Friday, July 4, 2026 The Evidence-First Edition Forecast: false positives, clearing by midday

The Analyst Ledger

Reporting the defensive security work of Mahmoud (“Michael”) Al Kurdi

CompTIA Security+ ce (SY0-701)B.S. Information Technologies, Summa Cum LaudeCharlotte, N.C. — Open to RemoteAvailable Full-Time

Security Operations · Lead Story

After Eight Years on Federally Regulated Ground, an Analyst Reports for the SOC

Security+ certified and summa cum laude, Mahmoud “Michael” Al Kurdi arrives with a crew chief’s discipline, public repositories for receipts, and a simple ethos: every claim maps to evidence.

Security work rarely announces itself. For eight years it looked like this: international flights turning on schedule, identities validated at the door, access tightly controlled, and every irregularity written down — because on a federally regulated ramp, the paperwork is the security. From 2015 to 2023, Mr. Al Kurdi served as an Aviation Security Operations Crew Chief for American Airlines in Charlotte, holding a security clearance with a CBP badge endorsement and working international flight operations under FAA, OSHA, IATA, and CBP requirements — with recurrent incident-response and safety-and-security training as a standing condition of the job.

He has since put the discipline on paper. In January 2025 he earned the CompTIA Security+ ce certification (SY0-701, valid through January 2028). In December 2025 he completed a B.S. in Information Technologies with a cybersecurity concentration at Southern New Hampshire University — summa cum laude, 3.96 GPA, inducted into the Sigma Psi chapter of Alpha Sigma Lambda — conferred January 1, 2026.

The receipts are public. AgentForge, a configuration framework for agentic AI coding assistants, ships on npm with six adapter targets and a test harness standing behind it. Its companion, the AgentForge ATT&CKLens Benchmark, asks a strictly defensive question — can AI coding agents build secure, uncertainty-aware, MITRE ATT&CK-aligned defensive tooling? — and answers with seven scored artifacts and a re-runnable harness. Standings in Section B

Mr. Al Kurdi is seeking full-time work as a SOC analyst, security operations analyst, cybersecurity analyst, incident-response analyst, junior detection engineer, or in security automation. He is based in Charlotte, N.C., and open to remote.

Profile · A2

Discipline learned where FAA, OSHA, IATA, and CBP all have opinions

Eight years of identity validation, access control, and high-accountability documentation — and what they teach about alert triage.

Turn to Profile →

The Standings · B1

Seven agents enter a defensive benchmark; Cursor tops the table at 100

A reproducible rubric grades AI coding agents on ATT&CK discipline, prompt-injection resistance, and honest uncertainty.

Full table inside →

The Record · C1

The complete record, in print

Experience, education, certification, and skills — with the résumé available as a one-page, print-ready PDF. No paywall.

Turn to the Record →
Section A · Profile

Profile

Page A2

The Person Behind the Ledger

The Making of an Evidence-First Analyst

The road from the ramp to the security operations floor ran through federal regulation, a 3.96 GPA, and a habit of writing everything down.

Ask what an aviation security operations crew chief actually does, and the answer sounds familiar to anyone who has worked a SOC shift: validate identities, control access to aircraft and secure areas, document incidents to a standard a federal auditor could act on, and keep operations moving while doing all of it. Mr. Al Kurdi did that work for American Airlines in Charlotte for eight years — under a security clearance with CBP badge endorsement, across international flight operations governed by FAA, OSHA, IATA, and CBP requirements, with recurrent incident-response and safety-and-security training required year after year.

The habits transfer. Alert triage rewards the same temperament as flight operations: calm under time pressure, suspicion of tidy explanations, and documentation a stranger could pick up cold. His project work runs on the same ethos — rubric-based scoring, evidence citation, confidence scoring, and an explicit “No Clear Mapping” verdict where the evidence runs out, rather than a guess dressed up as an answer.

The road between the ramp and the SOC ran through coursework and delivery routes: courier and logistics work for USPS in Kannapolis (2024–2025), then delivery for Fossa Logistics, an Amazon DSP in Charlotte (2025–present), while completing the cybersecurity degree summa cum laude. The pattern is consistent — high-accountability work, done thoroughly, documented properly.

He now seeks the room where those habits are the job description: the security operations center — in Charlotte or from it.

Section B · Technology

Projects

Page B1

Open Source · Section B Lead

“One Spec, Many Agents”: AgentForge Ships Its Configuration Framework to npm

Six adapter targets, one source of truth — with round-trip tests, smoke tests, and a doctor CLI standing behind the claim.

The problem is mundane and universal: every agentic coding assistant wants its own configuration dialect. AgentForge keeps one specification and writes it out to six targets — Claude Code, Codex, Gemini CLI, Cursor, Aider, and a generic adapter — published to npm as @kmitops/agentforge, version 0.3.1, under the MIT license.

The proof is the point. Behind the package stand adapter round-trip tests, install smoke tests, a doctor CLI for diagnosing broken setups, a readiness runbook, and a live demo anyone can open. It is the same standard the Ledger applies to its proprietor: don’t claim it, show it.

Node.jsnpmJavaScriptYAML / JSONMIT

The Standings · Defensive Benchmark

Seven Agents, One Rubric: Cursor Tops the Table at a Perfect 100

A reproducible, strictly defensive benchmark asks whether AI coding agents can build secure, uncertainty-aware, MITRE ATT&CK-aligned tooling. The table below is the box score.

Defensive Tooling League — Final Standings

Graded on ATT&CK mapping discipline, prompt-injection resistance, evidence citation, uncertainty handling (“No Clear Mapping”), detection ideas, remediation guidance, and analyst follow-up questions. One branch per agent; the harness re-runs via benchmark-all.ps1.
Pos Agent Artifact Pts / 100 Off Lead Score bar
1Cursor100
T-2Claude Code982
T-2Hermes Nemotron982
4Codex964
5Lovable (Repaired)7624
6Mistral Vibe7525
7Lovable (Original)4060

All work is defensive: detection, mitigation, and analyst support — never offensive tooling. MITRE ATT&CK® is a registered trademark of The MITRE Corporation.

In Brief · Dashboards

Vulnerability Management Mini Program

A Python, Flask, and SQLite dashboard for the unglamorous middle of security work: CRUD for findings, KPI cards, search, filtering, and severity states — remediation tracking that behaves like a tool, not a spreadsheet.

PythonFlaskSQLite

In Brief · Detection

Security Log Anomaly Detection

Python with pandas and NumPy: rule-based and statistical detection for authentication and network anomaly triage — the analyst’s oldest question, “is this normal?”, asked in code.

PythonpandasNumPy
Section C · Public Record

The Record

Page C1

Obtain the Complete Record

The résumé, print-ready in PDF. No paywall, no registration — the Ledger’s readers deserve primary sources.

Download the Résumé (PDF)

Experience

Aviation Security Operations Crew Chief

2015–2023

American Airlines — Charlotte, N.C.

Federally regulated operations under FAA, OSHA, IATA, and CBP requirements. Security clearance with CBP badge endorsement; international flight operations. Recurrent incident-response and safety/security training. Identity validation, access control, and high-accountability documentation.

Courier & Logistics Specialist

2024–2025

United States Postal Service — Kannapolis, N.C.

Time-critical routing and delivery with chain-of-custody accountability.

Delivery Associate

2025–Present

Fossa Logistics LLC (Amazon DSP) — Charlotte, N.C.

High-volume delivery operations, sustained while completing the cybersecurity degree summa cum laude.

Education

B.S. Information Technologies — Cybersecurity Concentration

Conferred Jan 2026

Southern New Hampshire University

Completed December 2025; conferred January 1, 2026. Summa cum laude, 3.96 GPA. Sigma Psi chapter of Alpha Sigma Lambda honor society.

Certification

CompTIA Security+ ce (SY0-701)

Jan 2025 → Jan 2028

CompTIA

Issued January 7, 2025; valid through January 7, 2028.

Section D · Letters

Correspondence

Page D1

Letters to the Desk

Recruiters, Hiring Managers & Security Engineers Are Invited to Write

Replies are prompt. Claims are verifiable. Correspondence on SOC, detection, incident response, and security-automation roles is especially welcome.

Clip & Send

“Dear Mr. Al Kurdi — we read the Ledger, checked the receipts, and would like to talk.”

Write to the Analyst

Charlotte, N.C. · Open to remote · Available full-time