About
I am a principal information security engineer. I work as the only security practitioner at a US defense contractor, so the controls I build and the evidence behind them are both mine to answer for.
How I work
I start from the evidence an assessor or an incident responder will ask for, then work back to the control that produces it. A control that cannot show its own evidence is a gap, whatever the policy says.
I prefer changes that can be undone. Hardening that breaks a business process tends to get rolled back in a hurry and not reapplied. Rollback plans, before-state backups and report-only phases are part of the build, not an afterthought.
I write decisions down with their trade-offs. Most security choices in a small business are a balance between cost, user friction and risk. The record of why a choice was made is often worth more in an assessment than the choice itself.
Now and next
Current work covers a CMMC Level 2 enclave build, a Google Workspace to MS 365 migration with a new identity baseline, and an on-prem SIEM and DFIR stack.
I also build open-source tooling, starting withWin11-Security-Optimizer, and do independent security research under the handle ahmadwhosecures.
From 2027 I plan to offer fractional security advisory work to small defense industrial base contractors.
Experience
Described by industry. Detail is on LinkedIn.
| Setting: | Role: | Work: |
|---|---|---|
| US defense contractor | Principal Information Security Engineer, first and only security hire | Security and compliance program: CMMC Level 1 and Level 2, NIST SP 800-171, DFARS, ISO/IEC 27001:2022. DFIR, SIEM, endpoint baseline, MS 365 migration and identity design. |
| Managed service provider | Technical Consultant, SOC operations | Secureworks Taegis XDR operations across three financial-services client accounts, with oversight of L1 to L3 tiers. |
| Technology services | DevOps and Network Engineer | Hardened golden-image pipeline built with Packer, Terraform and Ansible. |
| Network services provider | Network Engineer | Network engineering in telecommunications carrier and data centre environments. |
Education and credentials
| Credential: | Status: |
|---|---|
| Bachelor of Information Technology (Network Security), TAFE NSW | Completed |
| ISC2 Certified in Cybersecurity | Exam scheduled, late 2026 |
| Risk Management Framework (RMF) course | In progress |
| CISSP | Planned, 2027 |
Working toolset
| Area: | Tools and standards: |
|---|---|
| Compliance | CMMC 2.0, NIST SP 800-171 Rev 2 and Rev 3, DFARS 252.204-7012, ISO/IEC 27001:2022, ISO 19011 internal audit |
| Identity and cloud | Entra ID Conditional Access, Intune, MS Defender, Exchange Online, Autopilot |
| Detection | Wazuh, Sysmon, TheHive, Cortex, MISP, Secureworks Taegis XDR |
| DFIR | KAPE, Eric Zimmerman's tools, THOR Lite, Hayabusa, Chainsaw, SIFT |
| Endpoint and automation | Action1 RMM, PowerShell, Packer, Terraform, Ansible |
| Network | OPNsense, Zenarmor, enterprise firewalls in FIPS mode, carrier and data centre routing |