Mazen Abu Ghazaleh

MazenAbu Ghazaleh

I keep production infrastructure healthy, and I break my own to learn how.

I'm a network operations technician and a cybersecurity student in Laurel, Maryland. At work that means a fleet of KVM hypervisors, Cisco and Juniper switches, and the monitoring that is supposed to notice before a customer does.

At home I run a two-node Proxmox lab: a NAS, three GTX 1080s serving local models, and a Kali VM that feeds recon into an AI triage pipeline. I hunt on public bug-bounty programs, I'm studying for Security+, and I finish a B.S. in Cybersecurity in 2027. I'm looking for a SOC, security engineering, or systems role.

See the projectsDownload résumé

Projects

Recon tooling, a trading-research rig that found nothing, a bilingual client site, and the class projects that taught me Java. Filter by what each one is for.

Showing 15 of 15 projects

  • Security research · home lab

    AI-Powered Vulnerability Triage Pipeline

    GitHub
    • End-to-end automated recon and triage against explicitly authorized scopes only.
    • Recon chains reconFTW with nuclei, katana, ffuf, sqlmap, dalfox, httpx, naabu, and nikto; an aggregator normalizes results into a prompt-ready structure.
    • Two local Ollama models on a GPU-passthrough VM organize the dataset, then score severity and write a report.
    • Findings are delivered over Telegram via a Hermes agent (migrated from OpenClaw) so the lab can be run remotely.

    Python · bash · Kali · Ollama · Hermes · reconFTW

  • Personal project

    Network Security Analyzer

    GitHub
    • Live packet capture and analysis with anomaly detection over rolling windows for home-network visibility.
    • A real-time web dashboard streams capture summaries and alerts over WebSockets.
    • Packaged with Docker for one-command deployment, with documented capture and rule tuning.
    • Per-protocol breakdowns and top-talker tracking surface noisy or unexpected hosts at a glance.

    Python · Scapy · Flask · WebSockets · Docker

  • Personal project · quantitative research

    Systematic Trading Research Rig

    • Ran roughly 3,600 backtests across crypto and US equities (400+ strategy variants; 134 symbols over 10.6 years of data) and got the honest answer: nothing survived validation; no exploitable price-based edge at retail scale.
    • Built a leakage-proof measurement rig: walk-forward validation, deflated Sharpe, permutation tests, empirically measured fees, and a four-direction leakage canary guarding the backtest engine's signal-shift rule.
    • Wrapped a deterministic broker client in a fail-closed, veto-only risk gate and a crash-recovering order ledger; a $2 real-money shakedown proved the live order path and caught an unrecorded position within one monitoring cycle.
    • Runs 24/7 as a hardened systemd daemon with Telegram alerting, yet deliberately trades nothing: the rig killed every plausible strategy family it tested before one touched real money, which is the point.

    Python · SQLite · systemd · OAuth 2.1 · Telegram

  • Hackathon build · team of 3

    Dealership Management Platform

    • Built the core dealer-management system: nine screens covering inventory, CRM, valuations, merchandising, desking/F&I, buy-here-pay-here loans, accounting, P&L, and service tickets.
    • Added natural-language Q&A over dealership data through text-to-SQL with read-only guardrails, so staff ask questions in plain English instead of learning a report builder.
    • Abstracted the AI provider and database behind adapter interfaces: the app runs fully offline with zero credentials (in-browser Postgres, mock AI) and flips to Supabase Postgres in production.
    • Owned the team's repo and branch workflow alongside the build.

    Next.js 16 · React 19 · Supabase · PGlite · shadcn/ui

  • Deployment & hosting

    AEROS UAV Risk Platform

    • Deployed and self-host a full-stack UAV flight-risk intelligence platform on my Proxmox home lab, taking a partner's Dockerized FastAPI + local-RAG backend from repo to a live public site.
    • Exposed it through a Cloudflare Tunnel with automatic TLS and no open inbound ports, fronted by an nginx same-origin reverse proxy so the backend is never reachable directly and CORS is avoided.
    • Hardened the deployment with network segmentation, secrets kept in an out-of-git .env, and a deterministic decision engine where the optional LLM is disabled by default.
    • Right-sized the VM (CPU, RAM ballooning, disk) on a constrained host so the memory-heavy RAG stack runs reliably alongside the rest of the lab.

    FastAPI · Docker · nginx · Cloudflare Tunnel · RAG / FAISS

  • Personal build · interactive 3D

    MAZ//LAB 3D Homelab Showcase

    • An over-the-top interactive 3D tour of the two-node home lab, built to be projected on a TV while I narrate: every machine modeled from photos, down to the cable color code.
    • A 12-chapter presenter mode drives choreographed camera moves, with free-roam orbit, click-to-focus hardware stories, three full visual themes, and a one-key privacy mode that masks every address on screen.
    • A simulated telemetry engine gives the lab a personality (idle hum, AI bursts, NFS surges, transcode spikes) behind a clean seam designed to swap in live node data with no other code changes.
    • A scripted blackout drill replays the lab's real UPS staged shutdown and cold-boot recovery, and the whole site ships as one self-contained ~2 MB HTML file that runs offline from a double-click.

    React 19 · TypeScript · Three.js · React Three Fiber · zustand

  • Public web app · open source

    Doomsday Assembly

    doomsdayassembly.com
    • A public MCU watch-order tracker built entirely on Cloudflare's edge: static front end, a Pages Functions API, D1 for state, KV for the hot path, and no server to patch.
    • Anonymous analytics with an HMAC owner marker and baseline, so my own testing never pollutes real visitor numbers and no per-visitor identifier is ever stored.
    • An authenticated two-person sync mode: per-person rows in D1, debounced writes, and poll-plus-focus refresh so two phones stay in step.
    • A 21-assertion local test suite runs the real Pages Functions against node:sqlite; an adversarial review pass added CSRF Origin checks, retry-on-push, and UTF-8-safe Basic auth.

    Cloudflare Pages · Pages Functions · D1 · KV · HMAC

  • Client work · live in production

    THCC Bilingual Company Site

    temporary-houses.com
    • Designed and built the bilingual English/Arabic site for a Saudi prefab contracting firm, with full right-to-left mirroring and locale routing; live in production.
    • Built an IKEA-style 3D cabin configurator (React Three Fiber): size presets and custom dimensions, wall and color options, interior planner with wall-snap, and a quote flow straight to WhatsApp.
    • Editorial design system built from the company's print profile: no template, no stock-site look.

    Next.js · React Three Fiber · Arabic/English RTL

  • Security research · disclosure

    Bug Bounty & Responsible Disclosure

    • Active researcher on public bug-bounty programs, working full engagements from scope review through recon, validation, and report writing.
    • Identified and responsibly reported security vulnerabilities in a university web platform.
    • Disclosed through proper channels; specifics stay withheld until issues are remediated.

    Web security · recon · reporting

  • Tooling · home lab

    Custom Recon Pipeline Script

    • A reusable one-command bash wrapper that turns a single domain into a structured, deduplicated recon tree.
    • Standardizes subdomain enumeration, live-host filtering, port scanning, and fingerprinting so every engagement starts from the same baseline.

    bash · reconFTW · httpx · naabu · nmap

  • Hackathon · solo

    MasterPeace AI-Agent Hackathon

    • Competed solo at MasterPeace's "Put AI Coding Agents to the Test" hackathon in Columbia, MD.
    • Pre-built a deployable React starter whose AI endpoint points at my self-hosted Ollama node over Tailscale, so the app needs no cloud API key at all.

    Vite · React 19 · Cloudflare Pages · Ollama

  • Malware analysis · reverse engineering

    Agent Tesla RAT Analysis

    GitHub
    • Static and dynamic analysis of the Agent Tesla RAT: unpacked the sample, mapped its configuration, and traced persistence and process behavior.
    • Captured the exfiltration channel and documented indicators of compromise in a full written report.

    Static & dynamic analysis · Procmon · Wireshark · sandbox

  • Academic · database design

    Library Management Database

    GitHub
    • Designed a normalized relational database for a library: ER model, schema, and integrity constraints.
    • Built queries and views for catalog, members, and loan tracking, with sample reporting.

    SQL · relational design · ERD

  • Academic · Howard CC

    TV Store Management System

    • Inventory and sales system modeling order flow and undo history with stack and queue structures.
    • Persistent state via file I/O, with optimized product-lookup traversal.
    • Menu-driven CLI with input validation and reporting for stock levels and sales history.

    Java · file I/O · stacks & queues

  • Academic · Howard CC

    OOP Pokémon Game

    • A turn-based, Pokémon-style game built on inheritance, encapsulation, and polymorphism.
    • Game state and move resolution designed with tree-based structures.
    • Type-effectiveness and battle logic driven by a class hierarchy of creatures and moves.

    Java · OOP · tree structures

Home Lab

Two Proxmox nodes at home, run like production: they page my phone when something breaks, and the backups have been restored for real, not just scheduled.

DELL 5820 · SECURITY + EDGERYZEN 5600X · NAS + AItunnelmeshfw: KaliNFS · 2.5GInternetthe wildCloudflare Tunnelno inbound portsTailscalemesh VPNWeb VMnginx · 2 sitesKali VMrecon · pentestJellyfinVPN-isolatedMgmt LXCPDM · Beszel · KumaAI Inference VMOllama · 3× GTX 1080 (24 GB)TrueNAS SCALEZFS mirrors · NFS / SMB · Immich
two nodes, segmented by trust zonepublic edgeprivate
  • Proxmox VE 9 · VFIO · Tailscale · PDM

    Two-Node Proxmox Setup

    • Two independent Proxmox nodes: a Ryzen box for NAS and local AI inference, and a Dell Precision 5820 for the security lab and public-facing edge, joined over a Tailscale mesh on a 2.5GbE backbone.
    • Managed from a single Proxmox Datacenter Manager dashboard, with Beszel and Uptime Kuma watching every node and service and alerting to Telegram.
    • Each node's NIC is pinned by MAC and every passthrough device by ID and IOMMU group via Proxmox resource mappings, so a hardware change fails safe instead of silently grabbing the wrong device.
    • Root-caused a stubborn "three GPUs won't fit" wall to PCI address-space exhaustion rather than lane limits; the Ryzen node now runs three GPUs, and the storage controller moved onto CPU lanes so ZFS and VM disk I/O no longer share the chipset uplink.
  • Ubuntu · Ollama · 3× GTX 1080 · VFIO

    Local AI Inference

    • An Ubuntu VM runs Ollama with three GTX 1080s passed through and pooled into 24 GB of VRAM, serving a local OpenAI-compatible endpoint to the rest of the lab.
    • Firewalled so only the security node reaches the model plane; it is the brain behind the AI recon and triage pipeline.
    • The extra 8 GB keeps bigger, smarter models fully resident in VRAM: a 19.4 GB model runs at 100% GPU offload split across all three cards, while keep-alive, flash-attention, and a quantized KV cache stretch the pool further.
  • Dell 5820 · Kali · nginx · LXC

    Security & Edge Node

    • A Dell Precision 5820 hosting the Kali offensive VM, the public web edge, and lightweight LXC containers for datacenter management and monitoring.
    • Its remaining GTX 1080 stays on the host driver for Jellyfin's hardware transcodes, kept out of the AI pool on the other node.
    • That same card doubles as the console GPU, so an all-VFIO headless lockout can never happen.
  • TrueNAS SCALE · ZFS · NFS · SMB

    NAS & Self-Hosted Storage

    • TrueNAS with the SATA controller passed through; mirrored ZFS pools export SMB and NFS to the fleet and the home network.
    • Serves per-member private shares, a Windows backup target, the family photo library, and the NFS dataset that Proxmox writes nightly VM backups to.
  • Jellyfin · Docker · VPN-isolated · Tailscale

    Jellyfin Media Stack

    • A self-hosted Jellyfin server with hardware transcoding, fed by a fully containerized, automated media pipeline.
    • The download path is isolated behind a WireGuard VPN egress; media lives on the TrueNAS pool over NFS and streams over Tailscale.
  • Immich · Postgres · ZFS · rclone crypt · Swift

    Photos & Verified Offsite DR

    • A self-hosted photo platform for the family: 15,105 assets across three users on ZFS mirrors, with scheduled snapshots and nightly encrypted database dumps.
    • Encrypted offsite replication to object storage, plus the part most people skip: a real restore, verified at 15,123 of 15,123 files with database dumps and sampled originals byte-identical by SHA256.
    • Machine learning (CLIP search, face recognition) runs in a separate GPU worker pinned by GPU UUID with a short model TTL, so indexing never starves the media stack sharing the card.
    Read the write-up
  • Hermes · Ollama · MCP · nftables · Telegram

    Read-Only Ops Agent

    • A local LLM agent answers lab questions from my phone (GPU load, disk usage, service health) and is deliberately unable to change anything.
    • Three layers keep it that way: a per-platform tool allowlist, a custom nine-tool read-only MCP server, and an SSH forced-command dispatcher that rejects anything but its fixed verbs. Shell injection resolves to an invalid unit; the agent has no shell toolset at all.
    • A self-adversarial design review caught an exploitable path before deployment; the residual risk is written down rather than hand-waved.
  • 2.5GbE · iperf3 · NUT · upssched

    2.5GbE Backbone & Staged Power

    • Upgraded the wired lab to 2.5GbE and proved it with a pre-registered iperf3 baseline: node-to-node throughput up 2.5× to 2360 Mbps, NFS writes up 91%, and thousands of egress-buffer retransmits per run dropped to zero.
    • UPS-backed staged shutdown via NUT: on power loss the AI VM drops at +20 seconds to shed the GPU load, the NAS host follows gracefully at +5 minutes, and everything restarts itself when power returns, tested end to end.
    • GPU power caps (150 W per card) keep draw predictable: measured UPS load stays at 58% even with a 19 GB model resident, and a custom NVML daemon enforces a minimum fan speed on the fan-stop cards.
    • A link monitor alerts if any NIC silently renegotiates below its expected speed, the failure mode that actually happened.
  • nginx · Cloudflare Tunnel · Access · Docker

    Self-Hosted Web Hosting

    • Two live production websites served from the lab behind a Cloudflare Tunnel with automatic TLS and no open inbound ports.
    • Internal dashboards sit behind an email-gated Cloudflare Access policy; each public site is an isolated container with HTTPS enforced and hardening headers applied.
    • The public box is segmented off from the NAS and the rest of the lab so a public service can't pivot inward.

Work

Production operations at a datacenter operator: the hypervisor fleet, the switching, the monitoring, and the long-running tickets earlier attempts had left open.

Network Operations Center Technician (Tier 1)

AiNet · Laurel, MD

Apr 2025 – Present

  • Operate production infrastructure across a fleet of 13+ KVM hypervisors and 40+ Cisco/Juniper switches.
  • Discovered a certificate-distribution host publishing every domain's TLS private key over unauthenticated public HTTPS: verified seven wildcard keys downloadable from off-network, established a roughly 19-month exposure window, and wrote the remediation plan (keys regenerated, not just reissued, since the ACME client reuses them across renewals).
  • Built a 6-GPU inference rig from decommissioned datacenter hardware into a 48 GB VRAM pool serving a 35B-parameter model at ~33 tok/s, the compute base for an internal ops agent; handed off for agent bring-up.
  • Diagnosed a fleet-wide monitoring blind spot where a local disk check pasted one host's result across 84 hosts, hiding real full disks; remediated across the fleet so genuine alerts fire again.
  • Authored the VM fleet backup strategy: changed-block incremental capture pushed to OpenStack Swift object storage with dedup, encryption, and retention, every job monitored in Nagios; piloted on a production host.
  • Planned and executed live RAID 0 to RAID 5 migrations with zero guest downtime, including a 3-drive rebuild on the largest host.
  • Live-migrated 9+ production VMs across hypervisors over shared NFS, resolving cache-mode and snapshot edge cases without service interruption.
  • Migrated a production BGP peering session from an aging 3750 to a 6500-class switch, documenting neighbor, prefix-list, and route-map config before a clean cutover.
  • Restored a 10G DWDM circuit to a remote site that had been unreachable for about 10 months across four prior attempts: moved the /30, MTU, and OSPF point-to-point config onto the newly lit channel, then cleared an asymmetric MTU mismatch that had left the adjacency stuck in EXSTART.
  • Ended a recurring multi-tenant out-of-disk ticket by tracing it to monthly ZFS snapshots on a parent dataset pinning everything a 12-hour cleanup cron deleted; reclaimed 2.72 TB on a dry-run-verified destroy and fixed the recurrence at the config layer, taking the pool from 94% to about 21% used.
  • Mapped OSPF route preservation for three transit-switch decommissions, re-homing every live link so traffic through the boxes survived removal.
  • Deployed an OpenVAS scanner in a dedicated VM with custom profiles aligned to the asset inventory; ran the recurring monthly scan and documented findings.
  • Remediated a customer site with a broken TLS chain: installed intermediates, enforced HTTPS, and added HSTS, CSP, and hardening headers, verified end-to-end.

Store Manager

Talk N' Fix · Maryland

Oct 2023 – Apr 2025

Promoted from Repair Technician after the first year

  • Ran daily store operations end to end: staffing, scheduling, and opening and closing procedures.
  • Owned inventory and parts ordering, tracking stock levels and margins to keep common repairs in stock.
  • Handled customer escalations and warranty disputes, protecting both the customer and the shop.
  • Hired, trained, and supervised junior technicians on diagnostics, repair technique, and customer communication.
  • Set repair workflow and quality standards that cut rework and turnaround time on common jobs.
  • Reconciled daily sales and cash handling, reporting performance to ownership.

Repair Technician

Talk N' Fix · Maryland

Oct 2022 – Oct 2023

  • Diagnosed and repaired hardware faults across phones, laptops, and desktops, from display assemblies to charge boards and thermal rework.
  • Performed data recovery and malware removal while preserving customer privacy and chain of custody.
  • Quoted repairs and explained options clearly, turning walk-ins into completed jobs.
  • Kept detailed repair tickets so every device had a clear history and status.

Education

  1. B.S. Cybersecurity

    University of Maryland Global Campus

    18-credit Fall 2026 in progress; the term closes out Gen Ed and leaves only the capstone in the major.

    Expected Jul 2027

  2. A.S. Cybersecurity

    Howard Community College

    Plus coursework in CS: Java, OOP, data structures, algorithms.

    Graduated 2026

  3. A.S. Computer Science

    Howard Community College

    Columbia, MD

    Graduated 2026

Certificates

Done, and still in progress. CompTIA is the current track.

  • IT Automation with Python

    Google · Professional Certificate

    Completed

  • AI Fluency: Framework & Foundations

    Anthropic

    Completed

  • Claude 101

    Anthropic

    Completed

  • Security+ (SY0-701)

    CompTIA

    In progress

  • CySA+ (CS0-003)

    CompTIA

    In progress

  • Cloud+ (CV0-003)

    CompTIA

    In progress

Training & Awareness

  • OPSEC Awareness for Military Members, DoD Employees, and Contractors · DoD CDSE
  • Insider Threat Awareness · DoD CDSE
  • Identifying and Safeguarding Personally Identifiable Information (PII) · DoD CDSE
  • Cybersecurity Awareness · DoD CDSE

Skills & Tools

What I actually use, grouped by where it shows up in the work above.

Security & Pentest
Kali LinuxreconFTWnmapnucleiffufsqlmapOpenVASWiresharkTLS / PKI
Virtualization & Infrastructure
Proxmox VEKVM / QEMUVFIO passthroughZFSDockerNFS
Networking
Cisco IOSBGPOSPFVLANsTailscale2.5GbEswitch cutovers
Cloud & Edge
Cloudflare TunnelCloudflare AccessOpenStack Swift
Monitoring & Observability
NagiosMuninBeszelUptime KumaNUT (UPS)RANCID
Linux, Languages & Tooling
Ubuntu / DebianbashPythonJavasystemdGit
Web & Full-Stack
Next.jsReactTypeScriptSupabasei18n / RTL
AI / LLM Infrastructure
Ollamamulti-GPU inference (up to 6×)Hermes agentsClaude Code agents