ACCESS GRANTED // SESSION ACTIVE

OMAR YOUSEF

Cybersecurity Contractor & Researcher•Security+•CySA+

GET IN TOUCHVIEW ON GITHUB
CySA+ CERTIFIED//APRIL 2026
> SECTION_01 / CERTIFICATIONS

Certifications

> SECTION_02 / EXPERIENCE

Experience

National Science Foundation (NSF)

AI Security Researcher

May 2026 – Present

  • Researching AI/ML security — placeholder bullet, please update

Partsol

Cybersecurity Contractor

Jan 2026 – May 2026

  • Implemented IAM best practices using JumpCloud to provision, audit, and manage user roles and permissions
  • Troubleshot endpoint issues by designing and deploying PowerShell scripts across systems to enforce security configurations
  • Administered ThreatLocker (EDR), managing application control/requests, and strengthening malware response

Partsol

IT Cybersecurity Intern

Sep 2025 – Jan 2026

  • Assisted in SOC 2 audit preparation and ISO/IEC 42001 (AI Security Governance) compliance efforts
  • Strengthened email defenses by managing Mimecast policies and tuning AI filtering, reducing phishing and false positives
  • Streamlined project tracking by deploying Jira and Confluence for cross-team planning and IT ticket management
  • Managed IT asset inventory for laptops and hardware, regularly updating devices and maintaining accurate lifecycle tracking

School District of Palm Beach County

Lead IT Security Intern

Jun 2025 – Aug 2025

225K+
ENDPOINTS MONITORED
45+
DAILY ALERTS TRIAGED
30%
MTTD REDUCTION
40%
PHISHING CLICK-RATE DROP
  • Monitored 225,000+ endpoints via EDR platforms Carbon Black and CrowdStrike for threat detection
  • Triaged 45+ daily alerts in the Gurucul SIEM platform, reducing MTTD by ~30% and documenting root-cause analyses
  • Conducted vulnerability assessments with Nessus, NodeZero, and ExtraHop RevealX, delivering remediation plans
  • Penetration testing and malware analysis using Kali Linux, Metasploit, SQLmap, Burp Suite, Ghidra, and Autopsy
  • Led phishing and cybersecurity awareness training for 23,000+ staff via Infosec IQ, lowering click-through rates by 40%
  • Configured LightSpeed content filtering, blocking malicious domains to reduce phishing incidents

Basmah

Technical Office Manager

May 2022 – Jul 2023

  • Delivered Tier 1 IT support for hardware, software, and network issues
  • Managed ticketing systems to track incidents, ensuring SLA compliance and faster resolution times
> SECTION_03 / EDUCATION

Education

University of South Florida

Bachelor of Science in Cybersecurity

Tampa, FL•Expected May 2028

> RELEVANT COURSEWORK

  • Object-Oriented Programming
  • Programming Concepts
  • Intro to Databases
  • Physics

> HONORS & AWARDS

  • University of Cambridge AICE Diploma
  • Full Bright Futures Scholarship Recipient
  • AP Scholar
> SECTION_04 / TECHNICAL SKILLS

Technical Skills

> LANGUAGES

  • Python
  • MySQL
  • Bash
  • PowerShell
  • HTML
  • CSS
  • TypeScript
  • JavaScript

> SECURITY PLATFORMS

  • OpenVAS
  • NodeZero
  • Tenable Nessus
  • Carbon Black
  • Gurucul
  • CrowdStrike
  • ThreatLocker
  • Mimecast

> SECURITY TOOLS

  • Nmap
  • Kali Linux
  • Wireshark
  • Metasploit
  • BloodHound
  • Burp Suite
  • SQLMap
  • John the Ripper
  • Autopsy
  • YARA
  • Ghidra

> INFRASTRUCTURE & DEVOPS

  • Docker
  • Git
  • FastAPI
  • Next.js
  • React
  • Tailwind CSS
  • JumpCloud
  • Jira
  • Confluence
  • ServiceNow

> NETWORKING

  • TCP/IP
  • DNS
  • DHCP
  • VPN
  • SMB
  • SSH
  • RDP
  • HTTPS
  • SFTP
  • Firewalls
  • IDS/IPS
> SECTION_05 / PROJECTS

Projects

PROJECT_01
BEST USE OF GEMMA 4 — GOOGLE

SPOTTED

AI-Powered Retail Theft Detection & Response

HackABull 2026

An end-to-end retail security system that turns passive camera feeds into a real-time threat detection and response loop. YOLOv8 + ByteTrack handle live detection and tracking, a local Gemma 4 VLM (via Ollama) verifies whether behavior is actually theft and generates a context-aware announcement, and ElevenLabs synthesizes a live voice deterrent — all in seconds. Events are logged to MongoDB, synced to Snowflake, and queryable in natural language through a Cortex Search RAG chatbot.

> TECH STACK

Frontend
Next.js 16React 19TypeScriptTailwind CSSThree.js / R3F
Backend
Python (FastAPI)UvicornNext.js API routes
Computer Vision
YOLOv8ByteTrackResNet18OpenCVFFmpeg
AI
Gemma 4 (Ollama)GeminiElevenLabs (TTS)
Data & RAG
MongoDB Atlas (GridFS)SnowflakeSnowflake Cortex Search
View Project Details
PROJECT_02
1ST PLACE CTF4TH PLACE HACKATHON

Fragments

AI-Powered Network Security Platform

Hack the Bay 2026 • Built in 6 hours

An AI-powered network security platform that maps devices, scores risk in real time, and lets you interact with your network like a security analyst. ARP scanning for device discovery, Nmap for port/service analysis, OS fingerprinting, traceroute, deterministic risk scoring with CVE correlation, and a RAG-based AI system for natural language interaction.

> TECH STACK

Frontend
Next.js (TypeScript)ReactTailwind CSSD3.js
Backend
Python (FastAPI)SQLite
AI
OllamaClaude APIChromaDB (RAG)
Real-time
WebSockets
View Project DetailsView on Devpost
PROJECT_03
2ND PLACE — NEXTERA ENERGY CHALLENGE

Raven

AI-Powered Malware Analysis Platform

HackUSF 2026 • Built in under 24 hours

A sandbox malware analysis platform that safely detonates suspicious files inside a Docker container and uses multiple AI agents — Static Analyst, Behavioral Threat Modeler, and Adversarial Critic — to autonomously investigate. Agents debate and reach consensus to generate risk scoring, IOC extraction, MITRE ATT&CK mapping, and step-by-step remediation. Malware never leaves the container.

> TECH STACK

Frontend
Next.jsReact
Backend
FastAPI
Infrastructure
Docker
AI
Claude Agent SDK (multi-agent system)
Security Tooling
YARAILSpy (ilspycmd)Python cryptographyrestringer
View Project DetailsView on Devpost
PROJECT_04

ScopeUSF IoT Camera System

Raspberry Pi 5 Surveillance Platform

SCOPE Club • Production Deployment

Live video streaming and GPIO remote control over Tailscale VPN. MJPEG streaming with aiohttp and picamera2, hardware control through gpiozero, and systemd auto-start on boot.

> TECH STACK

Streaming
Pythonaiohttppicamera2 (MJPEG)
Hardware
Raspberry Pi 5gpiozero (GPIO)
Networking
Tailscale VPN
Deployment
systemd
Visit scopeusf.org
> SECTION_06 / CVE DISCLOSURES

CVE Disclosures

// Credited on three GitHub-coordinated CVE disclosures across open-source AI platforms — including a published High-severity Open WebUI CVE and a Critical public PraisonAI advisory — plus further research under coordinated disclosure. Identifiers appear here only once their public records are live.

  • CVE-2026-59219GHSA-855v-hq7w-jmjw
    HIGH · 7.1
    PUBLISHED CVEPublished 2026-07-09 · Patched in 0.10.0

    Open WebUI — realtime authentication[pip · open-webui]

    Affected
    ≥ 0.9.0, < 0.10.0 (Redis configured)
    Patched
    0.10.0
    Weakness
    CWE-613 · Insufficient Session Expiration

    With Redis-backed revocation configured, JWTs revoked at sign-out or via OIDC back-channel logout were still accepted by Open WebUI's realtime endpoints — a stolen token could keep opening Socket.IO and terminal-websocket sessions after the account had logged out.

    • Realtime connection and room-join paths validated token signature and expiry only, skipping the Redis-backed revocation check the normal HTTP layer enforced.
    • Impact scoped to realtime surfaces — session rooms, channel events, collaborative notes, and terminal websocket auth — while REST APIs correctly rejected revoked tokens.
    • Fixed in 0.10.0 by applying the shared is_token_revoked() check (per-token jti and per-user revoked_at) across realtime authentication.
    • Reported and credited to huslayer826; remediation coordinated with Classic298. CVE record published by the GitHub CNA on 2026-07-09.
    Read full writeupCVE recordAdvisoryFix commitRelease 0.10.0
  • GHSA-p75f-6fp4-p57w
    CRITICAL · 9.8
    PUBLISHED ADVISORYCVE assigned · pending Registry propagation · Patched in 4.6.59

    PraisonAI — bundled UI (MCP management)[pip · praisonai]

    Affected
    ≤ 4.6.48
    Patched
    4.6.59
    Weakness
    CWE-78 · CWE-306 — Cmd Injection + Missing Auth

    PraisonAI's bundled UI exposed an unauthenticated MCP management endpoint that accepted caller-provided process-launch configuration, letting network-reachable attackers execute chosen local commands as the UI service user.

    • Default UI hosting bound to all interfaces with no authentication on the management API.
    • Reachable through `praisonai ui`, `praisonai ui agents`, `praisonai claw`, and apps built on the hosted-UI integration.
    • Reported and credited to huslayer826; GitHub-reviewed advisory public since 2026-06-18. A CVE is assigned — the identifier will be listed once the Registry record is publicly live.
    Read full writeupGitHub Advisory
// IN COORDINATED DISCLOSURE

  • PraisonAI — second disclosure (High)

    Authentication bypass accepted and patched upstream. CVE assigned; the identifier and full details will be listed once the public Registry record and advisory are live.

    CVE ASSIGNED · PROPAGATING

  • Undisclosed open-source AI platform

    High-severity finding accepted by the maintainers; fix in progress upstream. Advisory and CVE will be published after the vendor's coordinated-disclosure window closes.

    UNDER EMBARGO
> SECTION_07 / LEADERSHIP

Leadership

Society for Critical Operations and Preparedness Engineering (SCOPE)

Software Engineer Lead

Aug 2025 – Present

  • Led software engineering team by delegating tasks, coordinating code reviews, and ensuring code quality across contributors
  • Developing drone flight capabilities through software, implementing control logic and integration for stable navigation

> COMPETITION HIGHLIGHTS

  • 1st Place CTF

    Hack the Bay 2026

  • 2nd Place Hackathon

    HackUSF 2026

    NextEra Energy Challenge

  • 4th Place Hackathon

    Hack the Bay 2026

> SECTION_08 / CONTACT

Contact

Let's Connect

Open to internship opportunities, collaborations, and security projects.