Skip to content
View rummanaqeel's full-sized avatar

Block or report rummanaqeel

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
rummanaqeel/README.md

Muhammad Rumman Aqeel

Security Operations · Cloud Security · Vulnerability Management
Lahore, Pakistan · PKT (UTC+5) · open to UAE / GCC relocation or fully remote

LinkedIn Email Open to work

About

I build and break defensive infrastructure to learn how it actually fails. My labs are AWS and Kubernetes environments where I deploy the control, attack it, catch the attack, then document what the detection missed.

Currently running live security administration for a small business — MFA, credential management, and SPF/DKIM/DMARC email authentication on a production domain — while preparing for CompTIA Security+.

Security Portfolio

Project What it demonstrates Stack
Kubernetes Runtime Threat Detection Caught 4 live container attacks with eBPF syscall monitoring, mapped to MITRE ATT&CK T1059.004 and T1003.008. Zero-trust NetworkPolicy, least-privilege RBAC, CIS audit across 124 controls. Falco Trivy kube-bench K3s RBAC
AWS Vulnerability Lifecycle Closed 100% of CRITICAL and HIGH findings on EC2; documented the 2 residual microcode CVEs as accepted risk with justification. Eliminated SSH entirely in favour of SSM Session Manager. Amazon Inspector SSM IAM ISO 27001
Log Parser & SOC Triage Simulator Five detections — brute force, off-hours access, sudo misuse, cron persistence, HTTP enumeration — emitting severity-ranked alerts in SIEM field schema. Stdlib Python, no dependencies. Python Detection Engineering MITRE ATT&CK

Toolchain

Cloud & Infrastructure

AWS EC2 IAM Kubernetes Terraform Linux

Detection & Response

Elastic Wazuh Falco Splunk Wireshark MITRE

Vulnerability & Compliance

Trivy Inspector CIS ISO27001 PCIDSS

Languages & Tooling

Python Bash Git

Certifications

Google Elastic SecurityPlus

Open to SOC Analyst, Cloud Security, and Vulnerability Management roles — UAE / GCC relocation or fully remote.

Popular repositories Loading

  1. vuln-scan-lab vuln-scan-lab Public

    Vulnerability reconnaissance lab – discovering HTTP/HTTPS exposures with Masscan & Nmap

    1

  2. k8s-security-lab k8s-security-lab Public

    Kubernetes Security Hardening & Runtime Threat Detection Lab - AWS EC2, Falco, Trivy, kube-bench

    1

  3. cloudsentinel cloudsentinel Public

    HCL 1

  4. SOC-Lab-Simulation-Project-01 SOC-Lab-Simulation-Project-01 Public

    Beginner-level SOC simulation: log analysis, threat detection & incident report.

  5. myrepo myrepo Public

    Testing

  6. LogParserProject LogParserProject Public

    Python CLI tool to parse logs and detect suspicious activity with simulated alerts.

    Python