# Omar Maarouf (عمر معروف)

> Security Engineer & Systems Architect. Omar Maarouf is a security engineer and systems architect in Egypt: secure architecture, DevSecOps, penetration testing and defensive engineering.

I'm a security engineer and systems architect. My work covers the full security lifecycle: designing systems so the secure path is the default one, building the platforms and pipelines they run on, testing them as an adversary would, and hardening and monitoring them once they're live.

DevOps is part of that architecture practice, not a separate service. Infrastructure as code, CI/CD and container platforms are where security controls either keep working or quietly disappear, so that's where I put them. Having built systems as well as broken them, I write recommendations that engineering teams can actually ship.

## Capabilities

### Architect: Systems architecture & secure design
Shaping systems before they're built, so security is a property of the design rather than a layer added at the end.
- Threat modelling
- Architecture and design reviews
- Identity and access design
- Network segmentation and zero-trust models
- Typical outputs: Threat models, reference architectures, decision records

### Build: Platform engineering & DevSecOps
Building the delivery path with security gates that run on every change, not once a year.
- CI/CD pipeline design
- Infrastructure as code
- Container platforms and secrets management
- SAST, dependency and image scanning in the pipeline
- Typical outputs: Pipelines, IaC modules, hardened baselines

### Break: Offensive security
Testing systems the way a real attacker would, then proving each finding before it's reported.
- Web application and API testing
- Internal network and Active Directory
- Android and iOS applications
- Attack-path analysis
- Typical outputs: Verified findings, CVSS ratings, remediation plan

### Defend: Defensive engineering & operations
Keeping systems in a known-good state and making sure you'd notice when they leave it.
- System hardening against CIS benchmarks
- Logging and detection engineering
- Vulnerability management
- Incident response readiness
- Typical outputs: Hardening guides, detection rules, runbooks

## Where he works in the stack

- Applications & APIs: Design review, code review, penetration testing
- Delivery pipeline: CI/CD, infrastructure as code, supply chain
- Platform: Containers, orchestration, secrets
- Infrastructure: Cloud and on-prem design, hardening
- Network: Segmentation, exposure, traffic control
- Identity: Active Directory, access models

## Principles

- Secure by default, not by checklist. Controls belong in the architecture and the pipeline, where they keep working after the audit ends.
- Evidence before opinion. Every finding is reproduced, and every recommendation is grounded in how the system actually behaves.
- Fixes that engineers can ship. Remediation is written for the team that owns the code, and ordered by real risk.
- Discretion as standard. Client systems, data and findings stay confidential.

## Tools and frameworks

- Architecture & infrastructure: Linux, Windows Server, Active Directory, AWS, Azure, TCP/IP & routing
- DevOps & platform: Docker, Kubernetes, Terraform, Ansible, GitHub Actions, GitLab CI
- Offensive: Burp Suite, Nmap, BloodHound, Impacket, MobSF, Frida
- Defensive & frameworks: Wazuh, Sysmon, CIS Benchmarks, MITRE ATT&CK, OWASP ASVS, NIST CSF

## Selected work

- [Law System Management App](https://github.com/omarmaarouf18/law-system-management-app-): Case and workflow management for legal practices: data model, role-based access and the application structure around them.
- [Mini System Manage](https://github.com/omarmaarouf18/mini-system-manege): A lightweight management system built around a clear module structure and practical day-to-day workflows.

## Facts

- Practice: Secure architecture, DevSecOps, offensive and defensive security
- Based in: Egypt, working remotely
- Languages: Arabic, English

## Contact

- Website (English): https://omar-maarouf.me/
- Website (Arabic): https://omar-maarouf.me/ar/
- Email: sec-eng@omar-maarouf.me
- Phone: +201034165405
- LinkedIn: https://www.linkedin.com/in/omar-maarouf-12776737a
- GitHub: https://github.com/omarmaarouf18
- X: https://x.com/omar_maarouf_
- Instagram: https://www.instagram.com/omar___maarouf/
- Facebook: https://www.facebook.com/omarmaaouf/

Last updated: 2026-10-26