Scroll to discover
FILE ALHUSENNAN · R
OPEN TO FULL-TIME ROLES
DATE ·
§ 00 Profile · Portfolio

Rayan Alhusennan.

Computer Science graduate of Imam Abdulrahman Bin Faisal University, focused on cybersecurity.

4.4/5 GPA
10 Certifications
2026 Graduated
eJPTv2 Security+ Certified
Begin reading
OPEN TO FULL-TIME · CYBERSECURITY
§ 01

Brief

A Computer Science graduate with hands-on internship experience in penetration testing and vulnerability assessment, seeking a full-time role where security, networking, and engineering meet real adversary problems.

I enjoy systems, how they're put together, how they behave under pressure, and what makes them break.

Cybersecurity is that curiosity turned into a career.

Alongside the academic track I hold the Security+ and eJPTv2, and took part in the KAUST Academy × NCA Advanced Cybersecurity Training Program.

§ 02

Credentials

Penetration testing INE

eJPTv2 eLearnSecurity Junior Penetration Tester

Practical, fully-hands-on certification covering network attacks, web application testing, host enumeration, and pivoting in a black-box environment.

PASSED Verify
Foundations CompTIA

Security+ CompTIA

Industry baseline for security operations, risk management, threat & vulnerability management, and security architecture concepts.

PASSED Verify
Specialization KAUST Academy × NCA

Advanced Cybersecurity Training Program

40-hour intensive training program conducted by KAUST Academy in partnership with the Saudi National Cybersecurity Authority.

Verify
Work Experience STC × Misk

Cybersecurity Incident Response Analysis Virtual Work Experience

Simulated incident response analyst role at STC, covering email analysis, incident reporting, cybersecurity policy development, and a security awareness campaign.

Verify
Professional Development McKinsey.org

McKinsey Forward

Covers structured problem solving, communicating for impact, adaptability and resilience, and working relationships.

Verify
Networking ISC²

Network and Communications Security

Verify
Systems Security ISC²

Systems and Application Security

Verify
Incident Response ISC²

Incident Response and Recovery

Verify
Secure Engineering UC Davis

Principles of Secure Coding

Verify
Operations ISC²

Security Principles and Operations

Verify
In progress INE

eCPPTv3 Certified Professional Penetration Tester

IN STUDY
§ 03

Featured · Case Study I

2025 – 2026 · Graduation Project

ThreatSense.

ThreatSense turns a single malware sample into a fully cited Incident Response Action Plan. Containment through hardening, every step traced to NIST or MITRE.

  • RoleSecurity engineer · Playbook author · ML lead · Architect · Designer
  • StatusLIVE

“Incident Response tools stop at identification. Nobody writes the response plan for you.
ThreatSense does.”

8h10min Analyst time per sample

The problem

An analyst opens VirusTotal, reads thirty sandbox actions and a tree of MITRE ATT&CK techniques, and stares at the screen. The artifacts are there. The next eight hours are still spent translating them into containment steps, eradication checks, recovery actions, and post-incident hardening, manually, against three different standards documents.

The rule engine, live

Pick a technique. The engine returns the matching D3FEND countermeasure, a one-line recommendation, and the standard it cites. SixThree of the thirty-five rules.

Observed technique
T1486 Data Encrypted for Impact Impact tactic · Ransomware
D3FEND countermeasure
D3-NI Network Isolation
Recommendation

Isolate the host immediately. Do not power it off; encryption keys may still be recoverable from memory.

Cited to CISA #StopRansomware Checklist §1
Technical details Pipeline, architecture & results

Build notes

Python, from sample to response.

Application & storage
Flask · SQLite
Evidence & analysis
VirusTotal · pefile · EMBER2024
Classification
LightGBM

Grounded in NIST SP 800-61r3 · SP 800-30 · CISA · NCA · ATT&CK · D3FEND

What it does, end to end

  1. 01
    Static analysis & ML. EMBER2024 cross-check, then a LightGBM verdict across six malware families.
  2. 02
    VirusTotal enrichment. Live AV verdicts, sandbox behaviours, and the ATT&CK techniques they triggered.
  3. 03
    Rule engine. 35 self-built deterministic rules map ATT&CK to D3FEND, each cited to NIST, CISA, or NCA.
  4. 04
    Threat scoring. Four signals fold into one severity tier; behaviour carries the most weight.
  5. 05
    IRAP generation. A phase-ordered action plan, rendered as HTML, JSON, and PDF.
  1. 01
    Static analysis & ML. Cross-checks the sample against a local EMBER2024 corpus, then runs its structural features through a trained LightGBM classifier to predict which of six malware families it belongs to.
  2. 02
    VirusTotal enrichment. Pulls live AV verdicts, the sample's observed behaviors inside commercial sandboxes, and the MITRE ATT&CK techniques those sandboxes flagged.
  3. 03
    Rule engine. A self-built deterministic 35-rule engine, authored from scratch, matches the observed techniques against a curated map of ATT&CK → D3FEND countermeasures, with every recommendation traced to NIST, CISA, or NCA guidance.
  4. 04
    Threat scoring. Four signals fold into one severity tier: what the file did, what family it belongs to, what other engines flagged, and how hard it tried to hide. Behavior carries the most weight, because what a sample does is more telling than what it claims to be.
  5. 05
    IRAP generation. A four-phase action plan (containment, eradication, recovery, hardening) covering classification, techniques, IOCs, and citations. Generated once and shaped for three readers: an HTML view the analyst works the incident from, a JSON payload for downstream tooling, and a printable PDF for the post-incident report.

Architecture

ThreatSense end-to-end pipeline. Left: how a sample moves through the system, with the typed data passing between each stage. Right: the reasoning behind each layer.

The system

  1. 1ingest

    A sample comes in.

    A known fingerprint, or the file itself.

    sample { sha256, bytes? }

  2. 2analyze · fan-out

    Three independent lenses look at it.

    • lens a

      Cross-check

      features → hit | miss

      EMBER2024 corpus

    • lens b

      Take apart

      bytes → features[ ]

      pefile

    • lens c

      Watch it

      bytes → behaviours[ ]

      VirusTotal sandbox

    { hit, features[ ], behaviours[ ] }

  3. 3fuse · classify

    One verdict, with its evidence.

    What it is · what it did · how confident we are

    verdict { label, evidence[ ], conf }

  4. determinism line

    4map · 35-rule engine · rule.yaml

    A deterministic rule engine writes the response.

    Each observed behaviour → a published countermeasure → a recommendation cited to NIST, CISA, or MITRE

    actions[ ] { id, control, citation }

  5. 5render · artifacts

    A response plan you can act on.

    Contain · Eradicate · Recover · Harden

    irap.html · irap.json · irap.pdf

legend

  • data flow
  • determinism line
  • deterministic only
  • parallel lens
ThreatSense end-to-end pipeline: how a sample moves through the system, with the typed data passing between each stage.

By the numbers

35 Deterministic ATT&CK → D3FEND rules
2,568 EMBER2024 feature dimensions
93.25% LightGBM accuracy · Win32 subset
0.78 Macro F1 across 6 families
4 Graceful degradation modes
8h10m Analyst time per sample

Design choices I'd defend in front of a panel

  • No LLMs anywhere in the pipeline. A hallucinated citation is not defensible in front of an auditor.
  • ML as a supporting actor. LightGBM can say which features drove the verdict; black-box accuracy cannot.
  • Four graceful degradation modes. Missing evidence lowers confidence; it is never invented.
  • D3FEND IDs verified three times. Five corrections applied during spec-locking.
  • No LLMs anywhere in the pipeline. The 35 rules are fixed and the citations are real codes. A generative model would draft the same incident two different ways and would occasionally fabricate a NIST or D3FEND ID that resolves to nothing. An IRAP has to be defensible in front of an auditor; a hallucinated one isn't.
  • ML as a supporting actor, not the thesis. A deep-net classifier would likely top the accuracy chart, but LightGBM was chosen because it can tell you which features drove the verdict. That explanation feeds straight into the IRAP's reasoning. Black-box accuracy can't.
  • Four graceful degradation modes. The pipeline draws from several data sources, and some days one of them is unavailable. Rather than failing silently or inventing what it can't see, the system drops to a lower confidence tier, tells the analyst exactly what evidence is missing, and refuses to fabricate the rest.
  • D3FEND IDs verified three times. Five corrections were applied during spec-locking. Citations that look right but resolve wrong are worse than no citations.
§ 04

Featured · Case Study II

2026 · Claude Code Hackathon

Stale.

A multi-agent auditor for university CS courses. Drop in the slides and Stale flags what's gone stale, each fix backed by a real citation. Then pick a target role, and it shows what that job needs that you were never taught.

“Stale keeps your tools updated and your knife sharp, in sync with the industry and how developers really work, before you walk into that interview. Not after it.”

The problem

Universities can't keep pace with how fast technology ages. By the time we graduate, a quiet fraction of what we learned has been replaced, deprecated, or flagged as insecure or wrong, and nobody told us until we walk into that job interview.

Stale closes that gap one course at a time, and frames the result as career-relevant evidence against the role we're actually applying for.

Universities can't keep pace with how fast technology ages. By the time we graduate, a quiet fraction of what we learned has been replaced, deprecated, or flagged as insecure or wrong, and nobody told us until we walk into that job interview.

Stale reads the slides, flags what's gone stale, fact-checks every flag against the real spec or advisory, and tells us what should replace it. A second pass maps the whole course against a target job role.

A real finding

A search for one student shows every student.

SQL injection · Lecture 6 · Database & Content Providers · pages 9, 22

A student types this in the roll number box: ' OR '1'='1

Slide code Unsafe
Cursor c = db.rawQuery(
  "SELECT * FROM student WHERE rollno='"
    + editRollno.getText() + "'",
  null);

SQL injection risk.This input changes the search and shows every student's record.

Corrected code Safe
Cursor c = db.rawQuery(
  "SELECT * FROM student WHERE rollno = ?",
  new String[]{rollno});

SQL injection prevented.The search looks for that exact text and finds no student.

Technical details Stack, sources & architecture

Build notes

Python, with a multi-agent audit.

Web interface
FastAPI · Jinja2
Agent orchestration
Anthropic Managed Agents API

Primary sources JLS · Javadoc · JEPs · PEPs · RFCs · NIST · MDN

Architecture

Stale audit and analysis pipeline. Left: how a slide deck moves through the system, with the typed data passing between each stage. Right: the reasoning behind each layer.

The system

  1. 1input

    A course comes in.

    Its slide decks · plus the role you're chasing

    course { decks[ ], role }

  2. 2first pass · wide net

    Cast a wide net.

    One AI reads every slide and lists anything that might be outdated. No judgment calls.

    candidates[ ] { slide, claim }

  3. 3second pass · careful scrutiny

    Weigh each candidate, one at a time.

    A more careful AI flags or skips each one, but a flag has to come back with a real source.

    flags[ ] { claim, citation }

  4. determinism line

    4a deterministic layer · no AI here

    Fact-check every claim.

    A plain program re-downloads each cited source and confirms the quoted text is really there.

    findings[ ] { claim, source, verified }

  5. 5two lenses

    Same verified findings, two lenses.

    • lens a · role-aware

      Market-fit

      what the role asks for, vs. what the courses taught

      role × findings[ ] → gaps[ ]

      managed agent

    • lens b · prescription

      Topics

      a ranked list of what to add next, in order

      findings[ ] → ranked[ ]

      managed agent

    report { findings, marketFit, topics }

  6. 6report

    A browsable report.

    Findings · Market-fit · Topics, each as its own tab

legend

  • data flow
  • determinism line
  • deterministic only
  • parallel lens
Stale audit and analysis pipeline: how a slide deck moves through the system, with the typed data passing between each stage.
§ 05

Capabilities

Tools, frameworks, practice

Offensive & reconnaissance

  • Metasploit
  • Nmap
  • Burp Suite
  • Wireshark
  • TCP / IP

Analysis & forensics

  • Oledump
  • Static PE analysis · pefile
  • Log analysis · SIEM (Splunk)
  • Malware family classification
  • IOC extraction

Engineering

  • Python
  • Java
  • SQL
  • Web application stack · Flask, FastAPI
  • Artificial Intelligence · ML

Standards & frameworks

  • NIST SP 800-61 Rev. 3
  • NIST SP 800-30
  • MITRE ATT&CK · D3FEND
  • CISA advisories
  • NCA controls

Practice

  • Incident response & threat triage
  • Technical reporting & documentation
  • Security architecture & design
  • Root cause analysis
§ 06

Experience & Education

June 2026 – Aug 2026

Khalifa A. Algosaibi Investments

Cybersecurity Intern
  • Offensive Security: Exploited a CVSS 8.8 CISA KEV during an authorized endpoint penetration test, capturing NTLMv2 credential material with Kali Linux and Metasploit.
  • Custom Tooling & AI: Built EventEyes, a Windows security assessment framework analyzing event logs and system configurations to generate an HTML dashboard; surfaced six validated findings and later evolved it into Verifact, a public AI-agent skill for Codex and Claude Code.
  • Attack Surface Management: Assessed KAI's external exposure with CTM360 across DNS, SSL/TLS, exposed services, and corporate accounts appearing in breach datasets; delivered prioritized remediation recommendations to the Group IT Manager.
  • Security Architecture & Posture: Built two iterations of KAI's cybersecurity risk register, designed a VLAN-segmented network with a default-deny firewall baseline, and audited Windows endpoints against CIS Benchmarks and Microsoft Security Baselines.
  • Operations & Delivery: Produced management reports, remediation plans, and security case studies while handling approximately 50 IT support tickets through iTop.
Aug 2021 – June 2026

Bachelor of Computer Science

Imam Abdulrahman Bin Faisal University

GPA 4.4 / 5 · Second Honours Degree

Jan 2022 – Present

King Abdulaziz Center for World Culture · Ithra, by Saudi Aramco

Volunteer · long-term

Multi-year volunteer engagement with one of Saudi Arabia's flagship cultural institutions.

Aug 2023 – Aug 2025

Cybersecurity Club

Imam Abdulrahman Bin Faisal University · Administrative

Administrative role across two academic years, supporting club operations and event coordination.

Jan 2024 – Aug 2025

Computer Science & Information Technology Club

Imam Abdulrahman Bin Faisal University · Administrative, then crowd organizer

Started in an administrative role, then moved into crowd organizing for club events.

Jan 2024 – June 2024

Google Developer Student Club

Imam Abdulrahman Bin Faisal University · Finance lead

Managed the club's budget and ran spending for the year's events.

June 2024

Hajj Season · 1445 AH

Saudi Arabian Boy Scouts Association · Crowd organizer

Crowd organizing during one of the largest annual gatherings in the world.

Arabic Native
·
English Professional working proficiency
§ 07

Contact

Open to full-time roles in cybersecurity: SOC, offensive security, security engineering.

Email
CV LinkedIn GitHub