AI Security · Threat Intelligence · Detection Engineering
Abdulmuiz
Annafi
AI Security & Threat Intelligence Engineer
I build the pipelines, detection, and AI tooling that modern threat operations run on. Most of my work is the verification layer that makes automated security decisions hold up when a real decision is on the line.
About
I work where machine learning meets security operations. Day to day that means the pipelines and evaluation layers threat teams rely on: moving raw threat and vulnerability data through ingestion, normalization, enrichment, and detection, then layering models on top that analyze cases and drive response.
A confident wrong answer in security is worse than no answer, so a lot of my work is the verification and guardrails around a model, not just the model itself. That is the difference between a demo and something an analyst will actually trust.
- focus
- detection engineering, MLSecOps, CTI, AI security
- building
- AI-augmented threat intel and detection pipelines
- learning
- adversarial ML, agent security, evaluation frameworks
- based
- remote, open to relocation
Experience
Cyber Threat Intelligence Analyst, R&D
CyberSOC Africa
Designing and building AI-augmented security tooling in the R&D division, automating threat-detection pipelines and response workflows across the end-to-end CTI lifecycle, and participating in incident response for global financial institutions during active breaches.
Site Reliability & Platform Security Engineer
Zer0Paper OÜ · Contract
Built and secured the infrastructure layer of a multi-tenant PaaS, hardened tenant isolation, secrets management, and a Git-to-deploy pipeline with private registries and reproducible rollouts.
MLSecOps Engineer
IRIS-SOC
Built the intelligence pipeline of an AI-native SOC platform, from ingestion and ECS normalization through CTI enrichment, SigmaHQ detection, and MITRE ATT&CK mapping, feeding a model that analyzes cases and drives response.
Information Technology Security Analyst
Mainstream Global Insurance Brokers
Built a centralised insurance risk-quantification system in Python and ran vulnerability scanning and incident response across monitored systems.
Cybersecurity Intern
Access Bank Plc · Information & Cybersecurity Group
Supported SOC operations across alert triage, incident response, threat hunting, and vulnerability assessment with enterprise SIEM tooling, alongside senior analysts.
Selected work
-
SideDoor — Session Hijack Detection Lab flagship · public
Reproduces an MFA-bypass session hijack and the detection layer that catches it. Six context-comparison rules, four as Sigma, with multi-signal correlation and honest false-positive tuning.
python · sigma · opensearch · oidc · tls/pki
-
AI Incident Response & Vulnerability Agent visa harness
An IR and vulnerability agent that does not just generate findings, it validates them: adversarial verification confirms a finding is exploitable, multiple agents must agree before a result is kept, and a review panel grades proposed fixes, so only triage an analyst can act on reaches a human.
python · llm agents · visa vulnerability harness · adversarial verification
-
Mule Interceptor — Money-Mule Detection Agent zecathon 6.0
A graph engine fusing AML rules, network features, and an unsupervised model to catch money-mule networks, interrupt the cash-out, freeze funds, and draft a regulatory report. Deterministic agent, human-in-the-loop filing.
fastapi · networkx · scikit-learn · redis · react
-
AI-Augmented Security Advisory Pipeline deployed · client
Ingests NVD, CISA KEV, and GitHub Advisory data, vets each CVE against a client's stack, prioritises by exploited status and severity, and generates formatted monthly advisory reports with a human-review checkpoint. Replaced a manual analyst workflow.
python · nvd api · cisa kev · github advisory
-
Automated Alert-to-Ticket Pipeline
An LLM-driven triage service that ingests security alerts, classifies and enriches them, then opens structured, deduplicated GitHub issues for analysts, connecting detection output to the tools teams already work in.
python · llm integration · github api
-
External Attack Surface Management
Continuously discovers an organisation's external footprint and correlates it against live NVD and CISA KEV feeds to surface prioritised, exploitable vulnerabilities through an analytics dashboard.
react · fastapi · python · nvd / kev
-
Cyber Risk Quantification Platform
An actuarial Monte Carlo simulator using Poisson-Gamma compound distributions to model cyber loss frequency and severity, turning raw threat data into financial risk scores and pricing.
python · monte carlo · fastapi
-
Email Impersonation Detection Tool
Generates email-address variants through systematic name-mangling, then validates each via DNS/MX resolution and SMTP probing to expose live impersonation infrastructure, with real-time alerting.
fastapi · python · osint · dns / smtp probing · websockets
-
Ephemeral Encrypted Messaging
A real-time end-to-end encrypted messaging system using X25519 for key exchange with forward secrecy, HKDF for key derivation, and AES-GCM for authenticated encryption.
x25519 · hkdf · aes-gcm · python
Recognition
// programs & awards
- NVIDIA Inception — contributor, IRIS-SOC (2026)
- AWS Activate & Google for Startups — cloud credits secured
- Zenith Bank Zecathon 6.0 — Mule Interceptor, fraud & financial crime
- RAIN-INN National Hackathon — AI fraud detection
- B.Sc. Cybersecurity — Second Class Honours (Upper Division), 4.25/5.0
// backed by
// certifications
- Microsoft — Data & AI Security Engineer
- AWS — Certified Cloud Practitioner
- ISC2 — Certified in Cybersecurity (CC)
- Google — Cybersecurity Professional
- Cisco — Cisco Certified Network Associate (CCNA)
- Red Team Leaders — Certified LLM Security Professional
- Anthropic — Model Context Protocol
Writing
Detection that doesn't fire on a normal Tuesday
Anyone can catch an attack in a log full of attacks. The real work is everything you do so it stays quiet on benign traffic.
identity securityMost companies are not hacked. They are logged into.
MFA helped, so attackers moved to the session token. The question is whether you would notice when one is stolen.
ai securityThe model generates. The harness decides what to believe.
AI engineering for security is less about the model and more about the verification layer you wrap around it.
ai securityGiving an LLM tools is giving it an attack surface
The moment a model can act, every tool you connect becomes another door someone can try to walk through.
agent securityAnyone can give an agent tools
The real work is deciding what an agent is allowed to touch, and being able to explain it afterwards.
ai safetyA fully safe model is a limited one
Safety and capability pull against each other. Maybe that is the part we need to stop pretending about.
// contact
Let's talk.
Open to AI-security, detection, and threat-intelligence roles, research, and collaboration.