Available for new rolesRemote from Lebanon · Open to relocation
Elia El Khoury
I build the automation behind 30+ client environments.
Security automation and DevOps engineer, five years building production automation infrastructure. Cortex XSOAR, Python and Docker: 50+ playbooks, the Python automations underneath them, and a distributed attack surface platform that tracks 500+ external assets across the client estate.
Built at Coordinates as a Cortex XSOAR playbook with Python automations behind each node. The production flow also covers impersonation, spoofing and sender reputation, and writes a structured verdict back to the incident. Vendor names and scoring thresholds withheld.
Lower MTTR
40%
SIEM, EDR and WAF orchestration
XSOAR playbooks
50+
30+ client environments
External assets
500+
Continuously monitored
Faster reporting
60%
Attack surface platform
About
What the work actually looks like.
Beirut time
Based
Lebanon, working remotely
Employer
Coordinates, Dubai UAE
Education
B.Eng. Computer & Telecommunications Engineering
Languages
English · French · Arabic
Open to
Full time, consulting, relocation
I work remotely from Lebanon for a Dubai security firm, across a client estate of 30+ environments. Most days that means a playbook that broke overnight, an integration whose vendor quietly changed a response schema, or a container that needs to stop being a pet.
The attack surface platform started because nobody could answer how many external assets we actually had. It is a remote controller, a central server and a fleet of distributed sensors, written in Python and packaged so a new client environment comes up in minutes instead of an afternoon.
Since 2024 I have had LLMs doing first-pass triage and threat intel enrichment. The limits matter: the model enriches and recommends, it does not contain. Anything that touches a production host still goes through a deterministic playbook with an explicit allowlist, because a hallucinated verdict that isolates a domain controller is a worse outage than the alert it was chasing.
Build it once
Containerized stacks so every environment runs the same build, not a variation of it.
Measure it
Every automation ships with the number it moved: MTTR, toil, reporting time.
Keep humans in charge
Models enrich and recommend. Containment stays deterministic and allowlisted.
Experience
Five years, three teams, one thing in common.
Every role has ended with something automated that used to be done by hand. The numbers below were measured inside the environments that run this work.
CurrentSep 2022 - Present
Coordinates
Dubai, UAE · Remote
Cybersecurity & Automation Engineer
Own the automation layer across 30+ client environments, from playbook code to the containers it ships in.
Architected and built an enterprise attack surface platform in Python from scratch: distributed sensor and controller architecture, centralized server, MongoDB backend. Tracks 500+ external assets across 30+ client environments with automated vulnerability identification and remediation workflows.
Developed 50+ Cortex XSOAR playbooks and the Python automations behind them, orchestrating SIEM, EDR and WAF workflows. MTTR down 40%, manual workload down 35%, triage cut from hours to minutes.
Containerized the full sensor stack with Docker, standardizing builds and cutting deployment time from hours to minutes across every client environment.
Engineered an end-to-end phishing inspection flow covering malicious attachments, redirect chains, malicious QR codes, homoglyphs, impersonation and spoofing, consolidated into one structured triage verdict.
Integrated agentic AI into SOC operations for detection, triage and response. LLM correlation and intel enrichment cut analyst intervention by roughly 30%.
Built a passive asset discovery workflow comparing expected against observed coverage per environment to surface missing assets, identity gaps and absent log sources, using SIEM queries and EDR telemetry with zero active scan noise.
Automated scheduling and execution of 20+ offensive simulations across deployed sensors, giving clients continuous hands-off visibility into external exposure.
Built and maintained REST integrations with third-party security tools to unify log ingestion, detection enrichment and remediation across client environments.
Partnered with the DevSecOps team to embed security checks into delivery pipelines, reducing false positives and widening detection coverage.
Built the telemetry stack for water delivery fleets, from the sensor board to the app the driver reads.
Built an IoT flowmeter system tracking water volumes from trucks to tanks, with Arduino Mega sensing, NodeMCU connectivity and a Flutter app for live field readings.
Added a NodeMCU-hosted web interface as a fallback for manual control, and maintained the platform through several feature and bug-fix cycles.
ArduinoNodeMCUFlutterEmbedded C++
Oct 2021 - Jan 2022
Po.Tech Consulting
Mansourieh, Lebanon
Cybersecurity Intern
First security role. Learned that the fastest way through repetitive investigation work is to write the script.
Ran 15+ OSINT investigations and wrote the Python tooling that automated passive recon, cutting manual research time in half.
Extended Darkivor, the internal OSINT framework, with new collection techniques and performance improvements.
PythonOSINTRecon automation
Selected work
Systems I built, shipped and still maintain.
Client work is described without vendor names, thresholds or environment detail. The personal projects are open to anyone: one site you can visit and two builds you can install.
FlagshipIn production2022 - Present
Attack surface management platform
Coordinates
A remote controller, a central server and a fleet of distributed sensors, written in Python and backed by MongoDB. It watches the external assets of 30+ client environments, schedules its own scanning and offensive simulation, and files what it finds as remediation work rather than a PDF nobody opens. Docker packaging took a new environment from an afternoon down to minutes.
PythonDockerMongoDBDistributed sensorsREST APIs
500+Assets tracked
30+Client environments
20+Scheduled simulations
60%Faster reporting
Production2023 - Present
Phishing inspection flow
Coordinates
Automated triage for inbound mail. Detonates attachments, unwinds redirect chains, decodes QR codes for quishing, and checks homoglyphs, impersonation and spoofing. Everything collapses into one structured verdict written back to the incident, so an analyst reads a decision instead of six vendor tabs. Diagrammed at the top of this page.
Cortex XSOARPythonEmail security
Production2023 - Present
Passive asset discovery
Coordinates
Compares what an environment should look like against what its telemetry actually shows, then surfaces the gap: assets nobody registered, identities with no owner, log sources that quietly stopped reporting. Runs off SIEM queries and EDR telemetry, so it finds things without putting a single packet on the wire.
SIEMEDRInventory
Live2026 - Present
Noblo, restaurant menu platform
Built with a collaborator
A B2B SaaS platform sold to restaurants: they publish their menu, diners browse it. Multi-tenant by design, Spring Boot on Java 25 with PostgreSQL behind a Next.js App Router frontend deployed to Cloudflare. Every business gets a public storefront on its own slug, plus a dashboard where menus nest from company to category to item and reorder by drag and drop. Images on S3, JWT auth, an approval flow that gates new tenants, and an audit log that snapshots readable labels at write time so an entry still makes sense after the thing it describes is renamed. CI/CD runs the test suite, builds the container and ships backend and frontend on merge.
A messenger I build, run and keep running, now supporting 50+ concurrent users. Flutter client, Spring Boot and MongoDB server, all self-hosted from Docker Compose. Hybrid RSA and AES with per-conversation keys, handled in a background isolate so the interface never stalls on key exchange. WebRTC voice and video, one-to-one and group mesh up to six, relayed through my own coturn when both ends sit behind NAT. Disappearing messages, view-once media, encrypted backups and PIN identity recovery. Ships as a signed APK with an in-app updater, behind 116 server tests. CI/CD runs those tests, signs the release build and rolls the Docker Compose stack forward on merge.
Client management, scheduling and billing for independent practitioners. Node.js, Express and MongoDB behind an EJS admin dashboard, with a Flutter app for the practitioners themselves. Multi-tenant, so every query is scoped by owner. Recurring bookings with live conflict detection that offers the nearest free slot, and a per-client ledger where payments nest under the charge they settle. Money is integer cents everywhere, because floats and invoices do not mix. TOTP two-factor with the secret encrypted at rest, exponential login lockout, single-use emailed resets. A CI/CD pipeline builds the image, signs the APK and deploys on merge.
Turns one text prompt into a multi-scene animation. A parsing pipeline segments the script into logical scenes, then renders a five-second clip per scene with Stable Video Diffusion and stitches the result, with inference tuned for consistency across concurrent scene generations.
PythonStable Video DiffusionComputer vision
Shipped2022
Water truck flow meter
SAWA Group
IoT metering for water delivery. Arduino Mega does the sensing, NodeMCU the connectivity, and a Flutter app shows live readings in the field. The NodeMCU also serves its own page, so a driver with no app installed can still read the meter.
ArduinoNodeMCUFlutter
Shipped2021
Face mask detector
Michel Daher Social Foundation
Raspberry Pi vision system wired into door access during the pandemic. 90%+ detection accuracy on 100+ daily entries, with OpenCV running on the device and no cloud round-trip, because the door could not wait on a network that was not always there.
Almost everything here runs in a client environment or in a product I maintain. The rest comes from work I built end-to-end. If it is on this page, I can talk through a decision I made with it.
SOC automation, XSOAR and AI builds, or standing up an attack surface program from nothing. Remote from Lebanon, open to relocation, and happy to walk through any number on this page.
