Islamabad, PakistanThe Security EditionEst. 2023

Muhammad Ayan

The field record of a cyber security analyst

Saturday, 26 September 2026Vol. ISelected cases & notesClearance: Public

Front pageFiled under: Defensive & offensive security

Case No. 01 — Subject profile

A cyber security professional who builds the tooling — and understands the compliance it feeds.

BS Cyber Security at FAST-NUCES, Islamabad, and a security intern at JWPL (JazzWorld). I pull vendor data into working dashboards in Python and SQL, and assess vendors and map controls against ISO/IEC 27001 and PTA CTDISR.

My work sits where engineering meets assurance. At JWPL I built the compliance KPI dashboard that unified four security stacks into one posture view, and ran SOC 2, vendor-risk and biometric assessments alongside it. My final-year research asks whether layered adversarial-ML defences for IoT intrusion detection survive an attacker who knows they're there. All of it is backed by hands-on offensive and defensive work from coursework and CTFs.

Read the case files Download CV

By the numbers

  • 4security stacks unified into one posture view at JWPL
  • 14CTDISR regulatory chapters mapped into a supplier questionnaire
  • 3vendor assessments run — SOC 2, Bitsight VRM, biometric PAD
  • 4CTF competitions entered
Section I — Case files4 exhibits entered into the record

Selected Cases

Asset Compliance view of the dashboard showing KPI cards, a control-coverage bar chart per source, a compliance-posture donut and a control-depth histogram. All values are redacted with black bars.Redacted · Confidential
Fig. A1 — Asset Compliance view — every asset any source knows about, checked against each control. Internal team names and asset counts removed.
Exhibit AJWPL (JazzWorld) · 2026

Security Compliance & KPI Dashboard

The problem
Security posture lived in four separate consoles — the SIEM, Qualys, EDR and PAM — and was stitched together by hand in spreadsheets for every management report. Nobody could say, on demand, which assets were compliant, which were drifting, or where remediation was overdue.
My role
Sole designer and builder, and the primary deliverable of my internship: from the vendor API clients and data model to the KPI logic and dashboard views.
Findings
  1. Four security stacks unified into a single organisational posture view.
  2. Manual spreadsheet collation replaced with an on-demand dashboard.
  3. KPI thresholds surface overdue remediation, tooling-coverage gaps and compliance drift automatically.
  4. Point-in-time snapshots make it possible to track trends, not just one moment.
Evidence (stack)
  • Python
  • REST APIs
  • SQLite
  • LogRhythm SIEM
  • Qualys VM
  • EDR
  • PAM
  • JavaScript
Open case file
The AAD+ Flow Explorer. Controls choose the traffic type, what the attacker knows and the EIDS fusion rule, above a pipeline of boxes from attacker host through wire and sensor into three defence layers — rule validator, adversarial discriminator and EIDS ensemble — ending at a protected hospital ward segment.
Fig. B1 — AAD+ Flow Explorer — send one flow at a time through the defence and see which layer stops it, and why.
Exhibit BFinal Year Project · FAST-NUCES · 2026 — 2027

Adversarial ML for IoT Intrusion Detection

Status: Research in progress

The problem
Layered adversarial-example detectors for IoT intrusion detection report near-perfect results — but they are trained and tested on the same attacks, evaluated only against defence-blind attackers, and validated on enterprise traffic rather than IoT. Nobody knows whether they hold up when it counts.
My role
Co-researcher on my final-year project: literature review and gap analysis, threat model, and the AAD+ evaluation bench and flow explorer used to put the defence under pressure.
Findings
  1. Identified five recurring evaluation gaps across the literature, from coupled train/test attack sets to unreported deployment cost.
  2. Re-implementing AAD (rule validator → RF discriminator → MLP/CNN/LSTM ensemble) as a testable pipeline.
  3. Evaluating it against unseen attack families and an adaptive, defence-aware attacker, under realizability constraints and on IoMT traffic.
  4. Measured results will be published here when the evaluation is complete.
Evidence (stack)
  • Python
  • Random Forest
  • MLP · CNN · LSTM
  • PGD · BIM · FGSM · DeepFool
  • CIC-IoMT-2024
  • CSE-CIC-IDS2018
Open case file
EIAM admin console showing a live request moving from IoT device through edge crypto, LAA engine and cloud IAM, with a per-attribute table of VR, freshness, TVR and threshold values and the final decision.
Fig. C1 — EIAM admin console — one request traced from device to decision, with the per-attribute trust calculation.
Exhibit CNetwork Security project · FAST-NUCES

Edge-Enabled Identity & Access Management for IoT

The problem
Cloud-centric IAM makes every IoT access decision cross the internet: credentials travel over the WAN, a round-trip can take hundreds of milliseconds, and cached identity data at the edge silently goes stale.
My role
One of three engineers. We implemented the Q1-2025 EIAM-IoT framework end to end: a local authentication and authorization engine at the edge, an authenticated-encryption channel from device to edge, and MQTT context sync with the cloud.
Findings
  1. Device-to-edge traffic protected with ephemeral X25519, HKDF (PSK as salt) and ChaCha20-Poly1305 — ciphertext only on the wire, verified in Wireshark.
  2. ABAC decisions made locally at the edge, with each attribute scored on freshness and trust (TVR = VR × F ≥ ToC).
  3. Every ALLOW or DENY persisted with per-attribute metrics, giving a full audit trail.
  4. Edge–cloud context sync over MQTT request/response, pulling only attributes newer than the edge's copy.
Evidence (stack)
  • Python
  • FastAPI
  • SQLite
  • MQTT · Mosquitto
  • X25519
  • HKDF-SHA256
  • ChaCha20-Poly1305
  • React
Open case file

  1. Stage 1

    • Discoverylive hosts on the local segment

  2. Stage 2

    • Port scanexposed services per host

  3. Stage 3

    • Fingerprintdevice type and vendor

  4. Stage 4

    • Weak credentialsdefault and weak logins

  5. Report

    • Dashboardtopology · vulnerability distribution · per-device report

WebSocket: live progress, status and findings pushed to the browser.

Fig. D1 — Scan pipeline. Each stage streams progress and findings to the dashboard as it runs.
Exhibit DPersonal project

IoT Vulnerability Scanner

The problem
Home and small-office networks fill up with IoT devices nobody inventories: cameras, plugs and hubs running default credentials and exposed services. General-purpose scanners report ports, not IoT risk.
My role
Sole developer across the full stack: the Python scanning pipeline, the WebSocket streaming layer and the dashboard.
Findings
  1. Four-stage pipeline covering host discovery, port scanning, device fingerprinting and weak-credential checks.
  2. Scan progress, status and findings streamed live to the UI over WebSockets.
  3. Visualises the network topology, the distribution of vulnerabilities and a security report for each device.
Evidence (stack)
  • Python
  • WebSockets
  • HTML · CSS · JavaScript
  • Network discovery
  • Service fingerprinting
Open case file
Section II — Standing ordersTools of the trade

The Toolkit

SIEM & SOC

Detection, triage and the data plumbing behind it.

  • LogRhythm (API integration)
  • Splunk — SPL
  • IBM QRadar
  • Wazuh
  • Elastic Stack
  • Snort

VAPT

Recon to exploitation, on lab and CTF targets.

  • Nmap
  • Metasploit
  • OWASP Top 10
  • Linux privilege escalation
  • Active & passive recon
  • pfSense

Digital Forensics

Memory, disk and packet evidence.

  • Volatility 3
  • Autopsy
  • Wireshark
  • NetworkMiner

Threat Modeling

Deciding what can go wrong before it does.

  • STRIDE
  • DREAD
  • Adaptive-attacker evaluation for ML defences

GRC & Compliance

Mapping controls and assessing third parties.

  • ISO/IEC 27001:2022
  • SOC 2 gap analysis
  • PTA CTDISR (all 14 chapters)
  • Vendor risk management — Bitsight
  • ISO/IEC 30107-3 (PAD testing)
  • FIDO2 / WebAuthn
  • ISO/IEC 24745

Engineering

Building the tooling, not just running it.

  • Python
  • SQL & SQLite
  • FastAPI
  • JavaScript, React, Express
  • MongoDB
  • MQTT
  • Rust & Flutter (debugging)
Section III — CompetitionsCapture the flag

The Scoreboard

EventYearResult
Ignite Hackathon CTF2024Competed
CTS CTF2024Competed
C00k3d CTF—Competed
MCS CTF—Competed
Section IV — ExperienceEntries in chronological order, newest first

The Career Ledger

  1. Jul 2026 — Aug 2026

    Cyber Security Intern

    JWPL (JazzWorld)

    Shipped the security compliance KPI dashboard as the internship’s primary deliverable, and ran vendor-risk and regulatory assessments alongside it.

    • Built a compliance KPI dashboard that consolidates LogRhythm SIEM, Qualys, EDR and PAM into one posture view, replacing manual spreadsheet collation.
    • Modelled KPIs against thresholds so overdue remediation, tooling-coverage gaps and compliance drift surface automatically.
    • Ran a SOC 2 gap analysis on a Jazz PMCL call-centre VRM questionnaire, and a gap analysis on a Bitsight VRM questionnaire.
    • Wrote a supplier security questionnaire from the ISMS Annexure with CTDISR-aligned rows across all 14 regulatory chapters.
    • Assessed a Biometric Verification System vendor against ISO/IEC 30107-3 (PAD), FIDO2/WebAuthn and ISO/IEC 24745.

  2. Jun 2026

    Software Development Intern

    TashiTech

    Worked on BitMadWall, an offline-first mesh messenger over BLE and LoRa that also carries Wi-Fi-less blockchain transactions.

    • Found a critical dual-protocol drift: the Rust chat module (chat/src/lib.rs) was bypassed at runtime by a diverging Dart implementation.
    • Diagnosed a decryption fall-through bug and a hash-chain integrity issue in the app’s cryptographic layer.
    • Fixed Docker/Rust build and Flutter compilation failures blocking the team.

  3. 2023 — 2027

    BS Cyber Security

    FAST-NUCES, Islamabad

    Network Security, Ethical Hacking, Cryptography and Information Security Management.

Section V — WritingWriteups, explainers & build notes

The Lab Report

Forthcoming

  • Explainer · Adversarial MLYour adversarial defence is only as good as the attacker you tested it against
  • Build notes · GRC engineeringFour vendor APIs, one posture view

Notice to readers

Responsible disclosure

Found a vulnerability in something I've built, including this site? Email ayansubhan25@gmail.com with the details and steps to reproduce. I'll acknowledge within 72 hours, keep you updated while I fix it, and credit you if you'd like. Please don't access other people's data or degrade the service while testing.

Machine-readable policy: /.well-known/security.txt

Section VI — Letters & correspondenceThe desk is open

Put it in writing.

Hiring for a SOC, GRC or security-engineering role? Or have a problem that needs a dashboard, an assessment or a second look at a threat model? Write to me. I read everything.