Skip to content
Mazen Abu Ghazaleh

MazenAbu Ghazaleh

I keep production infrastructure healthy, and I break my own to learn how.

I'm a network operations technician and a cybersecurity student in Laurel, Maryland. At work that means a fleet of KVM hypervisors, Cisco and Juniper switches, an object-storage cluster, and the monitoring that is supposed to notice before a customer does.

At home I run a two-node Proxmox lab: a NAS, three GTX 1080s serving local models, and a Kali VM wired to an AI triage pipeline I built. I practice on public bug-bounty programs, I'm studying for Security+, and I finish a B.S. in Cybersecurity Technology in 2027. I'm looking for a SOC, security engineering, or systems role.

See the workDownload résumé

Now · updated October 2026

Studying
CompTIA Security+ (SY0-701), next on the certificate track.
Shipped
Gym 1.1.2, the Android app I build and train with.
School
The second half of the Fall term starts Oct 14; after it, 14 credits to go.

Work

Production operations at a datacenter operator: the hypervisor fleet, the switching, the storage, and the monitoring that is supposed to notice first.

Network Operations Center Technician (Tier 1)

AiNet · Beltsville, MD

Apr 2025 – Present

Larger changes are reviewed and signed off by senior engineers before they run.

  • Operate production infrastructure across a fleet of 13+ KVM hypervisors, 40+ Cisco/Juniper switches, and an 800-drive object-storage cluster.
  • Found and scoped a critical private-key exposure in internal certificate distribution, then wrote the remediation plan: keys regenerated, not just reissued, because the renewal client reused them.
  • Root-caused an object-storage cluster whose replication never settled: its ring had about 1,000 partitions spread over 800+ drives, far too coarse to balance, made worse by full and unmounted drives. Laid out the fix options for the senior team.
  • Found a production VM still running on a disk image that had been deleted out from under it, and rescued it live: copied the disk from the open file handle and pivoted the guest onto the copy with no downtime.
  • Rebuilding the production mail platform on fresh Ubuntu 26.04 VMs: rebuilt the mail stack, restored six databases, and moved the first 80 GB (475,000 files) in under an hour ahead of cutover.
  • Restored a 10G DWDM circuit to a remote site that had been unreachable for about 10 months: moved the /30, MTU, and OSPF point-to-point config onto the newly lit channel, then cleared an asymmetric MTU mismatch that had left the adjacency stuck in EXSTART.
  • Ended a recurring multi-tenant out-of-disk ticket by tracing it to monthly ZFS snapshots on a parent dataset pinning everything a 12-hour cleanup cron deleted; reclaimed 2.72 TB on a dry-run-verified destroy and fixed the recurrence at the config layer, taking the pool from 94% to about 21% used.
  • Diagnosed a fleet-wide monitoring blind spot where a local disk check pasted one host's result across 84 hosts, hiding real full disks; fixed it fleet-wide, and later added 72 health checks across 18 storage nodes.
  • Designed and piloted the VM fleet backup strategy: changed-block incremental capture pushed to OpenStack Swift object storage with dedup, encryption, and retention, every job monitored in Nagios.
  • Built a 6-GPU inference rig from decommissioned datacenter hardware into a 48 GB VRAM pool serving a 35B-parameter model at ~33 tok/s, the compute base for an internal ops agent; handed off for agent bring-up.
  • Planned and executed live RAID 0 to RAID 5 migrations with zero guest downtime, including a 3-drive rebuild on the largest host.
  • Migrated a production BGP peering session from an aging 3750 to a 6500-class switch, documenting neighbor, prefix-list, and route-map config before a clean cutover.
  • Deployed an OpenVAS scanner in a dedicated VM with custom profiles aligned to the asset inventory; ran the recurring monthly scan and documented findings.

Store Manager

Talk N' Fix · Maryland

Oct 2023 – Apr 2025

Promoted from Repair Technician after the first year

  • Ran daily store operations end to end: staffing, scheduling, and opening and closing procedures.
  • Owned inventory and parts ordering, tracking stock levels and margins to keep common repairs in stock.
  • Hired, trained, and supervised junior technicians on diagnostics, repair technique, and customer communication.
  • Set repair workflow and quality standards that cut rework and turnaround time on common jobs.

Repair Technician

Talk N' Fix · Maryland

Oct 2022 – Oct 2023

  • Diagnosed and repaired hardware faults across phones, laptops, and desktops, from display assemblies to charge boards and thermal rework.
  • Performed data recovery and malware removal while preserving customer privacy and chain of custody.
  • Kept detailed repair tickets so every device had a clear history and status.

Home Lab

Two Proxmox nodes at home: one runs storage and local AI, the other runs the security lab and the public sites.

DELL 5820 · SECURITY + EDGERYZEN 5600X · NAS + AI2.5GbE switch · 2360 Mbps node to nodeUPS · AI VM off +20 s, host +5 min5820 · surge only, no batteryCloudflare Access · admin UIsfwNFSGPUGTX 1080 · Jellyfin NVENC + Immich MLGPU3× GTX 1080 · VFIO to the AI VMInternetthe wildCloudflare2 tunnels · AccessTailscalemesh VPNWeb VMnginx · 2 sitesKali VMrecon · on demandMedia LXCsJellyfin · Immich MLOps LXCsPDM · Beszel · KumaAI Inference VMOllama · 24 GB poolHermesread-only opsTrueNAS SCALEZFS mirrors · NFS / SMB · ImmichTelegramalerts, chatOffsiteencrypted
two nodes, colored by trust zonepublic edgeprivateoutside the lab, or powered down until needed
  • Proxmox VE 9 · VFIO · Tailscale · PDM

    Two-Node Proxmox Setup

    • Two independent Proxmox nodes: a Ryzen box for NAS and local AI inference, and a Dell Precision 5820 for the security lab and public-facing edge, joined over a Tailscale mesh on a 2.5GbE backbone.
    • Managed from a single Proxmox Datacenter Manager dashboard, with Beszel and Uptime Kuma watching every node and service and alerting to Telegram.
    • Each node's NIC is pinned by MAC and every passthrough device by ID and IOMMU group via Proxmox resource mappings, so a hardware change fails safe instead of silently grabbing the wrong device.
    • Root-caused a stubborn "three GPUs won't fit" wall to PCI address-space exhaustion rather than lane limits; the Ryzen node now runs three GPUs, and the storage controller moved onto CPU lanes so ZFS and VM disk I/O no longer share the chipset uplink.
  • Ubuntu · Ollama · 3× GTX 1080 · VFIO

    Local AI Inference

    • An Ubuntu VM runs Ollama with three GTX 1080s passed through and pooled into 24 GB of VRAM, serving a local OpenAI-compatible endpoint to the rest of the lab.
    • A firewall allow-list lets only the Kali VM and the read-only ops agent reach the model plane; it is the brain behind the AI recon and triage pipeline and the agent.
    • The extra 8 GB keeps bigger, smarter models fully resident in VRAM: a 19.4 GB model runs at 100% GPU offload split across all three cards, while keep-alive, flash-attention, and a quantized KV cache stretch the pool further.
  • Dell 5820 · Kali · nginx · LXC

    Security & Edge Node

    • A Dell Precision 5820 hosting the Kali offensive VM (powered on for engagements), the public web edge, and lightweight LXC containers for management and monitoring.
    • Its remaining GTX 1080 stays on the host driver, shared by Jellyfin's hardware transcodes and Immich's machine learning, instead of joining the AI pool on the other node.
    • When a reboot renumbered the GPU's device node and silently broke hardware transcoding, the containers moved to Proxmox device entries, and GPU checks now run real encode work instead of trusting nvidia-smi.
  • TrueNAS SCALE · ZFS · NFS · SMB

    NAS & Self-Hosted Storage

    • TrueNAS with the SATA controller passed through; mirrored ZFS pools export SMB and NFS to the fleet and the home network.
    • Serves per-member private shares, a Windows backup target, the family photo library, the media library, and the NFS dataset that Proxmox writes weekly VM backups to.
  • Immich · Postgres · ZFS · rclone crypt · Swift

    Photos & Verified Offsite DR

    • A self-hosted photo platform for the family: about 15,000 assets across three users on ZFS mirrors, with scheduled snapshots and nightly encrypted database dumps.
    • Encrypted offsite replication to object storage, plus the part most people skip: a real restore in September 2026, verified at 15,123 of 15,123 files, with database dumps and sampled originals byte-identical by SHA256.
    • Machine learning (CLIP search, face recognition) runs in a separate GPU worker pinned by GPU UUID with a short model TTL, so indexing never starves the media stack sharing the card.
    Read the write-up
  • Hermes · Ollama · MCP · nftables · Telegram

    Read-Only Ops Agent

    • A local LLM agent answers lab questions from my phone (GPU load, disk usage, service health) and is deliberately unable to change anything.
    • Three layers keep it that way: a per-platform tool allowlist, a custom nine-tool read-only MCP server, and an SSH forced-command dispatcher that rejects anything but its fixed verbs. Shell injection resolves to an invalid unit; the agent has no shell toolset at all.
    • A self-adversarial design review caught an exploitable path before deployment; the residual risk is written down rather than hand-waved.
  • What's Up Docker · Telegram · unattended-upgrades

    Update Watch & Console

    • Every container on both nodes is checked daily for new releases, and a Saturday digest of host packages, guests, and apps lands in Telegram.
    • Nothing updates itself: one console shows what is behind and applies an update only when I press the button. Security patches inside the containers still apply automatically.
    • Major versions wait for a planned upgrade with a backup first, because some are one-way: Jellyfin 12's 39 database migrations ran clean in October 2026.
  • 2.5GbE · iperf3 · NUT · upssched

    2.5GbE Backbone & Staged Power

    • Upgraded the wired lab to 2.5GbE and proved it with a pre-registered iperf3 baseline: node-to-node throughput up 2.5× to 2360 Mbps, NFS writes up 91%, and thousands of egress-buffer retransmits per run dropped to zero.
    • UPS-backed staged shutdown via NUT: on power loss the AI VM drops at +20 seconds to shed the GPU load, the NAS host follows gracefully at +5 minutes, and the AI VM restarts itself if power returns first, all rehearsed with a simulated outage.
    • GPU power caps (150 W per card) keep draw predictable: measured UPS load stays at 58% even with a 19 GB model resident, and a custom NVML daemon enforces a minimum fan speed on the fan-stop cards.
    • A link monitor alerts if any NIC silently renegotiates below its expected speed, the failure mode that actually happened.
  • nginx · Cloudflare Tunnel · Access · Docker

    Self-Hosted Web Hosting

    • Two live production websites served from the lab behind a Cloudflare Tunnel with automatic TLS and no open inbound ports.
    • Internal dashboards sit behind an email-gated Cloudflare Access policy; each public site is an isolated container, and this one sends HSTS, a content security policy, and the standard hardening headers.
    • Next step: move the public VM onto its own DMZ VLAN once VLAN-capable routing is in; the 2.5GbE switch already speaks 802.1Q.

Projects

Three I would walk an interviewer through, the builds I ship and host, and a list of everything else. Filter by what each one is for.

Showing 16 of 16 projects

  • Malware analysis · team of 2 · 2026

    Agent Tesla RAT Analysis

    GitHub

    Static and dynamic analysis of a live Agent Tesla credential stealer in an isolated Windows lab, published as a defensive reference with defanged indicators.

    • Static pass: a .NET keylogging API chain (GetKeyboardState, MapVirtualKey, ToUnicodeEx), a hard-coded C2 URL, and strings aimed at saved credentials; 63 of 72 engines flagged the sample.
    • Dynamic pass: it masqueraded as a data-recovery tool through forged version info and read saved FileZilla, Paltalk, and IMVU credentials at runtime.
    • Its TLS setup pointed to exfiltration over HTTPS; the C2 host was already offline, and the report says so instead of guessing past it.
    • Mapped what was observed to MITRE ATT&CK (T1036.005, T1555, T1552.001, T1056.001, T1041) and recorded the gaps: no persistence or keystroke-log write was captured in this run.

    pestudio · Procmon · Process Explorer · Wireshark · Regshot · MITRE ATT&CK

  • Lab automation · authorized scopes only · 2026

    AI-Assisted Recon & Triage Pipeline

    GitHub

    A recon pipeline on the Kali VM that hands its output to local models for sorting and a first-draft report, so my time goes to validating leads instead of collating tool output.

    • Chains reconFTW with nuclei, katana, ffuf, httpx, and naabu, then normalizes every tool's output into one structured dataset.
    • Local Ollama models on the GPU node organize the dataset, rank what deserves a closer look, and draft notes; nothing leaves the lab and no cloud API is involved.
    • The models never decide: every lead is reproduced and validated by hand before anything is reported, and runs only touch scopes that authorize them.
    • Driven from Telegram through a Hermes agent with a default-deny chat allowlist; the Kali VM is powered on only for engagements.

    Python · bash · Kali · Ollama · Hermes · reconFTW

  • Personal project · open source · 2026

    Network Security Analyzer

    GitHub

    Live packet capture with rolling-window anomaly detection and a real-time dashboard, packaged for one-command deployment.

    • Live packet capture and analysis with anomaly detection over rolling windows for home-network visibility.
    • A real-time web dashboard streams capture summaries and alerts over WebSockets.
    • Per-protocol breakdowns and top-talker tracking surface noisy or unexpected hosts at a glance.
    • Packaged with Docker for one-command deployment, with documented capture and rule tuning.

    Python · Scapy · Flask · WebSockets · Docker

  • Personal build · shipping · 2026

    Gym, an Android App

    Releases

    A native workout planner and one-handed logger I built for my own phone and ship to a friend: 20 builds since Sept 23, with XP, streaks, 48 badges, and ranks against open powerlifting data.

    • 1,607 automated tests, including screenshot tests, on a shared module kept ready for Kotlin Multiplatform.
    • Seven database schema versions, each migrated in place on a phone holding real training history, with every table kept.
    • Updates itself: an in-app updater saves a backup, pulls the release build from a public releases repo, and checks its SHA-256 before installing; the source stays private.

    Kotlin · Jetpack Compose · Room · Coroutines

  • Security research · disclosure

    Bug Bounty & Responsible Disclosure

    A real disclosure first, and steady practice on public programs.

    • Found and responsibly reported security vulnerabilities in a university web platform through the proper channel; specifics stay withheld until they are fixed.
    • Practicing on public bug-bounty programs, working engagements end to end: scope review, recon, manual validation, and report drafting.

    Web security · recon · reporting

  • Deployment & hosting · 2026

    AEROS UAV Risk Platform

    Took a partner's Dockerized FastAPI and local-RAG flight-risk platform from repo to a live public site on my home lab.

    • Exposed through a Cloudflare Tunnel with automatic TLS and no open inbound ports, behind an nginx same-origin proxy so the backend is never reachable directly.
    • Hardened with network segmentation, secrets kept out of git, and a deterministic decision engine where the optional LLM is off by default.
    • Right-sized the VM so the memory-heavy RAG stack runs reliably alongside the rest of the lab.

    FastAPI · Docker · nginx · Cloudflare Tunnel · RAG / FAISS

  • Public web app · open source · 2026

    Doomsday Assembly

    doomsdayassembly.com

    A public MCU watch-order tracker built entirely on Cloudflare's edge, with no server to patch.

    • Anonymous analytics with an HMAC owner marker, so my own testing never pollutes visitor numbers and no per-visitor identifier is stored.
    • An authenticated two-person sync mode: per-person rows in D1, debounced writes, and poll-plus-focus refresh.
    • A 21-assertion test suite runs the real Pages Functions locally; an adversarial review added CSRF Origin checks and UTF-8-safe Basic auth.

    Cloudflare Pages · Pages Functions · D1 · KV · HMAC

  • Client work · live in production · 2026

    THCC Bilingual Company Site

    temporary-houses.com

    The bilingual English/Arabic site for a Saudi prefab contracting firm, with full right-to-left mirroring; live in production.

    • An IKEA-style 3D cabin configurator: size presets, wall and color options, an interior planner with wall-snap, and a quote flow straight to WhatsApp.
    • An editorial design system built from the company's print profile: no template, no stock-site look.

    Next.js · React Three Fiber · Arabic/English RTL

  • Hackathon build · team of 3 · 2026

    Dealership Management Platform

    The core dealer-management system for a team hackathon: nine screens from inventory and CRM to loans, accounting, and service tickets.

    • Plain-English questions over dealership data through text-to-SQL with read-only guardrails.
    • AI provider and database behind adapters: runs fully offline with zero credentials, and flips to Supabase Postgres in production.

    Next.js 16 · React 19 · Supabase · PGlite · shadcn/ui

Also built

  1. MAZ//LAB 3D Homelab Showcase

    A 3D tour of the home lab for presenting on a TV: 12-chapter presenter mode, simulated telemetry, and a blackout drill, in one offline HTML file.

    Interactive 3D · 2026

  2. Systematic Trading Research Rig

    About 3,600 backtests behind a leakage-proof measurement rig; nothing survived validation, so it never traded beyond a $2 shakedown.

    Quantitative research · 2026

  3. Custom Recon Pipeline Script

    A one-command bash wrapper that turns a domain into a deduplicated recon tree, so every engagement starts from the same baseline.

    Tooling · 2026

  4. MasterPeace AI-Agent Hackathon

    Competed solo in Columbia, MD, with a React starter wired to my self-hosted Ollama over Tailscale, so it needed no cloud API key.

    Hackathon · solo · 2026

  5. Library Management Database

    ER and EER modeling, normalization, and runnable Oracle SQL for a library system.

    Database design · 2026GitHub

  6. TV Store Management System

    A Java inventory and sales system built on stacks, queues, and file I/O.

    Howard CC · 2024

  7. OOP Pokémon Game

    A turn-based Java game built on inheritance, encapsulation, and polymorphism.

    Howard CC · 2023

Education & Certificates

  1. B.S. Cybersecurity Technology

    University of Maryland Global Campus

    Expected Jul 2027

  2. A.S. Cybersecurity

    Howard Community College

    Graduated 2026

  3. A.S. Computer Science

    Howard Community College

    Java, object-oriented programming, data structures, and algorithms.

    Graduated 2026

Certificates

  • IT Automation with Python

    Google · Professional Certificate

    Completed

  • Security+ (SY0-701)

    CompTIA

    Studying

Courses, training & awareness

  • AI Fluency: Framework & Foundations · Anthropic
  • Claude 101 · Anthropic
  • OPSEC Awareness for Military Members, DoD Employees, and Contractors · DoD CDSE
  • Insider Threat Awareness · DoD CDSE
  • Identifying and Safeguarding Personally Identifiable Information (PII) · DoD CDSE
  • Cybersecurity Awareness · DoD CDSE

Skills & Tools

What I actually use, grouped by where it shows up in the work above.

Security
WiresharkOpenVASMITRE ATT&CKmalware analysisTLS / PKIKali LinuxnmapnucleiffufreconFTW
Virtualization & Infrastructure
Proxmox VEKVM / QEMU / libvirtVFIO passthroughZFSDockerNFS
Networking
Cisco IOSBGPOSPFRPKI / ROAVLANsTailscale
Cloud & Edge
Cloudflare TunnelCloudflare AccessOpenStack Swift
Monitoring & Observability
NagiosMuninBeszelUptime KumaNUT (UPS)RANCID
Linux, Languages & Tooling
Ubuntu / DebianbashPythonJavaKotlinsystemdPostfix / DovecotGit
Web & Apps
Next.jsReactTypeScriptJetpack ComposeSupabasei18n / RTL
AI / LLM Infrastructure
Ollamamulti-GPU inferenceMCP tool serversClaude Code