Baraa Alsayyed

Penetration Tester delivering end-to-end security assessments across web applications, APIs, Active Directory, internal networks, and high-security environments. Skilled across the full assessment lifecycle reconnaissance, manual testing, vulnerability validation, exploitation, post-exploitation, proof-of-concept development, and technical reporting. Proven track record assessing applications and systems, engineering custom offensive-security scripts, and delivering remediation-ready reports that translate directly into measurable risk reduction.

Certified in OSCP, eWPTX, eCPPT, CRTA, CRTOM, eJPT and ISC2.

Information Security Officer & Penetration Tester at National Cyber Security Center (2022-07 – 2026-04)

• Executed end-to-end penetration tests and adversary simulations for government entities across web applications, APIs, enterprise networks, and Active Directory, surfacing critical attack paths before adversaries could exploit them.
• Identified, validated, and exploited high-impact vulnerabilities through reconnaissance, enumeration, privilege escalation, and lateral movement, backing every finding with reproducible proof-of-concept evidence.
• Assessed government applications, systems, and internal networks, exposing attack paths, access-control weaknesses, credential exposure, and Active Directory misconfigurations that shaped remediation priorities.
• Built custom Python and PowerShell tooling to automate reconnaissance, enumeration, exploitation, and PoC validation, cutting manual testing time and expanding assessment coverage.
• Authored technical and executive-level security assessment reports, translating attack paths and risk impact into prioritized, remediation-ready recommendations while maintaining strict confidentiality.

Information Technology Specialist at OtterSec (2023-02 – 2025-03)

• Delivered L2 technical and security support to 235+ users, resolving Windows endpoint, application, network, and access-control issues while sustaining high service continuity.
• Administered Active Directory and Microsoft 365 identities, permissions, and onboarding/offboarding workflows, enforcing least-privilege access across the full account lifecycle.
• Restored secure, reliable connectivity by troubleshooting LAN/WAN, VPN, DNS, DHCP, Wi-Fi, switching, and routing issues.
• Strengthened endpoint security posture through hardening, patch management, firewall operations, backups, and security-incident escalation, backed by thorough technical documentation.

Founder & Team Lead at QnQSec (2024-02 – Present)

Competitive cybersecurity/CTF team

• Founded and lead a 50+ member international offensive-security team, driving it to a top-95 global ranking on CTFtime.
• Direct hands-on technical training across web exploitation, Active Directory, privilege escalation, lateral movement, OSINT, and attack-path analysis, sharpening the team's competitive edge.
• Design realistic CTF challenges that reproduce web-application and enterprise attack scenarios for international competitions.
• Directed QnQSec CTF 2025 end-to-end — challenge quality assurance, infrastructure, scoring, and live operations — distributing $20,000+ in prizes.

Cybersecurity Educator at Cyber-eto (2024-02 – Present)

• Deliver hands-on ethical-hacking and offensive-security workshops for university students, translating advanced attack techniques into structured, practical labs.
• Design and deliver CTF challenges covering Active Directory exploitation, web vulnerabilities, and OSINT for live international competitions.
• Led technical delivery of Cyber-eto CTF 2025 at Philadelphia University, overseeing challenge operations and $10,000+ in prize distribution.
• Led the competitive team at Black Hat MEA 2024, a Guinness World Record-certified event featuring 250 teams from 90+ nationalities.
• Placed 54th in the Black Hat MEA CTF 2024 finals and 71st in the 2025 finals; secured 5th place in both the IEEE Penetration Testing Competition and CyPetra CTF, Jordan.
• Competed with QnQSec across 61 CTFtime-rated events in 2025, propelling the team to 95th globally and 2nd in Jordan.
• Delivered top-team finishes including 1st at ACECTF 1.0, 2nd at ApoorvCTF 2025, 3rd at Breach CTF 2025, and 4th at BITSCTF 2025, plus top-10 results at No Hack No CTF, BroncoCTF, ECTF, TAMUctf, WolvCTF, x3CTF, and K!nd4SUS CTF.
• Ranked in the top 1% globally and top 10 in the UAE on TryHackMe.

Bachelor of Science in Cybersecurity – The Hashemite University (2022 – 2026)