Baraa Alsayyed

Penetration Tester with hands-on experience delivering security assessments across web applications, APIs, Active Directory, internal networks, and high-security environments.

Experienced across the full assessment lifecycle: reconnaissance, manual testing, vulnerability validation, exploitation, post-exploitation, proof-of-concept development, and technical reporting. Assessed 25+ applications and systems, developed 10+ custom offensive-security scripts, and delivered 20+ remediation-ready reports. Certified in eWPTX, eCPPT, CRTA, CRTOM, and eJPT.

Cybersecurity Manager at QnQSec (2024-12 – Present)

• Built and now lead a 50+ member international offensive-security team ranked among CTFtime's global top 100.
• Direct technical practice across web exploitation, Active Directory, privilege escalation, lateral movement, OSINT, and attack-path analysis.
• Designed realistic CTF challenges that reproduce web-application and enterprise attack scenarios for international competitions.
• Led QnQSec CTF 2025 end to end, including challenge quality assurance, infrastructure, scoring, live operations, and distribution of $20,000+ in prizes.

Information Security Officer & Penetration Tester at National Cyber Security Center (2025-06 – 2026-04)

• Executed end-to-end penetration tests and adversary simulations across 20+ production and high-security environments, covering web applications, APIs, enterprise networks, and Active Directory attack paths.
• Identified, validated, and exploited vulnerabilities across 25+ applications and systems; documented business impact, technical evidence, and reproducible proof-of-concept steps.
• Developed 10+ custom exploit and automation scripts, reducing proof-of-concept validation time and shortening remediation timelines by 30%.
• Produced 20+ technical and executive-ready assessment reports with prioritized findings and actionable remediation guidance, helping reduce the average exposure window by two weeks per engagement.
• Completed a full network penetration test three days ahead of schedule while maintaining assessment depth, reporting quality, and strict confidentiality.

Information Technology Specialist at OtterSec (2023-07 – 2025-03)

• Delivered L2 technical and security support for 235+ users across Windows endpoints, business applications, network services, and access-control issues.
• Administered Active Directory and Microsoft 365 identities, permissions, onboarding, and offboarding, supporting least-privilege access and account lifecycle controls.
• Troubleshot LAN/WAN, VPN, DNS, DHCP, Wi-Fi, switching, routing, and endpoint issues to restore secure and reliable connectivity.
• Supported endpoint hardening, patch management, firewall operations, backups, security-incident escalation, and technical documentation.

Cybersecurity Training Program at Eng. Ahmad H Al-Mashaikh (2025-01 – Present)

• Conducted vulnerability assessments and penetration tests across simulated enterprise environments, documenting attack paths, findings, and remediation actions.
• Performed Splunk-based SOC monitoring, alert triage, investigation, and incident-response exercises at L1 and L2 levels.
• Applied MITRE ATT&CK, NIST CSF, and ISO 27001 to offensive-security, detection, and risk scenarios.
• Completed hands-on Linux hardening and enterprise firewall exercises using Fortinet FortiGate and Palo Alto technologies.

Cybersecurity Educator at Cyber-eto (2024-06 – Present)

• Deliver practical ethical-hacking and offensive-security workshops for university students, translating complex attack techniques into structured labs.
• Design and test CTF challenges covering Active Directory exploitation, web vulnerabilities, and OSINT for live competitions.
• Led technical delivery of Cyber-eto CTF 2025 at Philadelphia University, supporting challenge operations and $10,000+ in prizes.
• Led the team at Black Hat MEA 2024, a Guinness World Record-certified event featuring 250 teams and participants from 90+ nationalities.
• Placed 54th in the Black Hat MEA CTF 2024 finals and 71st in Black Hat MEA CTF 2025.
• Placed 5th in the IEEE Penetration Testing Competition and 5th in CyPetra CTF, Jordan.
• Competed with QnQSec in 61 CTFtime-rated events during 2025, helping the team finish 95th globally and 2nd in Jordan.
• Top team finishes: 1st at ACECTF 1.0, 2nd at ApoorvCTF 2025, 3rd at Breach CTF 2025, and 4th at BITSCTF 2025.
• Additional top-10 finishes: No Hack No CTF, BroncoCTF, ECTF, TAMUctf, WolvCTF, x3CTF, and K!nd4SUS CTF.
• Ranked in the top 1% globally and top 10 in the UAE on TryHackMe.

Bachelor of Science in Cybersecurity – The Hashemite University (2022 – 2026)