omar@csm.one:~$
Available for security & infrastructure roles

OMAR
AL AZZAWI

.
Boston · Cambridge, MA omar@csm.one U.S. Citizen · Secret-eligible

Security researcher and Tier-3 infrastructure engineer with 13+ years hardening enterprise systems across defense, fintech, and FDA-regulated medical environments. Recognized on the Tencent Security Response Center Hall of Fame for a valid production vulnerability disclosure — now reporting across Meta, Google VRP, and YesWeHack while building AI-assisted security and automation workflows.

View Code LinkedIn Contact
13+
years in infrastructure
TSRC
Hall of Fame + bounty
4
active bounty programs
500+
endpoints secured

$ whoami --about

Who is Omar Al Azzawi?

Omar Al Azzawi is a cybersecurity researcher and Tier-3 infrastructure engineer based in the Greater Boston area. He is recognized on the Tencent Security Response Center (TSRC) Hall of Fame for a valid, paid vulnerability disclosure, and reports security findings through the Meta, Google VRP, and YesWeHack bug bounty programs. Over 13+ years he has hardened enterprise infrastructure for defense (DoD), financial services, and FDA-regulated medical organizations, and holds AWS Security Specialty, AWS Advanced Networking, Microsoft Azure (AZ-305), CompTIA CySA+, and Security+ certifications alongside a B.S. in Cybersecurity. His work pairs offensive security research with the discipline of an infrastructure engineer: every finding is verified against raw evidence before it is reported.

$ cat ~/research/summary.md

Security Research

Independent web and mobile application testing — every exploit chain verified against raw HTTP and ADB output, so each report is reproducible and evidence-backed. Handle: omaarvip.

Tencent Security Response Center — Hall of Fame PAID BOUNTY

Recognized for a valid vulnerability disclosure affecting Tencent production systems, with a paid bounty award. Enrolled in the DoD Cyber Registered Apprenticeship Program (DCAP), targeting the Cyber Defense Analyst and Incident Responder tracks.

Verify on the official TSRC site →
Tencent Security Response Center public profile for Omar Al Azzawi — 3 vulnerabilities, 9 credits, linked to csm.one TSRC · verified profile ↗

Findings reported

IDOR Access-control bypass Session hijacking Stored XSS SSO / open-redirect Android intent-redirection

Toolchain

Burp SuiteCaidoOWASP ZAP Kali LinuxADBClaude Code / Gemini CLI

Programs

Tencent (TSRC) ↗Hall of Fame
MetaActive
Google VRPActive
YesWeHackActive

$ git log --career --oneline

Experience

Tier-3 escalation across regulated, high-consequence environments — from classified DoD systems to FDA-regulated medical manufacturing.

Getinge ABMedical / HIPAAMay 2022 – Present
IT Systems Administrator, Tier 3 · via Tech Mahindra

Senior escalation point for infrastructure, identity, and endpoint operations across a global medical-device manufacturer, spanning 14+ U.S. sites.

  • Own backup & retention (Veeam, HP Data Protector) under HIPAA chain-of-custody
  • Okta platform admin — full joiner / mover / leaver identity lifecycle
  • Deploy applications via SCCM to 500+ endpoints; AirWatch/Workspace ONE MDM fleet
  • Built an AI-assisted compliance workflow in n8n using OCR/vision barcode reading
State StreetFinTechJan 2021 – May 2022
IT Support Engineer

Regulated financial-services environment; endpoint imaging and provisioning at scale.

  • Deployed and imaged 300+ enterprise laptops via SCCM pipelines
  • PowerShell automation for onboarding, cutting repetitive manual setup
  • Coordinated with security operations on incident escalation & containment
RaytheonDefense / DoDJun 2019 – Jan 2021
IT Support Specialist · via DXC Technology

Controlled Department of Defense environment under strict operational-security requirements.

  • Secure hardware decommissioning & DoD-compliant data sanitization
  • Active Directory asset management and ServiceNow incident workflows

$ ls -la ./arsenal

Technical Arsenal

A toolkit spanning offensive security, cloud, identity, and automation — held together by evidence-first discipline.

Offensive Security

Burp SuiteCaidoOWASP ZAPKali Linux Web app testingMobile / ADBIDOR & access controlVuln disclosure

Cloud & Infrastructure

AWS (Security Specialty)Azure (AZ-305)VMwareDocker Windows ServerSCCMActive DirectoryGroup Policy

Identity, Backup & Compliance

Okta (platform admin)Entra ID / Azure ADVeeamHP Data Protector HIPAADoD protocolsSEC / FINRACIS Benchmarks

Automation & AI

PowerShell (advanced)PythonBashn8n OpenAI / GPT APIsClaude CodeTwilioDeepgram

$ openssl verify certs/*

Certifications

Azure Solutions Architect Expert

Microsoft · AZ-305

AWS Certified Security — Specialty

Amazon Web Services

AWS Advanced Networking — Specialty

Amazon Web Services

CompTIA CySA+

Cybersecurity Analyst

CompTIA Security+

CompTIA

B.S. Cybersecurity

Southern New Hampshire University

$ ls ~/projects --sort=impact

Projects

Production automation and AI systems that solve real infrastructure and security problems.

01 LLM Workflow Automation

Multi-step n8n production automations integrating GPT and Claude — a Telegram-to-CMS content pipeline and a barcode/inventory tracker using GPT-4o vision and Google Sheets.

n8nGPT-4oClaudeVision OCR

02 Voice AI Support Prototype

Enterprise customer-service assistant combining Deepgram speech-to-text, OpenAI, and SAP OData retrieval, orchestrated through n8n with real-time transcription.

DeepgramTwilioSAP OData

03 AI-Assisted Security Tooling

A Claude Code / Gemini CLI agent on Kali Linux for research workflows — enforcing raw-evidence verification (proxy-routed traffic, saved-response inspection) to eliminate fabricated findings before reporting.

KaliClaude CodeBurp

04 Full-Stack Applications

Flutter + Firebase/Supabase applications with admin panels, real-time data, role-based access control, and automated notification pipelines.

FlutterFirebaseRBAC

05 Vulnerability Remediation Pipeline

PowerShell + SCCM workflow that standardizes patching and hardening across enterprise endpoints, compressing critical-exposure windows from weeks to days.

PowerShellSCCMCIS

06 Compliance Automation (n8n)

An AI-assisted compliance workflow using OCR/vision barcode reading to replace a manual tape-tracking process under HIPAA retention requirements.

n8nVisionHIPAA

$ cat education.txt

Education & Training

B.S., Cybersecurity

Southern New Hampshire University

DoD Cyber Apprenticeship (DCAP)

Cyber Defense Analyst & Incident Responder tracks · in progress

$ man omar-al-azzawi

Frequently Asked

Who is Omar Al Azzawi?

Omar Al Azzawi is a cybersecurity researcher and Tier-3 infrastructure engineer based in the Greater Boston area. He is recognized on the Tencent Security Response Center (TSRC) Hall of Fame for a valid, paid vulnerability disclosure and is active across the Meta, Google VRP, and YesWeHack bug bounty programs.

What is Omar Al Azzawi known for?

Independent security research and responsible vulnerability disclosure — including a paid, verified finding recognized by Tencent's Security Response Center — alongside 13+ years hardening enterprise infrastructure for defense (DoD), fintech, and FDA-regulated medical organizations.

Is Omar Al Azzawi a certified cybersecurity expert?

Yes. He holds AWS Certified Security – Specialty, AWS Certified Advanced Networking – Specialty, Microsoft Azure Solutions Architect Expert (AZ-305), CompTIA CySA+, and CompTIA Security+, plus a B.S. in Cybersecurity.

What kinds of vulnerabilities has Omar Al Azzawi found?

Reported findings include IDOR, access-control bypass, session hijacking, stored XSS, SSO and open-redirect, and Android intent-redirection vulnerabilities — each verified against raw HTTP and ADB evidence for reproducibility.

Where is Omar Al Azzawi based, and how can I contact him?

He is based in the Greater Boston area (Cambridge, MA), United States. He can be reached at omar@csm.one, on GitHub as MrCyber02, and on LinkedIn as omeralazzawi.

$ sudo unlock --direct-line

Direct Line

The phone number isn't written anywhere in this page's source — it's XOR-encrypted, and the decryption key is the answer to the challenge below. Bots can't read it; you can. Consider it a tiny CTF.

CHALLENGE

Convert hex 0x1BB to decimal to unlock the line. Hint: it's the port HTTPS listens on.