Dammam, Saudi Arabia

Abdallah Alotaibi

Cybersecurity
& Compliance

Security Automation Application & API Security GRC

Information Technology graduate and Cybersecurity & Compliance Intern based in Saudi Arabia. I work across governance, security controls, systems, and practical security tooling, combining compliance-focused work with hands-on technical implementation.

View featured projects GitHub LinkedIn

Abdallah Alotaibi wearing traditional Saudi attire

About

Practical security, clearly implemented.

I’m a Saudi Information Technology graduate focused on cybersecurity governance, compliance, security automation, and application security.

My work combines policy and control implementation with hands-on systems, infrastructure, and software security. I enjoy turning security requirements into clear, practical, and verifiable technical controls.

I also build security-focused software and labs to strengthen my understanding of secure engineering, credential exposure, identity, networks, and cloud environments.

Experience

Governance supported by technical evidence.

June 2026—Present

Eastern Province
Saudi Arabia

NAJIM Systems

Cybersecurity & Compliance Intern

Support cybersecurity governance and compliance activities by drafting and reviewing security policies, access baselines, onboarding and offboarding controls, asset-return procedures, and data-disposal documentation.
Build and document Windows Active Directory and Ubuntu lab evidence for password policies, account lockout, screen locking, firewall protection, endpoint security, USB restrictions, and SSH hardening.
Review technical security controls involving email authentication, MFA, endpoint protection, remote access, backups, logging, VPN, and web application security.
Assist in organising risks, controls, evidence, gaps, and remediation activities for compliance readiness.

Featured projects

Selected work across software and infrastructure.

Open-source security tooling

CredScope

I co-built CredScope, an offline-first security tool that helps developers understand where exposed credentials could matter inside a repository. It combines findings from Gitleaks with context from Docker Compose and GitHub Actions, showing where a credential is referenced, which services or workflows are connected to it, and how the finding may be prioritised.

Why it matters. CredScope adds repository and infrastructure context to a possible secret so developers can review the finding more effectively.

My work. Go CLI development, repository analysis, reporting formats, GitHub Action integration, documentation, security model, and releases.

Built primarily in Go, the cross-platform tool produces Terminal, HTML, JSON, SARIF 2.1.0, and Mermaid reports. It is designed not to execute repository content, contact credential providers, or include raw secret values in reports, and is available for Windows, Linux, and macOS with GitHub Action support.

Graduation project · Cybersecurity training platform

PMUCTF

I developed PMUCTF as my graduation project to provide university students with a complete environment for practising cybersecurity through Capture The Flag challenges. The platform allows learners to solve challenges, submit flags, track their progress, compete on leaderboards, and receive immediate scoring feedback.

My work covered the Flask backend, user and challenge workflows, scoring logic, administrative challenge management, security controls, and deployment of the platform using AWS, Nginx, Gunicorn, and Cloudflare.

The project demonstrates full-stack development, secure platform design, cloud deployment, and the ability to turn cybersecurity training requirements into a working product.

Windows Server & Active Directory lab

Broonet Server Lab

I designed and documented an enterprise-style Windows Server lab to practise how core organisational infrastructure is configured and managed. The environment covered identity, access, networking, storage, policy enforcement, and service monitoring.

The lab included Active Directory structure, organisational units, users and groups, Group Policy, DHCP, DNS, IIS, FTP, DFS, RAID 1, and Windows event monitoring.

The project demonstrates practical knowledge of Windows administration, identity management, network services, infrastructure security, and technical documentation.

Additional hands-on practice through TryHackMe, Hack The Box, and cybersecurity labs.

Core skills

A selective view of working areas and tools.

GRC & Compliance

Security Policies · Risk Registers · Control Evidence · Gap Assessment · Access Reviews · Onboarding and Offboarding Controls

Security Engineering

Application Security · API Security · Vulnerability Assessment · Security Automation · Threat Modelling · Credential Exposure Analysis

Systems & Infrastructure

Windows Server · Active Directory · Group Policy · Linux · Networking · Firewalls · MFA and Endpoint Security

Development & DevSecOps

Go · Python · JavaScript · SQL · Docker · GitHub Actions · Flask

Certifications

Confirmed credentials, kept concise.

eJPT

eLearnSecurity Junior Penetration Tester

INE
Nov 2025—Nov 2028

ICCA

INE Certified Cloud Associate

INE
Nov 2025

ISO/IEC 27001 Lead Auditor

Information security management systems

Mastermind
Jul 2025—Jul 2028

Education

Information Technology, completed in 2026.

2021—2026

Al Khobar, Saudi Arabia

Prince Mohammad Bin Fahd University

Bachelor of Science in Information Technology

Coursework and projects focused on cybersecurity, information security, systems, networking, and secure software development.

07 / Contact

Let’s connect around
security work.

For professional opportunities, open-source security tooling, and thoughtful conversations about practical security controls.

[email protected] GitHub LinkedIn