FILE 2026-KMK-01
Case File — Personnel Status: Active Filed: July 2026

AL KURDI,
MAHMOUD (“MICHAEL”)

Security Operations Analyst — Charlotte, NC · open to remote · available full-time

  • 8 years of federally regulated aviation security operations — American Airlines, CLT (2015–2023)
  • CompTIA Security+ ce (SY0-701) — issued Jan 2025, valid through Jan 2028
  • B.S. Information Technologies, Cybersecurity — SNHU, summa cum laude
  • Builds defensive, evidence-first security tooling — see Exhibits A–D

MEMORANDUM

TO:
Hiring Manager / SOC Lead
FROM:
Records Division, File 2026-KMK-01
RE:
Background of subject — AL KURDI, Mahmoud (“Michael”)
DATE:
July 2026

From 2015 to 2023 the subject served as Aviation Security Operations Crew Chief with American Airlines in Charlotte — eight years of federally regulated operations under FAA, OSHA, IATA and CBP requirements, holding a security clearance with CBP badge endorsement for international flight operations. The job was recurrent incident-response and safety/security training, identity validation, access control, and the kind of high-accountability documentation where an unlogged detail is a finding.

He then converted that operational discipline into formal credentials: CompTIA Security+ ce (SY0-701), issued January 2025, and a B.S. in Information Technologies with a Cybersecurity concentration from Southern New Hampshire University — completed December 2025, conferred January 1, 2026, summa cum laude with a 3.96 GPA, inducted into the Sigma Psi chapter of Alpha Sigma Lambda.

Current work sits where his two backgrounds meet: defensive security tooling and AI-agent evaluation. Exhibit A (AgentForge) is a published configuration framework for agentic coding assistants; Exhibit B is a reproducible benchmark testing whether those agents can build secure, MITRE ATT&CK-aligned defensive tooling. All security work in this file is framed around detection and mitigation — nothing offensive, ever. The through-line of the whole record: claims are only made where a public repo, credential, or document can back them.

Portions redacted for modesty. Hover or focus to declassify.

ROLES SOUGHT — CHECK ALL THAT APPLY

  • SOC Analyst
  • Security Operations Analyst
  • Cybersecurity Analyst
  • Incident Response Analyst
  • Junior Detection Engineer
  • Security Automation

OBSERVED CAPABILITIES

SOC / SecOps

  • Alert triage
  • Security monitoring
  • Incident documentation
  • Log analysis & evidence review
  • Authentication events
  • DNS investigation
  • Remediation planning
  • Escalation notes

Cybersecurity

  • MITRE ATT&CK
  • Defensive security
  • Prompt-injection resistance
  • Access control & least privilege
  • Security documentation
  • Confidence scoring
  • “No Clear Mapping” handling

AI / Automation

  • AI coding-agent evaluation
  • Reproducible benchmark design
  • Rubric-based scoring
  • Prompt architecture & safety rules
  • Acceptance criteria
  • Automated reporting

TOOLS: Python · Gradio · JavaScript · Node.js · PowerShell · Bash · Git/GitHub · Markdown · JSON · YAML · HTML/CSS · pytest · npm

EXHIBITS A–D

Entered into evidence — all public, all verifiable
EXHIBIT A

AgentForge

“One spec, many agents” — configuration framework for agentic AI coding assistants · MIT license

A single project specification compiled out to six adapter targets — Claude Code, Codex, Gemini CLI, Cursor, Aider, and a generic fallback — so a team defines its rules once and every agent obeys them. Published to npm as @kmitops/agentforge@0.3.1.

Proof attached

  • Adapter round-trip tests — spec in, adapter out, spec back
  • Install smoke tests + doctor CLI for environment diagnosis
  • Readiness runbook and a live public demo
EXHIBIT B

AgentForge ATT&CKLens Benchmark

Reproducible defensive-security benchmark for AI coding agents · MIT license

The question under examination: can AI coding agents build secure, uncertainty-aware, MITRE ATT&CK-aligned defensive tooling? Seven agent artifacts, one branch per agent, each scored against a 100-point rubric covering ATT&CK mapping discipline, prompt-injection resistance, evidence citation, uncertainty handling (“No Clear Mapping”), detection ideas, remediation guidance, and analyst follow-up questions. The harness re-runs end to end via benchmark-all.ps1.

Findings of fact — scores out of 100
Agent artifactScore
Cursor100
Claude Code98
Hermes Nemotron98
Codex96
Lovable (repaired)76
Mistral Vibe75
Lovable (original)40

MITRE ATT&CK® is a registered trademark of The MITRE Corporation.

EXHIBIT C

Vulnerability Management Mini Program

Python · Flask · SQLite

A vulnerability-tracking dashboard built the way a working analyst would want it: full CRUD over findings, KPI cards for the numbers that matter, search and filtering, and explicit severity states so nothing hides in a spreadsheet tab.

EXHIBIT D

Security Log Anomaly Detection

Python · pandas · NumPy

Rule-based plus statistical detection for triaging authentication and network anomalies — the unglamorous, essential SOC work of separating a bad login from a bad actor, done in code and documented like evidence.

PERSONNEL RECORD

STANDARD FORM 2026 · FILE 2026-KMK-01
Name
AL KURDI, Mahmoud (“Michael”)
Station
Charlotte, North Carolina — open to remote
Status
Available for full-time roles
Sought
SOC Analyst · Security Operations · Incident Response · Junior Detection Engineer · Security Automation

Certification

CompTIA Security+ ce (SY0-701)
Issued January 7, 2025 — valid through January 7, 2028.

SECURITY+ CE · SY0-701 · VALID THRU 01/2028 · CERTIFIED JAN 07 2025

Education

B.S. Information Technologies — Cybersecurity concentration
Southern New Hampshire University · completed December 2025, conferred January 1, 2026
Summa Cum Laude, 3.96 GPA · Sigma Psi chapter of Alpha Sigma Lambda honor society

Service Record

Period Organization Position
2015–2023 American Airlines — Charlotte, NC Aviation Security Operations Crew Chief. Federally regulated international flight operations under FAA/OSHA/IATA/CBP; security clearance with CBP badge endorsement; recurrent incident-response and safety/security training; identity validation, access control, high-accountability documentation.
2024–2025 USPS — Kannapolis, NC Courier & Logistics Specialist
2025–present Fossa Logistics LLC (Amazon DSP) — Charlotte, NC Delivery Associate
Request Certified Copy — PDF

ROUTING & TRANSMITTAL SLIP

OPTIONAL FORM 41 (adapted)
  • For reply — hiring conversation
  • For review — résumé attached to file, Exhibits A–D public
  • For filing — not recommended; subject is available now
Email kurdi.michael.it@gmail.com
Phone (704) 456-8322
GitHub github.com/KM-it-ops
LinkedIn linkedin.com/in/mahmoud-michael-al-kurdi
Site km-it-ops.github.io