About Me
sl0ck is Faris Haidar Zuhdi, and I go by Faris or Slock most of the time.
I am fascinated by how systems work, how they are built and how they break. Information security is where I have taken that curiosity furthest. I have worked across offensive testing, product and cloud security, and defense, from breaking web, mobile, cloud and AI systems to SOC monitoring, detection and incident response.
I also build, designing and engineering automations and tooling and taking a solution from architecture and system design all the way to working code in production. The ones I enjoy most detect a problem and fix it on their own. My personal projects and tools run on a small multicloud cluster of my own, because the best way to understand a system is to be responsible for one.
I find myself immersed most of all in art and media in their many forms, music and film above the rest, and drawn to them for what they are long before I think about keeping them. They are also fragile, and much of it survives only because someone decided it was worth keeping. I am always keen to contribute to preservation and archival efforts, for any work of art or literature, because the works of human culture belong to everyone, and every generation to come deserves the chance to find them, consume them and be moved by them.
The rest of my time goes wherever curiosity points. Public transport and how cities are planned, history and philosophy, science and mathematics, and theoretical computer science, where the questions are the best part.
Away from the screen, I like to wander. I stroll through cities and nature, find new places, take in other cultures, and look at the beauty of urban architecture and natural landscapes along the way. I also dig for antiques and rare physical media.
I studied Information Systems at Universitas Indonesia and graduated cum laude in 2024.
For collaboration, resume requests and other enquiries, you can reach me at sl0ck@slickerius.net or on Discord at @sl0ck.
What I Use
Security
- Burp Suite
- HTTP Toolkit
- Impacket
- Cobalt Strike
- Frida
- Wireshark
- Metasploit
- Kali Linux
Languages
- Python
- TypeScript
- JavaScript
- Go
- Java
- Dart
- Shell
- C
- C++
- Solidity
Web and data
- React
- Next.js
- Node.js
- Express
- Django
- Flask
- Spring
- htmx
- PostgreSQL
- MongoDB
- SQLite
- Ethereum
Cloud and infrastructure
- Kubernetes
- Docker
- Terraform
- AWS
- Google Cloud
- Cloudflare
- Flux
- nginx
- GitHub Actions
- Linux
- Git
- GitHub
AI/ML
- Strands
- Amazon Bedrock
- Bedrock Knowledge Bases
- Vertex AI
Other tools
- Elastic and ELK
- Splunk
- Datadog
Work Experience
TravelokaOffensive Security Engineer
Penetration testing across web applications, APIs, Android and iOS apps and AI/ML systems, with source code review of critical services. Red team and adversary simulation across Kubernetes, cloud and CI/CD environments. Also runs the bug bounty program, builds internal security tooling and writes audit-ready reports that support compliance programs.
DOKUOffensive Security Engineer
Ran vulnerability management with commercial scanners across cloud and on-prem systems and managed the bug bounty program. Found issues across web, API, mobile and Kubernetes targets, from XSS and IDOR to race conditions and privilege escalation. Reviewed more than 15 critical Java, Go and Python codebases, helped design company-wide API authentication and rewrote the pentest team's SOP. Worked with the SOC through adversary simulations to turn findings into detection coverage.
- DOKU
SOC Analyst/Engineer
Designed and built a centralised Elastic SIEM fed by more than five sources, including cloud audit logs, WAFs and cluster nodes. Handled alert monitoring, incident response, malware analysis and threat hunting. Managed EDR policies, added WAF protections such as CSP and HSTS, and built automation that cut manual SOC work and pushed firewall and threat intelligence alerts to Slack.
TelkomselCloud Security Engineer Intern
Designed AWS security automation workflows with CloudFormation, SNS and Security Hub. Built a web-based service to manage IAM roles around the company's access control needs, and a proof of concept benchmarking service covering CIS, GDPR, NIST, PCI and SOC 2.
MekariProduct Security Engineer Intern
Built an automated secret scanning service that finds leaked secrets across Git platforms. Wrote company SOPs for HashiCorp Vault and Kubernetes deployments, ran Android penetration tests, and built WAF log parsers and scripts that automate compliance checks.
