Case file № 26-0107 · Security Operations · Charlotte, NC
The analyst walked in with eight years of federally regulated security operations and a spotless paper trail. Security+ certified. Summa cum laude. Builds defensive tooling — and benchmarks the AI agents that build it. Every claim in this file maps to a public repo, a credential, or a document.
Act I
Who he is, where he's been, and why the paper trail holds up.
Investigator's notes — filed 2026
Eight years on the concourse at Charlotte Douglas. From 2015 to 2023, Mahmoud “Michael” Al Kurdi ran aviation security operations as a crew chief for American Airlines — security clearance, CBP badge endorsement, international flight operations under FAA, OSHA, IATA, and CBP requirements. Recurrent incident-response and safety training, year after year. Identity validation. Access control. The kind of work where documentation isn't paperwork — it's the whole case.
Then the pivot, deliberate and on the record. January 2025: CompTIA Security+ ce (SY0-701), valid through January 2028. December 2025: the degree — B.S. Information Technologies, cybersecurity concentration, Southern New Hampshire University. Summa cum laude, 3.96 GPA, inducted into the Sigma Psi chapter of Alpha Sigma Lambda. He kept the lights on with logistics work at USPS and an Amazon DSP while he did it.
What he wants now is plain: a seat on a security operations team — alert triage, incident response, detection engineering, security automation. What he brings is in the exhibits below. Draw your own conclusions; the evidence is public.
Act II
Evidence log. Four items entered into the record — all public, all reproducible.
Exhibit A
“One spec, many agents.”
A configuration framework for agentic AI coding assistants: write the spec once, deploy it to six adapter targets — Claude Code, Codex, Gemini CLI, Cursor, Aider, and a generic fallback. Published to npm as @kmitops/agentforge@0.3.1, MIT licensed.
Proof on file: adapter round-trip tests · install smoke tests · doctor CLI · readiness runbook · live demo
Exhibit B
Seven agents interrogated. One rubric. Nobody walked.
A reproducible, strictly defensive cybersecurity benchmark asking one question: can AI coding agents build secure, uncertainty-aware, MITRE ATT&CK–aligned defensive tooling? Seven agent artifacts were graded against a 100-point rubric — ATT&CK mapping discipline, prompt-injection resistance, evidence citation, uncertainty handling (“No Clear Mapping”), detection ideas, remediation guidance, and analyst follow-up questions. One branch per agent; the harness re-runs on demand via benchmark-all.ps1. MIT licensed.
Interrogation ledger — scores out of 100
MITRE ATT&CK® is a registered trademark of The MITRE Corporation.
Exhibit C
Everything broken, on one board.
A Python/Flask/SQLite dashboard for tracking what's vulnerable and what's been fixed: full CRUD, KPI cards, search, filtering, and severity states.
Stack: Python · Flask · SQLite
Exhibit D
The logs always talk. You just have to listen.
Rule-based and statistical detection in Python with pandas and NumPy, built for authentication and network anomaly triage.
Stack: Python · pandas · NumPy
Act III
The history, in order. Nothing sealed, nothing redacted.
2025 — Present
Fossa Logistics LLC (Amazon DSP) · Charlotte, NC
2024 — 2025
USPS · Kannapolis, NC
2015 — 2023
American Airlines · Charlotte, NC
Federally regulated operations under FAA, OSHA, IATA, and CBP requirements. Security clearance with CBP badge endorsement; international flight operations. Recurrent incident-response and safety/security training. High-accountability documentation, identity validation, and access control — eight years of it.
Credential
Issued January 7, 2025 · valid through January 7, 2028.
Education
Southern New Hampshire University. Completed December 2025, conferred January 1, 2026. Summa Cum Laude, 3.96 GPA · Sigma Psi chapter of Alpha Sigma Lambda.
One page. Typed. Signed off.
Epilogue
The office is open. Charlotte, North Carolina — remote works fine. If you're building a security operations team and want an analyst whose claims come with receipts, the channels are on the right.
“Somewhere in your stack, an alert is waiting to be read properly.
He reads them properly.”