I automate security operations. For the past four years I've been at Coordinates, a security company in Dubai, writing Cortex XSOAR playbooks, Python integrations and the Docker setup they run on. I also built our attack surface platform, which now watches 500+ external assets per client across 30+ client environments.
I work remotely from Lebanon for Coordinates, a security company based in Dubai. We handle security operations for 30+ clients, and I'm responsible for the automation behind it: the playbooks that process alerts, the integrations between security tools, and the containers all of it runs in.
A normal week might mean fixing a playbook that broke overnight, updating an integration after a vendor changed their API, or moving another service into Docker so it deploys the same way everywhere.
The project I'm proudest of is our attack surface platform. It started because nobody could tell how many external assets our clients actually had. I built it in Python as a central server, a controller and a set of distributed sensors. It now tracks 500+ assets per client, and setting up a new client takes minutes instead of an afternoon.
Since 2024 I've also been using LLMs in triage, mostly for enrichment and a first read of each alert. They don't get to act on their own, though. Anything that touches a production machine still goes through a fixed playbook with an allowlist.
Based in
Lebanon, working remotely
Current job
Coordinates, Dubai
Looking for
Security automation, SOAR, DevOps or DevSecOps roles
Open to
Full-time, contract, relocation
Education
B.Eng. Computer & Telecom Engineering, Antonine University
Languages
English, French, Arabic
Experience
Where I've worked
Sep 2022 - Present
Coordinates
Dubai, UAE · Remote
Cybersecurity & Automation Engineer
I own the automation for 30+ client environments, from the playbook code to the containers it runs in.
Built our attack surface management (ASM) platform from scratch in Python: distributed sensors, a controller, a central server and MongoDB. It tracks 500+ external assets per client, runs 20+ scheduled offensive simulations, and turns findings into remediation tasks.
Wrote 50+ Cortex XSOAR playbooks and the Python behind them, connecting SIEM, EDR and WAF tools. MTTR dropped 40%, manual work dropped 35%, and triage went from hours to minutes.
Packaged the whole sensor stack in Docker. A new client deployment went from hours to minutes, and every environment runs the same build.
Built an automated phishing check that looks at attachments, redirect chains, QR codes, lookalike domains, impersonation and spoofing, then writes one clear verdict to the incident.
Added LLM enrichment and correlation to SOC triage, which cut analyst intervention by about 30%.
Set up passive asset discovery that compares expected and actual coverage using SIEM and EDR data. It finds missing assets and silent log sources without any active scanning.
Built REST integrations with third-party security tools, and worked with the DevSecOps team to add security checks to delivery pipelines.
Built a water metering system for delivery trucks, from the sensor board to the mobile app.
Built an IoT flow meter that tracks water volume from truck to tank, using an Arduino Mega for sensing, a NodeMCU for connectivity and a Flutter app for live readings.
Added a small web page served by the NodeMCU as a backup, so drivers could read and control the meter without the app.
ArduinoNodeMCUFlutterC++
Oct 2021 - Jan 2022
Po.Tech Consulting
Mansourieh, Lebanon
Cybersecurity Intern
My first security job. Mostly OSINT, and where I started writing scripts for the repetitive parts.
Ran 15+ OSINT investigations and wrote Python scripts for passive recon, which cut manual research time in half.
Added new collection techniques and performance fixes to Darkivor, the company's internal OSINT framework.
PythonOSINT
Projects
Things I've built
The first three are from my job, so client names and details are left out. The rest are side projects. Noblo is live, and EncChat and Calcendar can be installed on Android.
In productionCoordinates · 2022 - Present
Attack surface management platform
A Python platform made of a remote controller, a central server and distributed sensors, with MongoDB for storage. It watches the external assets of 30+ client environments, runs scheduled scans and offensive simulations, and turns what it finds into remediation tasks instead of a report nobody reads. Packaging it in Docker cut new client setup from an afternoon to a few minutes.
PythonDockerMongoDBREST APIs
Assets per client
500+
Client environments
30+
Scheduled simulations
20+
Faster reporting
60%
In productionCoordinates · 2023 - Present
Phishing check flow
Automated triage for incoming email. It opens attachments in a sandbox, follows redirect chains, decodes QR codes and checks for lookalike domains, impersonation and spoofing. The result is one verdict on the incident, so the analyst doesn't have to jump between six tools to reach it.
Cortex XSOARPythonEmail security
Phishing check flow, simplified
1.
INTAKE
A reported or flagged email comes in.
2.
EXTRACT
Pull out URLs, attachments and QR codes.
3.
INSPECT
In parallel: detonate attachments, unwind redirect chains, decode QR codes and check for homoglyphs.
4.
SCORE
Combine the findings into one verdict.
5.
CONTAIN
If malicious: act through EDR and WAF.
6.
RELEASE
If clean: close the incident and log it.
Each step is part of the XSOAR playbook, backed by Python. The real flow also checks impersonation, spoofing and sender reputation. Vendor names and scoring thresholds are left out.
In production2023 - Present
Passive asset discovery
Coordinates
Compares what should be in a client environment with what the SIEM and EDR data actually show. It flags unregistered assets, accounts with no owner and log sources that stopped sending. Everything is passive, so nothing gets scanned.
SIEMEDRAsset inventory
Live2026 - Present
Noblo
Side project, with a collaborator
A menu platform for restaurants. Each business gets its own public page and a dashboard to manage menus with drag and drop. Spring Boot (Java 25) and PostgreSQL on the backend, Next.js on Cloudflare for the frontend, images on S3. Also has JWT auth, an approval step for new businesses, an audit log, and CI/CD that tests and deploys on every merge.
An end-to-end encrypted messenger that started as a university project. I still build and host it myself, and it supports 50+ concurrent users. Flutter app, Spring Boot and MongoDB backend, all running on Docker Compose. Messages use hybrid RSA and AES encryption with a key per conversation. It also has WebRTC voice and video calls, disappearing messages and encrypted backups. Releases are signed APKs, shipped through CI/CD after 116 server tests pass.
Scheduling and billing for independent practitioners. Node.js, Express and MongoDB with a web admin dashboard, plus a Flutter app. It handles recurring bookings, catches conflicts and suggests the next free slot, and keeps a ledger per client. Money is stored in integer cents to avoid rounding errors. Login has TOTP two-factor and locks out after repeated failures.
Takes a written prompt, splits it into scenes, generates a five-second clip for each scene with Stable Video Diffusion, and joins them into one video. Most of the work went into keeping the scenes consistent with each other.
PythonStable Video Diffusion
Shipped2022
Water truck flow meter
SAWA Group
IoT metering for water delivery trucks. An Arduino Mega reads the sensor, a NodeMCU handles connectivity, and a Flutter app shows live readings. The NodeMCU also serves a small web page, so the meter can be read without the app.
ArduinoNodeMCUFlutter
Shipped2021
Face mask detector
Michel Daher Social Foundation
A Raspberry Pi camera connected to door access during COVID. OpenCV runs on the device itself, with 90%+ accuracy over 100+ entries a day, and it keeps working when the internet is down.
I'm looking for security automation, SOAR or DevOps roles, remote or with relocation. If you have a role in mind or just want to ask about something on this page, email is the quickest way to reach me.
