Shaik Arif Ali Get in touch

AI Security · AppSec · Product Security

Shaik Arif Ali

I work on the parts of security that help teams ship with confidence.

Product Security Engineer focused on application security and AI security. My work spans secure SDLC practices, security testing, threat modeling, and practical conversations with engineering teams. In my free time, I work on AI security research and build open-source security tools.

Email me See my tools → LinkedIn
Hyderabad · Remote / Product Security Engineer / Fintech SaaS
Shaik Arif Ali

Open to work

Looking for my next role in AI Security or Application Security.

Open to full-time and contract opportunities in AppSec, product security, and AI/LLM security — based in Hyderabad or fully remote.

AI Security AppSec Product Security Full-time Remote
Let's talk →

About

Thoughtful security work starts with context.

I work across the secure SDLC of a fintech SaaS company, helping teams understand and address security risk in a practical way. This includes SAST and DAST triage, software composition analysis, secrets detection, threat modeling, and vendor security review. I try to keep the focus on what is genuinely exploitable and what an engineer can do next.

Earlier in my career, I worked on full-scope application security penetration testing (VAPT) across web, mobile, network, and API surfaces. That experience shaped how I approach security findings today: clear evidence, fair severity, and remediation guidance that the receiving team can use.

Outside of work, I do independent bug bounty research on YesWeHack under the handle mrclown. I have been active there since 2023.

Where the work concentrates

01AI Security
02AppSec
03Secure SDLC
04Threat Modeling
05SAST / DAST
06SCA
07Secrets Mgmt
08VAPT

Experience

Two years, one team, an expanding remit.

June 2024 — Present

Product Security Engineer

Fintech SaaS company · Hyderabad, India

  • —Lead triage on SAST output in Checkmarx: separate what's genuinely exploitable from what merely trips a rule, and pair every escalation with a fix path a developer can act on the same day.
  • —Run software composition analysis in JFrog Xray across builds and container artifacts — closing the gap between "a dependency has a CVE" and "this build actually ships it."
  • —Operate secrets detection in GitGuardian as a standing process rather than a dashboard: exposed credentials get rotated on a clock, not a backlog.
  • —Run product and application security assessments that go past checklist scanning, surfacing architectural and design flaws that automated tooling doesn't see.
  • —Advise engineering teams on secure architecture and secure coding before code ships — not after a pentest finds it.
  • —Thread threat modeling into the SDLC early enough to catch an attack surface before it becomes a finding.
  • —Own third-party security review end to end — vendor onboarding, assessment coordination, and a documented read on partner risk posture.

Oct 2023 — June 2024

Product Security Intern

Fintech SaaS company · Hyderabad, India

  • —Ran full-scope application security penetration testing (VAPT) across web applications, Android and iOS clients, internal and external networks, and REST/SOAP APIs, plus Windows and Linux hosts.
  • —Wrote findings the way a fixing engineer actually needs them: clear reproduction steps, an honest risk rating, and remediation guidance that doesn't require a follow-up conversation.

Skills

What I work with, day to day.

Security domains

AI Security Application Security Product Security Secure SDLC Threat Modeling SAST DAST SCA Secrets Detection API Security Android Security iOS Security Network Security VAPT

Tools

Checkmarx (SAST) JFrog Xray (SCA) GitGuardian Jira

Testing types

Web App Testing Mobile App Testing API Testing (REST/SOAP) Network Pen Testing

Independent research

Bug bounty, on my own time.

yeswehack.com/hunters/mrclown ↗

I do bug bounty research on YesWeHack and have been active there since 2023.

202

points earned

2023

active since

Certifications

Credentials that back the work.

CNSP

Certified Network Security Practitioner

CCSP-AWS

Certified Cloud Security Practitioner — AWS

eWPTX

Web Application Penetration Tester eXtreme

Community

Community work, beyond the day job.

Shaik Arif Ali speaking at a null Hyderabad meetup

null Hyderabad

Chapter Leadership

Core team — I help run the show.

I'm on the core team at null Hyderabad, India's community-driven infosec chapter. I help make sure events run smoothly end to end — reviewing speaker content, running the chapter's social media, and emceeing sessions on the day.

Meet the team →
Bug Bounty Brigade logo

Bug Bounty Brigade — Global Hacking Community

Founder

A global hacking community I started.

A community of bug hunters, by bug hunters, for bug hunters — built around collaboration, knowledge sharing, and professional growth for security researchers, with a focus on responsible disclosure and ethical hacking practice.

Watch on YouTube → LinkedIn Instagram WhatsApp

Talk

A talk I've given.

Shaik Arif Ali presenting "The UI Is the Lie" at null Hyderabad

null Hyderabad

The UI Is the Lie: Hunting Bugs Hidden in JavaScript Bundles

Why the rendered UI hides the real attack surface, and how to pull endpoints, secrets, and DOM-XSS-shaped sinks straight out of a target's JS bundles — the ideas that became BundleBleed.

View session on nullHyd →

Featured build

Open-source security tools, built in public.

kiyooo logo
kiyooo Open source · MIT

Open-source AI attack surface management. Instead of another severity score, kiyooo puts every finding through evidence-cited LLM triage, with a human in the loop and local models by default — no hostname or finding leaves the network.

See how it works
SkillFence logo
SkillFence / SkillFence Lab Open source · MIT

Runtime behavioral security for AI agent skills. SkillFence watches what a skill actually causes an agent to do, scores capability drift, and pauses high-risk actions for a human before they execute.

Explore the project
BundleBleed logo
BundleBleed Open source · MIT

AI/LLM-assisted JS recon and vulnerability triage for authorized bug bounty testing. Extracts endpoints, secrets, and DOM-XSS-shaped sinks from client-side JavaScript, then scores them into evidenced hypotheses — scope-gated, passive by default, and human-verified before anything sends.

Explore the project