Cybersecurity Analyst/Network Administrator/Cloud & AI Security
I build secure networks, detect and contain threats with Wazuh, and explore where cloud, AI, and quantum-enhanced security meet — backed by hands-on red-team reconnaissance and SOC operations.
A hands-on engineer across network operations, offensive security, and threat detection.
I'm Hafiz Asim Shayan Khan, a BS Computer Science graduate from Abasyn University, Peshawar, with a concentration in Cybersecurity & Artificial Intelligence. My work sits where network security, offensive testing, and threat detection meet.
On the offensive side, I've run full red-team engagements — OSINT, reconnaissance, Active Directory attacks, phishing, and endpoint evasion. On the defensive side, I now work as a Network Administrator operating the Wazuh XDR platform, writing custom detection rules and automated active-response actions to catch and contain threats in real time.
Beyond that, I've completed 15+ hands-on cloud and AI labs across AWS and Azure — from KMS encryption and automated incident remediation to SageMaker ML pipelines and Azure AI Foundry — and I build AI-assisted security systems, always validating results honestly rather than trusting a suspiciously perfect metric.
§ 02Experience
Where I've operated.
From breaking into labs on the red team to defending live infrastructure with Wazuh.
Network Administrator · Abasyn University
Jun 2026 — Present
Blue Team · SOC · Peshawar, Pakistan
Manage the university's network infrastructure — configuring and maintaining switches and Wi-Fi access points, monitoring performance, and troubleshooting connectivity issues across campus.
Deployed the Wazuh XDR platform and write custom detection rules for threat detection and active response, tailored to the university's requirements — with proper documentation of every rule and workflow.
Automate routine network and configuration tasks using AI for faster, consistent, and more efficient deployments.
Triage alerts, correlate logs, and map detections to MITRE ATT&CK to prioritise investigation and response.
Configure VPN and access controls and provide day-to-day network and system support for end users.
Red Team Intern · Cyberster
Mar 2026 — May 2026
Offensive Security · Remote
Ran end-to-end penetration tests across Linux, Windows, and Active Directory labs — passive OSINT through to Domain-Admin compromise.
Performed OSINT and subdomain enumeration with Subfinder, Assetfinder, and OWASP Amass — 352 subdomains discovered, 21 live hosts validated via httpx & Gowitness.
Executed AD attacks — AS-REP Roasting, Kerberoasting, LLMNR/NBT-NS poisoning, GPO ACL abuse — reaching NT AUTHORITY\SYSTEM on domain controllers.
Built phishing campaigns with GoPhish and Havoc C2; applied AMSI bypass, LOLBAS, and payload obfuscation to evade endpoint defences in controlled labs.
Documented every finding in professional pentest reports mapped to CVSS and MITRE ATT&CK.
§ 03Featured Work & Research
Systems I've built.
AI-assisted defence, threat-intelligence engineering, and cloud & network security.
01 AI · Threat Intelligence · MITRE ATT&CK
ThreatFusion AI — CTI Fusion Pipeline
An end-to-end defensive cyber-threat-intelligence pipeline: it ingests CTI reporting, extracts indicators of compromise, proposes MITRE ATT&CK mappings with a supervised classifier, scores risk, assembles a knowledge graph, and exports STIX 2.1 bundles with analyst-ready reports.
The valuable findingAn honest evaluation exposed a data-leakage artefact behind a "perfect" 0.90 F1 — held-out template testing collapsed it to 0.27, so the detection backlog was rebuilt on analyst-validated labels instead of model output.
A supervised deep-learning detector that classifies enterprise network flows into benign traffic plus five attack behaviours — reconnaissance, brute force, web attack, exfiltration, and botnet C2. Covers the full AI-SOC lifecycle: leakage-controlled preprocessing, class-imbalance handling, explainability, and a streaming live-detection demo.
Endpoint coverageA complementary GRU host-log model extends detection from network flows to Linux authentication sessions — flagging brute force, privilege misuse, and persistence.
0.9994Macro-F1
30KFlows classified
43Incidents auto-raised
PythonTensorFlowGRUKali LinuxColab GPU
03 Cloud · High Availability
AWS Aurora Multi-AZ Failover
A production-grade dual-AZ VPC hosting an Aurora MySQL 8.0 Multi-AZ cluster; validated zero-downtime failover with automatic role promotion in under 60 seconds and diagnosed a security-group misconfiguration along the way.
AWS EC2RDS / AuroraVPCMulti-AZ
04 Research · Quantum ML
QSVM vs Classical SVM — FYP
Final-year research comparing a Quantum SVM against a Classical SVM for email-spam detection — applying PCA for qubit constraints and probing where AI reliability breaks down in threat-detection contexts.
PythonQSVMPCAScikit-Learn
05 Automation · Recon
Network Scanning & Asset Discovery
A Python auditing tool that sweeps CIDR subnets with SYN stealth scanning, detects open ports, service versions, and OS fingerprints, then writes clean inventory reports for asset management and compliance.
PythonNmapSYN ScanOS Fingerprinting
§ 04Hands-on Labs
Cloud & AI, hands on.
Practical lab tracks across AWS and Azure — security, machine learning, and generative AI.
🔐
AWS Cloud Security
AWS
Secured S3 with resource-based & IAM policies, encrypted data at rest with AWS KMS (SSE-KMS, EBS), monitored activity with CloudTrail + CloudWatch, and auto-remediated security-group drift using AWS Config + Lambda.
Deployed Azure Firewall, enforced least privilege with Privileged Identity Management (PIM), implemented directory synchronization, and secured containers across Azure Container Registry (ACR) and Azure Kubernetes Service (AKS).
An end-to-end ML workflow on Amazon SageMaker: notebook instances, data ingestion & EDA, feature encoding, model training & deployment, performance metrics, and hyperparameter tuning — culminating in an airplane-delay prediction challenge.
Built a generative-AI project in Microsoft Azure AI Foundry: deployed and tested a GPT-4.1 model, worked with project and model endpoints, and integrated the AI Foundry toolkit into Visual Studio Code.
Azure AI FoundryGPT-4.1GenAIModel DeploymentVS Code
§ 05Capabilities
The toolkit.
Attack, defence, networking, cloud, and the AI/ML that ties them together.
AWS EC2VPCIAMS3RDS / AuroraKMSCloudTrailCloudWatchAWS ConfigLambdaAzure FirewallEntra ID / PIMACRAKSDocker
🧠
AI / Machine Learning
Detection · GenAI
PythonScikit-LearnTensorFlowPandasNumPyAmazon SageMakerAzure AI FoundryGPT-4.1Isolation ForestSVM / QSVMGRUPCA
⌘
Systems & Tools
Labs · Scripting
Kali LinuxUbuntuWindows ServerGNS3Packet TracerVMwareVirtualBoxHyper-VGitSSHJava
§ 06Leadership & People
Beyond the terminal.
Representing communities, mentoring peers, and the professional skills that make the technical work land.
🎖️
Cyberster Ambassador
Cyberster Security Academy CURRENT
Represent and advocate for Cyberster — promoting its offensive-security training, championing the program within the student and security community, and supporting aspiring red-teamers as they get started.
🗣️
Class Representative (CR)
Abasyn University · 2022 – 2026
Elected representative for the BS Computer Science cohort across the full four-year degree — the liaison between students and faculty, coordinating academics, communicating concerns, and helping resolve issues throughout the program.
Vendor and industry credentials across networking, cloud, and security.
CCNA
Cisco Certified Network Associate
Cisco · 2026
SAA
AWS Solutions Architect – Associate
Amazon Web Services · 2026
CCSP
Certified Cloud Security Professional
Pearson / Coursera · 2025
SEC
IT Security: Defence Against the Digital Dark Arts
Google / Coursera · 2025
PY
Python for Active Defence
Infosec / Coursera · 2025
DIR
Detection & Incident Response
Google / Coursera · 2025
NMA
Network Monitoring & Analysis
Google / Coursera · 2025
SYS
System Administration & IT Infrastructure
Google / Coursera · 2025
FND
Foundations of Cybersecurity
Google / Coursera · 2025
NAV
Cisco Network Administration
NAVTTC · 2025
AVAILABLE FOR SOC · RED TEAM · NETWORK ROLES
Let's build something secure.
Open to opportunities in security operations, threat detection, penetration testing, cloud security, and network engineering. The fastest way to reach me is email or LinkedIn.
