Skip to content
Open to backend and automation roles

Kareem
Hesham.

Python Automation, Web Scraping & Backend Engineer

Python engineer building production-grade automation systems, backend APIs, and data acquisition pipelines — with a peak delivery of a million records in a day from direct protocol access, no browser, no DOM.

PythonFastAPIWeb ScrapingReverse EngineeringBackend APIsOpen Source

01 / About

Engineering below the abstraction line.

I build systems by understanding the layers they depend on—from TLS fingerprints and browser protocols to API boundaries, persistence, and CI. The result is automation that keeps working when the easy assumptions stop being true.

Portrait of Kareem Hesham

Self-taught through the problems themselves: protected clients that had to be understood before they could be automated, and services that had to survive their own success. The payoff is measurable — on one engagement a peak day returned a million records from about 10,000 requests, because the work went to the protocol instead of the page.

I work well inside a team — collaborating with data scientists and ML engineers on delivery, taking direction, and applying feedback. That's reflected in my verified references.

4

Open-source tools

Public repositories with CI

2

Research articles

Published technical deep dives

1

Responsible disclosure

CWE-835 reported to Samsung

3

Verified references

Independently collected via ZincWork

600+

Targets automated

Sites and APIs across client work

2

Languages

Arabic native · English professional

02 / Capabilities

A stack built for systems work.

Tools are selected for control, observability, and a clean path from investigation to dependable production software.

01

Backend

Typed, observable services with clean data boundaries.

PythonFastAPISQLAlchemyPostgreSQLAlembicREST APIsJWTPydantic
02

Automation

Browser and request-level systems built for resilience.

PlaywrightSeleniumScrapyrequestsasyncioCDP
03

Networking

Protocol-aware data acquisition beyond the happy path.

HTTPHTTP/2TLSCookiesSessionsHeadersProxy RotationBurp SuiteCharles
04

Reverse Engineering

Recovering behavior from protected web and mobile clients.

JavaScriptNode.jsBabelASTFridaJADXAndroid
05

Infrastructure

Repeatable delivery, tests, and operational foundations.

DockerLinuxGitHub ActionspytestGitCI/CD

03 / Experience

How the work actually runs.

Contract engagements rather than salaried roles: investigating difficult protocols, designing maintainable implementations, and carrying them into production. Embedded in small client teams alongside data scientists and ML engineers, delivering against their requirements and review.

2022 — Present

Freelance · Contract

Cairo, Egypt · Remote

Independent Python Automation & Backend Engineer

Automation · Data acquisition · Reverse engineering · Backend APIs

  • Build request-level automation that reproduces protected client behavior without a browser or DOM — one engagement delivered 1M records in a day from ~10K direct HTTP requests.
  • Reverse engineer client-side signatures, dynamic tokens, fingerprint challenges, and Android application flows across 600+ distinct targets.
  • Handle bot-mitigation and verification flows across roughly 30 challenge types, working only on client-authorized targets and strictly within the contracted engagement scope.
  • Diagnose and ship fixes within 6–24 hours when a target changes its protections, keeping delivery pipelines running.
  • Design typed FastAPI services with layered architecture, PostgreSQL persistence, Alembic migrations, JWT authentication, and pytest coverage.
  • Develop resilient acquisition pipelines with session control, proxy rotation, and rate-limit handling — largest single delivery was 60GB across 35M validated rows.
  • Collaborate with data scientists and ML engineers on scoped deliveries, coordinating tasks and shipping on schedule.
  • Turn investigation tooling into documented open-source utilities and publish the underlying technical research.

Delivery figures

Aggregate figures across client engagements from 2022 onward. Volume comes from reading the protocol directly rather than driving a browser.

1Mrecords

Peak day

Delivered from ~10K direct HTTP requests — roughly 100 records per call, no browser or DOM rendering.

600+targets

Sites and APIs

Distinct scrapers built against production targets across varied protections and response formats.

60GB35M rows

Largest delivery

Single dataset acquired, validated, and handed off in a structured format.

30providers

Challenge types

Verification and bot-mitigation flows handled on client-authorized targets, within contracted scope.

6-24hrecovery

Defense changes

Typical turnaround to diagnose and ship a fix when a target changed its protections.

95%+accuracy

capture2tls output

Share of captures converted to working request code without manual correction.

Figures span client engagements between 2022 and 2026. Client names, target systems, and delivered datasets are covered by confidentiality agreements; specifics are available on request under NDA, and the referees below worked directly on this delivery.

04 / Selected work

Open systems. Inspectable decisions.

Each project isolates a hard systems problem, makes the architecture legible, and leaves the implementation open for inspection.

/01

Reqvexa

Pythonv0.1.0-alpha

A HAR-based HTTP provenance analyzer that traces the cookies, tokens, headers, and request dependencies behind a target request.

Python 3.12+HAR 1.2CLIFletpytest
  • Preserves request order, duplicate headers, and raw HAR fields
  • Traces cookies, authorization, headers, query, JSON, form, and HTML state
  • Matches URL-decoded, Base64/base64url, and Bearer representations

/02

capture2tls

Python

A zero-dependency converter from raw proxy captures to fingerprint-aware Python request code.

PythonHTTP/1.1HTTP/2tls_clientcurl_cffi
  • Converts 95%+ of captures without manual correction
  • Parses HTTP/1.1 and HTTP/2 pseudo-headers
  • Separates cookies into an explicit session dictionary

/03

jsunveil

JavaScript

A pattern-based JavaScript deobfuscator that survives regenerated identifiers, alphabets, and rotation offsets.

Node.jsBabelASTvm sandboxStatic analysis
  • Locates randomized string tables and decoder functions
  • Executes only the minimum code inside an isolated VM
  • Inlines decoder calls through an AST transformation

/04

API Automation Platform

PythonActive

A FastAPI service for authenticated API integrations and background synchronization workflows.

FastAPISQLAlchemy 2.0PostgreSQLAlembicDocker
  • OAuth2 password flow with JWT access tokens
  • Typed API boundaries with Pydantic
  • Versioned migrations and containerized PostgreSQL

05 / Research

Understand the mechanism. Then reproduce it.

Technical research is part of the engineering process: isolate assumptions, instrument the target, build the smallest useful model, and document what survives scrutiny.

Study 01

Protected web systems

Anti-bot stack decomposition

Mapped the layered interaction between generated JavaScript, device fingerprinting, behavioral telemetry, and server-side challenge verification.

Dynamic analysis · AST tooling · Headless reproduction

Study 02

Mobile imaging security

Samsung UltraHDR loop analysis

Traced a non-terminating execution path in the UltraHDR stack and validated the denial-of-service condition through coverage-guided fuzzing.

arm64 reversing · Frida · AFL++

07 / References

What collaborators say.

Independently collected and identity-verified through ZincWork. Each referee worked directly with me on delivery.

Based on my experience working with him, I would gladly collaborate with him again.

He was responsible for collecting and organizing data, performing analysis, solving technical challenges, and ensuring tasks were completed on schedule.

Mohamed Wageh

Data Scientist

I would feel confident having him on the team again because of his professionalism, reliability, and collaborative approach.

His role involved managing technical tasks, analyzing project requirements, contributing to problem-solving, and making sure his assigned work was completed accurately and on time.

Seif Eldin Hatem

Machine Learning Engineer

I would be happy to collaborate with him again on future projects.

We collaborated on several professional projects, working together to deliver high quality results.

Youssef Abdelhamid

Web Scraper

Full reference pack, independently verified.

View on ZincWork

08 / Credentials

Education, languages, and verified training.

Public code, CI history, and published research carry the engineering evidence. What follows is the formal record behind it.

2018 — 2023

Bachelor of Laws (LL.B.)

Cairo University

Two things carry over. The first is practical: I can read a terms of service, a data processing agreement, or a scraping engagement scope and say where the line is before any code is written — which matters in this field. The second is the habit itself — close reading under adversarial conditions, where rules, exceptions, and edge cases decide the outcome. A protocol specification reads the same way.

Academic reference: Ayman Al-SaadanyAssistant Professor of Public Law, Cairo University

Languages
Arabic
Native
English
Professional working proficiency

09 / Contact

Have a difficult system problem? Let's inspect it.

Open to backend and automation roles, and to technically demanding contract work across data acquisition, reverse engineering, and Python backend systems.