content Security and Product Security domain at Disney+ Hotstar to reduce the risk of content leak and piracy. 2. Enhancing in-house playback security solutions (PS3, Risk Engine, Anomaly Engine, Device Fingerprinting, DRM Proxy & DRM License Server, Forensic Watermarking, Client Security NDK .. etc) by collaborating with the Security Engineering Team to mitigate content leak and piracy abuse risk across Multi CDN 3. Spearheaded strategies to scale security programs across the organization and subsidiaries

Security Researcher at Fools Of Security, May 2017 - Present · 9 yrs 4 mos, India, 1. As a Security Researcher with OSCE Certification, I spent a lot of time on reverse engineering proprietary software like DRM, Antivirus... etc to uncover vulnerabilities, secrets, and obfuscation techniques. 2.Built open-source tools to automate reverse engineering using the following technique - Binary Instrumentation - Static & Dynamic Analysis - Taint Analysis - Symbolic Execution

Senior Security Engineer at Disney+ Hotstar, Jul 2022 - Nov 2024 · 2 yrs 5 mos, Bengaluru, 1. Leading Content Security and Product Security domain at Disney+ Hotstar to reduce the risk of content leak and piracy. 2. Enhancing in-house playback security solutions (PS3, Risk Engine, Anomaly Engine, Device Fingerprinting, DRM Proxy & DRM License Server, Forensic Watermarking, Client Security NDK .. etc) by collaborating with the Security Engineering Team to mitigate content leak and piracy abuse risk across Multi CDN 3. Spearheaded strategies to scale security programs across the organization and subsidiaries

Security Engineer II at Disney+ Hotstar, Oct 2021 - Jul 2022 · 10 mos, Bangalore Urban, Karnataka, India, 1. Led Content Security and Product Security Initiative at Disney+ Hotstar to reduce content leaks and piracy abuse risk. 2. Implemented strategies to enhance CDN security and mitigate risks effectively across all CDN

Principal Security Analyst at we45, May 2021 - Oct 2021 · 6 mos, Bangalore Urban, Karnataka, India, 1. Led VAPT Assessments for various client working with their Engineering and Product Team as part of the SDLC Process. Incorporate security tools as part of the CI/CD Pipeline with E2E automation, working with the DevOps Team 2. Build new security course, labs, and R&D on Zero-Day Exploits for AppSecEngineer platform

Senior Security Analyst at we45, Apr 2018 - May 2021 · 3 yrs 2 mos, Bangalore, Role and Responsibilities Threat Modeling (STRIDE) Application Security Assessment (Web, MicroService, ThickClient) Secure Code Review (PHP, JavaScript, Python, Java, NodeJs, C, C++, C#) Logic Flaw Analysis SAST (Fortify, Open Source Tools) and DAST (Burp Pro, ZAP, AppSpider, NetSpark, Open Source Tools + Custom Python Script) Integrating security tools into CI/CD Pipeline (SDLC) Building custom script to perform regression test Building security library for Robot Framework Automate security tools in CI/CD and collect artifacts for triaging Windows Reverse Engineering (PE File: .exe, .dll, .sys) Malware Analysis (IDA Pro, Ghidra, x64dbg, Immunity Debugger, Ollydbg, LibVMI, Drakvuf, DnsChef, Wireshark, TcpDump) Memory Forensic (Rekall, Volatility) Malware Sandbox (Cuckoo, Any.run, Drakvuf - Custom build on Xen Hypervisor) Virtualization (VirtualBox, VMware, Xen Hypervisor, QEMU, KVM) Participating in-house CTF event (Offensive and Defensive) Research: Automated Malware Sandbox on Xen Hypervisor using Drakvuf to generate artifacts - https://www.youtube.com/watch?v=FAJb1X2hX2s Drakvuf Console - Log Analysis Toolkit in electron js to extract IOC from the drakvuf log - https://www.youtube.com/watch?v=njZ_FKywiHk Research on Hypervisor Level Debugger Bug Bounty on Anti Virus Products Zero day research on RPC Protocol and Chrome IPC (Browser Exploitation)

Associate Security Analyst at we45, Sep 2017 - Mar 2018 · 7 mos, Bangalore, Led VAPT Assessments for various client working with their Engineering and Product Team as part of the SDLC Process. Incorporate security tools as part of the CI/CD Pipeline with E2E automation working with DevOps Team

Security Engineer at Brisk Infosec Solutions LLP, Oct 2016 - Aug 2017 · 11 mos, Chennai Area, India, Led the VAPT Assessment Project for various clients and carried out various security assessments (Web, Network, Mobile, WAF,.etc) along with regression test automation for all findings as part of VAPT report Role and Responsibilities Web Application Penetration Testing, API Testing & Network penetration Testing Automated/Manual Security Testing Web Developement CMS code reviewing and CMS security hardening Server Hardening Open Source Firewall implementation Implement Honey bot Developing Security Testing Tools in Python Implementing open source WAF with custom build Web UI Writing WAF rules for new vulnerability Log monitoring and Analysis using ELK Research on Exploit Development in Linux and Windows Web Application Penetration Testing Standards: OWASP, SANS 25 Network Penetration Testing Standards: OSSTMM, PTES Web Application Penetration Testing Tools: Burp Suite, ZAP Proxy, Acunetix, Netsparker, Vega Network Penetration Testing Tools Nmap, Netcat, Metasploit Framework, Nikto, Nessus, OpenVAS, Nexpose, Qualys, Core Impact and other available tools in Kali Linux package. Network Security Tool Developed in Python: ANSE Scanner (Oct - Nov 2016) (https://github.com/briskinfosec/ANSE-SCANNER) Research Project: Integrate Mod Security WAF with ELK (Web UI) for Log Monitoring an Analysis

WAPT Internship at Brisk Infosec Solutions LLP, Sep 2016 - Oct 2016 · 2 mos, Chennai, Tamil Nadu, India, I am currently doing WAPT course in brisk infosec Chennai and also I am doing internship in brisk infosec along with my wapt course.

Education

Bachelor’s Degree, Mechanical Engineering, Mepco Schlenk Engineering College

Public links

github: https://github.com/umarfarook882