~/career/about
Background
I build detection and response for organisations, then test it the way an adversary would. Running both sides is not a résumé line — it is the reason the rules are written the way they are.
The route in
I started in industrial control. Instrumentation and automation work at Technolead, then a mechatronics degree at the University of Kalamoon. Control systems are an unusual place to learn security from, but they teach a specific lesson early: real infrastructure is held together by assumptions, and the interesting failures happen where two systems disagree about who is responsible for something.
In between, I spent three years at a US agency, first designing websites and then running delivery — six people across design, engineering, copywriting and social. That taught me the other half of this job: how to write for someone who is not going to read the technical section, and how to hold a schedule when the work is open-ended.
Security became the whole job in 2024. Penetration testing at XTech against banking and telecom estates, where I built the modular framework the team still runs engagements on. Then Protech, where the work inverted — building the detection stack instead of getting past one. I kept doing both, because each one is the best possible training for the other.
How I work
Verify
No raw scanner output presented as a finding. If it is in the report, it was reproduced by hand with a working proof of concept. A version banner is a hypothesis, not a vulnerability.
Translate
A critical finding nobody funds is not fixed. Severity ratings do not travel upstairs on their own, so I write the executive section in the language the room already uses: exposure, cost, sequence.
Systematise
If a method only exists in one person's head, it does not scale and cannot be taught. Writing the framework down halved our setup time and made it possible to bring junior testers onto real engagements.
Disclose
Rules of engagement first, always in writing. Anything critical is reported the moment it is confirmed rather than saved for the report. Client detail stays inside the agreement — which is why the case studies on this site are anonymised.
Education & certification
Also
I run Hermetecha, a studio where I lead development teams end to end. It keeps me building rather than only breaking, which matters more than it sounds — you write better findings when you have shipped the kind of thing you are testing.
Based in Damascus, working remote or hybrid. English and Arabic.
Available for consultancy and full-time roles.