Ahmad Shaukat
I build security programs for US defense contractors and keep the evidence an assessor will ask to see.
I am the only security engineer at a defense contractor of about 80 users. I cover CMMC, NIST SP 800-171 and ISO 27001. I also run detection and response, plus the migrations that sit underneath all of it. Earlier work was in SOC operations, DevOps and carrier network engineering.
Claims and the evidence behind them
Status uses assessment language. Implemented means in place with evidence. In progress means designed, with the build under way.
- Claim:
Built the security and compliance program at a US defense contractor of about 80 users, as its first security hire.
US defense contractor, November 2025 to now
Evidence:Brought the commercial environment up to the CMMC Level 1 practice set, designed an enclave-based CUI boundary for Level 2, wrote the SSP against NIST SP 800-171 and set up an ISO/IEC 27001:2022 ISMS with internal audit.
- Claim:
Moved a business from Google Workspace to MS 365 across three mail domains, and rebuilt the identity baseline on the way.
US defense contractor, August to October 2026
Evidence:78 user and 17 shared mailboxes, about 1.8 TB, migrated with MigrationWiz into one tenant. Security Defaults replaced mid-migration by a five-policy Conditional Access baseline with break-glass accounts.
- Claim:
Designed an on-prem SIEM and DFIR stack that one engineer can run, on servers the business already owned.
US defense contractor, 2026
Evidence:Wazuh all-in-one with Sysmon on every Windows endpoint, five event channels, MITRE-mapped custom rules and FIM. TheHive, Cortex and MISP for case handling. KAPE and THOR Lite for triage. A 19-section build manual covers the stack end to end.
- Claim:
Brought an unmanaged Windows fleet under control through RMM scripting, then designed tiered access so each group gets only what its work needs.
US defense contractor, 2026
Evidence:Fleet-wide PowerShell remediation through Action1 removed unapproved remote-access tools and software, audited local admin sprawl and collected Windows 11 readiness and Autopilot data. Conditional Access tiers set by role, location and device.
- Claim:
Wrote and maintain an open-source Windows 11 hardening and triage tool in which every change is backed up and reversible.
Independent open source, 2026 to now
Evidence:A PowerShell 5.1 GUI with a security audit and tiered fixes, debloat, a plain-English compromise check and a native process and event-log hunt. Restore point, JSON before-state, rollback script and verify-after-apply on every change.
Writing
Field notes from the work above. Lab data and sanitised detail only.
MigrationWiz "Mailbox Size" is not your source size
Why MigrationWiz showed some Gmail mailboxes at nearly twice the size Google reported, how to measure the label multiplier and what it changes for limits and pass times.
AADSTS50079 on a migration account: replacing Security Defaults with Conditional Access
Why a migration service account failed destination authentication under Entra Security Defaults, and how a five-policy Conditional Access baseline replaced them without weakening the tenant.
Wazuh all-in-one on Ubuntu 24.04: the decisions that matter
A condensed build guide for a single-node Wazuh SIEM covering about 80 Windows endpoints, from memory sizing and disk layout to agent rollout through RMM and the first custom rules.
KAPE and THOR Lite: a two-tool triage workflow
A repeatable Windows triage workflow practised on a lab machine. Collect with KAPE, preserve, parse with Eric Zimmerman's tools, scan with THOR Lite, then correlate before calling anything a finding.
Building a Windows hardening tool that can always be undone
Design notes from Win11-Security-Optimizer: read-only scans, before-state backups, a rollback script that standard users cannot tamper with, risk tiers and opt-in DFIR tools checked against pinned hashes.