DevOps Engineer building production-grade infrastructure with security baked in from day one. Final-year BSCS @ SZABIST Karachi · AWS Certified · Google Cybersecurity Certified Open to DevOps / DevSecOps roles in Karachi 🇵🇰 and remote opportunities in 🇩🇪 🇨🇦
Production-grade DevSecOps platform deployed on AWS EC2 Frankfurt with full infrastructure automation, automated security scanning on every commit, and real-time observability.
| Layer | Implementation |
|---|---|
| Cloud | AWS EC2 t3.micro · eu-central-1 Frankfurt · VPC + subnets + IGW + security groups |
| IaC | Terraform — entire AWS stack provisioned in a single command |
| CI/CD | GitHub Actions: flake8 → Bandit SAST → Docker build → Trivy CVE scan → smoke test |
| Security | Non-root Docker user (sentryuser) · least-privilege enforcement · security headers |
| Proxy | NGINX — 10 req/s rate limiting · X-Frame-Options · X-Content-Type-Options · server_tokens off |
| Observability | Prometheus scraping /metrics every 15s → auto-provisioned Grafana dashboards |
| Registry | Docker image published to GHCR · 30s auto-refresh dashboard |
Real production bugs solved: non-root Docker exit code 7 · Terraform region timeout (Bahrain → Frankfurt) · CI smoke test path mismatch · Grafana datasource schema error — all resolved independently.
The only mobile-first IoT IDS powered by an unsupervised ML autoencoder ensemble — hardware-validated against real TP-Link Tapo C200 cameras including Mirai botnet simulation.
Architecture — 4-Tier System:
[React Native App] ←→ WebSocket/REST ←→ [FastAPI Backend] ←→ [KitNET IDS Engine] ←→ [PostgreSQL / NeonDB]
↑ ↑
Mobile alerts Paramiko SSH → tcpdump → SFTP PCAP → Scapy → 52 features
sub-50ms latency (Kali Linux on VMnet8 / eth1 hotspot)
ML Engine — KitNET:
- Ensemble of autoencoders (Mirsky et al. NDSS 2018) — unsupervised, zero-day capable
- Trained on ~530,000 BENIGN flows from CICIDS2017 Monday traffic
- 52 CICIDS2017 features per flow extracted via custom 508-line Scapy parser
- Detection threshold: 0.000007 RMSE (empirically calibrated, academically defended)
- Severity mapping: RMSE > 0.001 = Critical · > 0.0001 = High · > 0.00001 = Medium · else Low
Key Results:
- 🚨 903 total alerts in production DB · 200 Critical DDoS + 200 Medium PortScan per run
- ⚡ < 50ms WebSocket latency alert delivery to mobile (LAN)
- 📡 218 network flows (209 benign CICIDS2017 + 9+ attack flows)
Hardware Validation:
- 2× TP-Link Tapo C200 smart cameras on Windows Mobile Hotspot (192.168.137.x)
- Attack 1: hping3 SYN flood on RTSP port 554 → Critical DDoS alert
- Attack 2: Mirai HTTP brute-force on HTTP port 8800 → Critical/High alert
- KitNET classified both as distinct threat patterns from normal RTSP/cloud-sync/UPnP baseline
Backend — FastAPI:
- 15+ REST endpoints · JWT auth · bcrypt · OTP email verification
- WebSocket real-time broadcast to all connected mobile clients
- PostgreSQL on NeonDB — Users, Devices, Alerts, NetworkLogs, SimulationRuns, NotificationPrefs
- PDF + CSV alert export via reportlab
7 Real Production Bugs Solved:
| Bug | Root Cause | Fix |
|---|---|---|
| GNS3 capture API → 24 bytes (empty PCAP) | VyOS routing broken; no traffic crossing subnet | Replaced with Paramiko SSH + tcpdump directly on Kali NIC |
| Stale PCAP (old data every run) | /tmp/capture.pcap owned by system tcpdump user, not kali |
Changed path to /home/kali/capture.pcap |
| tcpdump stopped after 1-2 seconds | Paramiko channel assigned to local variable — GC destroyed it mid-capture | Stored as self._tcpdump_channel (instance variable) |
| hping3/nmap produced no packets | Raw socket ops require root; no sudo in SSH command | Prefixed all Kali commands with echo 'kali' | sudo -S |
| APK build failure on Windows | Project path exceeded Windows 260-char MAX_PATH limit | Moved project to C:\TF\ (short path) |
| Release APK network errors | Android 9+ blocks cleartext HTTP in release builds | Added android:usesCleartextTraffic="true" in AndroidManifest.xml |
| KitNET NumPy shape mismatch | Partial flows producing < 52 features | Added shape guard — skip flows not exactly (52,) |
Cloud & Infrastructure
Containers & Orchestration
CI/CD & Security
Monitoring & Observability
Languages & Frameworks
Networking & Security
- 🏛️ BSCS — SZABIST Karachi (Expected Jun 2026) | CGPA: 3.58 / 4.0 | Last Semester: 4.0 / 4.0
- 🔐 Cybersecurity Intern — Arch Technologies (Jun–Aug 2025) | Scapy packet analysis · ML fraud detection · security tooling
- 🏆 Hackathon Co-Lead — ZABEFEST 2025 | 50+ competing teams
- 🥇 National Cybersecurity Competition — 7th place, Ignite NTF (25 universities)
Security is not a feature — it's the foundation.