Available for Opportunities

Hello, I'm

Syed Farhan Ahmed

>  Head of Cyber Security

A hands-on Head of Cyber Security with 15 years in IT and the last nine in security. Specialised in Penetration Testing, CHFI Forensics, Mobile/Windows Forensics, and ISO 27001 compliance.

CISMCISA PNPT CEH CHFI ISO 27001 CSA Mobile Forensics
15+Years
Experience
21+Industry
Certifications
1750+Endpoints
Secured
5Tools on
GitHub
Hire Me View ExperienceDownload CV
LinkedIn GitHub
Syed Farhan Ahmed, Head of Cyber Security, in a navy blazer
How I lead
Lead from the front
How I respond
Calm under attack
How I build
People first, then tools
How I decide
Trust, then verify
Scroll Down
Penetration Testing CHFI Forensics ISO 27001 CEH Certified Mobile Forensics FortiGate Sophos XG Wazuh SIEM IBM QRadar Elastic SIEM Zabbix Vulnerability Assessment Incident Response EDR Solutions Threat Hunting Windows Server Azure
About Me

Know Who I Am

Syed Farhan Ahmed at work, reviewing security dashboards at his workstationSyed Farhan Ahmed at work, reviewing security dashboards at his workstation
15+ Years of
Experience

Head of Cyber Security &
DFIR, SIEM and Detection Engineering

I'm Syed Farhan Ahmed, Head of Cyber Security, with 15 years in IT and the last nine in security. I specialise in Penetration Testing (CEH), Computer Forensics (CHFI), Mobile & Windows Forensics, and ISO/IEC 27001 information security compliance.

I work with Oxygen Forensic Detective 18.2, Magnet AXIOM 10.1, and Mobiledit Ultra Pro 9.8, and my forensic work established the evidence in a PKR 80 million corruption case.

At F Tech Solutions (Dawat-e-Islami) I run security across a head office estate of 1,750+ endpoints, Madani Channel included: SIEM, enterprise firewalls, and the penetration testing programme, which I still do hands-on.

A growing part of my work is AI automation for security: eight AI agents that support SIEM rule development, file integrity monitoring and continuous monitoring, an automated scanning platform I am building for the organisation's own estate, and the open tools on my GitHub.

A recognised Bug Bounty Hunter, acknowledged by HackerOne (#7 Pakistan), OPPO (#1), AT&T, Mastercard, Rockstar Games, Logitech, Dell, Adobe, Sophos & Xiaomi.

Get in Touch LinkedIn
NameSyed Farhan Ahmed
LocationKarachi, Pakistan
Emailsyedfarhan6669@gmail.com
Phone+92 311 1256221
Experience15+ Years in IT, 9+ in Security
EducationBachelor of Technology (Hons), Telecommunication
LanguagesEnglish, Urdu
StatusAvailable
Career

Professional Journey

Feb 2023 to Present Current

Head of Cyber Security

F Tech Solutions (Dawat-e-Islami)
  • Led the response to a compromise affecting 11 production hosting servers, where attackers entered through compromised SSH keys and used backdoor accounts, tampered with authorised key files and modified cron jobs for persistence. Contained it, remediated every host, and ran the root cause investigation
  • Built the detection engineering capability from zero to 124 custom Wazuh rules covering 43 MITRE ATT&CK techniques, with gap analysis across initial access, execution, persistence and privilege escalation
  • Ran the hardening programme that followed, moving the SOC from reactive response to proactive detection: process attribution through auditd and whodata, file integrity monitoring gaps closed, and a fleet-wide credential rotation
  • Designed and built eight AI agents to support security operations, including SIEM rule development, File Integrity Monitoring, continuous monitoring, and internal tooling for assessment tracking and vulnerability dashboards
  • Tested the organisation’s 400+ domain estate personally, and now direct a scheduled programme covering 50+ core applications across OWASP Top 10, API security, access control and business logic
  • Act as the organisation’s forensic examiner, specialising in mobile forensics with licensed Oxygen Forensic Detective and Magnet AXIOM, and lead internal investigations including a PKR 80 million corruption case
  • Analyse malware and webshells hands-on, and reverse engineer untrusted third-party binaries before they reach production
  • Built the cybersecurity department from the ground up across offensive, defensive and governance functions, and hired and now lead the team across penetration testing, DevSecOps and SOC
  • Security operations across a Head Office environment of 1,750+ endpoints, including Madani Channel
Oct 2017 to Feb 2023

IT Security Analyst

F Tech Solutions (Dawat-e-Islami)
  • Built the organisation’s security monitoring capability across its operating divisions and established the forensic practice: evidence handling procedures, tooling and reporting standards
  • Deployed endpoint protection, encryption and firewall controls across the estate
  • Designed network infrastructure to meet connectivity and reliability requirements
Oct 2016 to Oct 2017

Helpdesk Manager

F Tech Solutions (Dawat-e-Islami)
  • Managed the IT help desk function and day-to-day service delivery
Feb 2015 to Oct 2016

IT Support Officer, Help Desk

F Tech Solutions (Dawat-e-Islami)
  • International video/audio conference management
  • Network installation & troubleshooting
  • Multi-platform OS support (Windows, macOS, Android)
  • Remote patch management & configuration
Nov 2011 to Apr 2013

IT Support and Network Solutions

SINA Sadiq Intl News (Pvt.) Ltd.
  • System log analysis & issue identification
  • Hardware/software installation & laptop anti-theft security
  • Wired & wireless network deployment
Sep 2011 to Mar 2012

System Security and Network Support

Sunny Co International (Pvt.) Ltd.
  • Network installation & troubleshooting
  • Endpoint security, logging & system support
Aug 2011 to Nov 2014

IT Instructor

Finest Computer Institute (Pvt.) Ltd.
  • CompTIA A+ & Network+ teaching
  • Mentored students through A+ and Network+
Credentials

Professional Certifications

21 certifications from 11 issuing bodies, across offensive security, forensics, SOC and compliance
Primary
PNPT

PNPT, Practical Network Penetration Tester

TCM Security

TCM Security. Hands-on network penetration testing assessed by full engagement and report.

IssuedSep2025 Verify
APT-TH

Black Hat APT Threat Hunting & IR

Black Hat
IssuedAug2023 Verify
Primary
ISO 27001

ISO/IEC 27001, Information Security Associate™

SkillFront

ISMS framework implementation, security controls, risk assessment methodologies, and compliance auditing.

IssuedJan2021 Verify
CNSS

CNSS, Network Security Specialist

ICSI International Cybersecurity Institute
IssuedMay2020 Verify
2 credentials
eJPT v2 · ICCA

INE Security Certifications

INE Security
  • eJPT v2, Junior Penetration TesterFeb 2026
    Verify
  • ICCA, INE Certified Cloud AssociateOct 2025
    Verify
Issued2025 to 2026
Primary2 credentials
CISM · CISA

ISACA Certifications

ISACA
  • CISM, Certified Information Security ManagerApr 2021
    Verify
  • CISA, Certified Information Systems AuditorSep 2016
    Verify
Issued2016 to 2021
2 credentials
CCNA · IOC

Cisco Certifications

Cisco
  • Introduction to CybersecurityApr 2021
    Verify
  • CCNA, Cisco Certified Network AssociateApr 2009
Issued2009 to 2021
2 credentials
NSE 1 - 2

Fortinet NSE Level 1 & 2

Fortinet
  • NSE 1 Network Security AssociateApr 2020
    Verify
  • NSE 2 Network Security AssociateApr 2020
    Verify
IssuedApr2020
Primary3 credentials
CHFI · CSA · CEH

EC-Council Certifications

EC-Council
  • CHFI, Computer Hacking Forensic InvestigatorAug 2026
    Verify
  • CEH, Certified Ethical HackerMar 2023
    Verify
  • CSA, Certified SOC AnalystSep 2022
    Verify
Issued2022 to 2026
3 credentials
CSFP · CAPC · RWPC

CertiProf Certifications

CertiProf, via Credly
  • CAPC, Cybersecurity Awareness Professional CertificationSep 2024
    Verify
  • RWPC, Remote Work Professional CertificationDec 2022
    Verify
  • CSFPC, Cyber Security Foundation Professional CertificateJan 2021
    Verify
Issued2021 to 2024
3 credentials
MCSA · MCP

Microsoft Certifications

Microsoft · MCP transcript ID 11408094
  • Microsoft Specialist: Implementing Azure Infrastructure SolutionsDec 2014
  • MCSA: Office 365Nov 2014
  • Microsoft Certified ProfessionalNov 2014
IssuedNov to Dec2014 Verify
Expertise

The Four Jobs I Do

Everything I do, grouped by the four jobs a security function has to do, with the tools I use and one result from my own record.

Build

Engineering and automation

Secure design, and the detection that catches what slips through it.

Detection
  • Wazuh detection engineering
  • MITRE ATT&CK mapping
  • auditd and whodata
  • File integrity monitoring
  • AI agents for SOC work
Hardening
  • Linux and Windows hardening
  • CIS benchmarking
  • FortiGate and Sophos firewalls
  • VPN, VLAN and wireless security
Cloud and systems
  • Windows Server and virtualisation
  • Microsoft Azure and Office 365
  • AWS workload security
Proof

Built detection engineering from zero to 124 custom Wazuh rules covering 43 MITRE ATT&CK techniques, and designed eight AI agents for SIEM rule development, file integrity monitoring and continuous monitoring.

Break

Offensive security

Finding the way in before someone else does.

Testing
  • Web and API penetration testing
  • OWASP Top 10
  • Access control and business logic
  • Vulnerability assessment
  • Mobile and network testing
Adversary
  • Red team work
  • Social engineering testing
  • Bug bounty
Analysis
  • Malware and webshell analysis
  • Reverse engineering of third-party binaries
Proof

Tested the organisation's 400+ domain estate personally, and now direct a scheduled programme across 50+ core applications, with retesting to confirm each fix holds.

Defend

SOC, response and forensics

Watching, hunting, responding, and proving what happened.

SOC
  • SOC operations
  • Wazuh, QRadar and Elastic SIEM
  • Zabbix monitoring
  • Threat hunting
  • Incident and ransomware response
Forensics
  • Oxygen Forensic Detective 18.2
  • Magnet AXIOM 10.1
  • Mobiledit Ultra Pro 9.8
  • Disk imaging, data recovery and chain of custody
Endpoint
  • EDR and Open EDR
  • Employee and asset monitoring
Proof

Led the response to a compromise of 11 production hosting servers entered through compromised SSH keys: contained it, remediated every host and ran the root cause investigation.

Govern

Risk and compliance

Policy, risk and audit, and the team that carries them.

Standards and audit
  • ISO/IEC 27001 and ISMS
  • Security policy
  • Compliance
  • IS audit (CISA)
Risk and access
  • Risk assessment
  • Access governance
People
  • Security awareness training
  • Phishing simulation
  • Team leadership
Proof

Built the cybersecurity department from the ground up, set its scope across offensive, defensive and governance work, and now lead the team across penetration testing, DevSecOps and SOC.

Forensic note: I lead the forensic work myself, from ransomware response to internal investigations. One of them established the evidence in a PKR 80 million corruption case using Magnet AXIOM and Oxygen Forensic Detective, resulting in formal legal action.
Open Source

Tools I Build, Live from GitHub

Five public repositories. Stars, licence and last update come from the GitHub API and refresh when the page loads. Each card says plainly how far along the tool is.

github.com/farhan6667Syed Farhan Ahmed (SFA)Security tooling, detection engineering and AI automation, published in the open.
  • 5Public tools
  • 4Open source
  • 2Languages
Follow on GitHub
Detection engineering

Wazuh RuleGuard

Checks a Wazuh rule change against sample logs through the logtest API before it ships.

  • Python
  • Apache-2.0
  • 1 star
  • Updated 6 days ago
Early prototypeView on GitHub
Detection engineering

Wazuh NoiseLens

Shows which alerts a proposed Wazuh exception would hide, so you can judge it before you add it.

  • Python
  • Apache-2.0
  • 1 star
  • Updated 6 days ago
Early prototypeView on GitHub
AI agents for pen testing

HexSwarm

A Python framework that runs a swarm of AI agents against authorised penetration testing and CTF targets, gated by an explicit scope file.

  • Python
  • MIT
  • Updated 3 days ago
Latest release v1.0.112 Oct 2026
Alpha, open sourceView on GitHub
MCP server

no-api-media-mcp

Makes images and video from Claude Code, Cursor or Codex with the subscriptions you already pay for. No API keys.

  • TypeScript
  • Apache-2.0
  • 1 star
  • Updated yesterday
Latest release v1.3.011 Oct 2026
Open sourceView on GitHub
Linux desktop

SFA Monitor

A performance widget and task manager for the Linux desktop.

  • Free, not open source
  • Updated 2 days ago
Latest release v1.0.113 Oct 2026
Free to use, not open sourceView on GitHub
Built inside the organisation

AI and automation I run at work

These are internal, so there is no code or screenshot to show. What they do, in general terms:

Automated security testing

Scanning platform for our own estate

Runs several vulnerability scanners on a schedule across the organisation's 400+ domains, has an AI model triage the findings, and keeps a running record for reporting. It only accepts targets on an approved list of the organisation's own domains, and every action is tied to a signed-in, role-based account.

  • AI triage
  • Allow-listed targets only
  • Role-based access
In developmentInternal
SOC automation

Eight AI agents for security operations

Agents I designed for SIEM rule development, file integrity monitoring, continuous security monitoring, and internal tooling for assessment tracking and vulnerability dashboards. I define the tasks, workflows and security requirements, and review what they produce.

  • SIEM rules
  • File integrity
  • Dashboards
In useInternal
View all repositories

The Wazuh tools are independent projects and are not affiliated with or endorsed by Wazuh.

Foundations

Training & Course Completions

Ten classroom, academy and online courses completed across my career. These are completion certificates from the training provider, not credentials issued by the certifying body, so they are listed separately from the certifications above.

TIC CIU Certified WAN Associate

Dec 2014
Technology Incubation Center CIU

Career certification programme, scored 81 per cent

TCCWA3948220238

HP LIFE e-Learning: IT for Business Success

Dec 2014
HP

Choosing and putting technology solutions in place against business goals

1613875-39098

MCITP Enterprise Server 2008

Aug to Dec 2014
CTTC (Pvt) Ltd

Windows 7, Server 2008 network, directory and applications infrastructure

Network Plus

Jul to Sep 2012
CTTC (Pvt) Ltd

Networking fundamentals, media, protocols and troubleshooting

A+ Certification

Jun to Aug 2012
CTTC (Pvt) Ltd

Hardware, operating systems and end user support

Network+ Certification

Dec 2011
Silicon Technologies

Hands-on, lab oriented course in building and maintaining computers

Student ID 00659

CCNA Discovery: Networking for Home & Small Businesses

Dec 2008
Cisco Networking Academy, Azfam Technologies

The earlier CCNA curriculum: small business networking, connectivity and basic IP services

CCNA 8.0

Feb to May 2015
CTTC (Pvt) Ltd

The CCNA course again on the newer 8.0 version, to keep current

Student ID 12689

MS Office Diploma

Apr to Sep 2004
Finest Computer Institute, Karachi

Word, Excel and PowerPoint XP, graded A-One

MCSE PC & Internet Security

Undated
Microsoft Certificate of Excellence

PC and internet security, held as a paper certificate

Personal

Hafiz-e-Quranحافظ القرآن

Madrasa-tul-Madina, Landhi, Karachi

Complete memorisation of the Quran, certified after examination.

Registration 153Certificate 4676
Sep 2005
Recognition

Hall of Fame

Companies that have credited my responsible security research.

HackerOne

Ranked #7 Pakistan July 2019

OPPO

Ranked #1 May 2021

OPPO

Ranked #4 Snails 2020 Reward

AT&T

Acknowledged Bug Bounty

Mastercard

Acknowledged Security Research

Rockstar Games

Acknowledged Vulnerability

Logitech

Acknowledged Bug Report

Xiaomi

Acknowledged Security Research

Sophos

Acknowledged Vulnerability

Dell

Acknowledged Security Research

Adobe

Acknowledged Bug Report
Education

Academic Background

B.Tech, Telecommunication

Newports Institute

Bachelor of Technology Degree

D.A.E., Computer Information Technology

Sindh Board of Technical Education, Karachi

3 Years Diploma in CIT

Hafiz-e-Quran

Islamic Studies

Complete Quran memorisation

FAQ

Frequently Asked Questions

Direct answers about my work, my certifications and how to reach me

Who is Syed Farhan Ahmed (SFA)?

Syed Farhan Ahmed, known as SFA, is the Head of Cyber Security at F Tech Solutions (Dawat-e-Islami) in Karachi, Pakistan. He has 15 years in IT and the last nine in security, and he built the cybersecurity department he now leads.

What does he specialise in?

Detection engineering with Wazuh mapped to MITRE ATT&CK, digital forensics and incident response, penetration testing, and governance with ISO/IEC 27001. He stays hands-on: he still tests systems himself and works as a SOC engineer when the team needs another pair of hands.

Is he open to remote work?

Yes. He is open to remote cyber security leadership roles. Email or LinkedIn is the quickest way to start that conversation.

Which certifications does he hold?

21 certifications from 11 issuing bodies. The main ones are CISM and CISA from ISACA, CHFI, CEH and Certified SOC Analyst from EC-Council, PNPT from TCM Security, eJPT from INE Security, and the ISO/IEC 27001 Information Security Associate. The Certifications section lists each one with a verification link where the issuer provides one.

What tools has he built?

He publishes five tools on GitHub: Wazuh RuleGuard, Wazuh NoiseLens, HexSwarm, no-api-media-mcp and SFA Monitor. At work he built 124 custom Wazuh rules covering 43 MITRE ATT&CK techniques and eight AI agents that support SIEM rule development, file integrity monitoring and continuous monitoring.

What incident response and forensics work has he led?

He led the response to a compromise of 11 production hosting servers, from containment to root cause. He is also his organisation's forensic examiner, working mainly on mobile devices with Oxygen Forensic Detective and Magnet AXIOM, and his forensic work established the evidence in an internal corruption case.

Where is he based?

Karachi, Pakistan, on Pakistan Standard Time (UTC+5). He works in English and Urdu.

How can I contact him?

Email syedfarhan6669@gmail.com or call +92 311 1256221. You can also message him on LinkedIn at linkedin.com/in/sfa6667, and the CV is a two-page PDF you can download from this page.

Still have a question?Ask me directly
LinkedIn

Find Me on LinkedIn

The same career, in the format recruiters read

LinkedIn cover of Syed Farhan Ahmed: Detection Engineering, DFIR, Threat Hunting
Syed Farhan Ahmed, LinkedIn profile photo with the Open to Work frame

Syed Farhan Ahmed (SFA)

Head of Cyber Security | Digital Forensics and Incident Response | SIEM and Detection Engineering

Karachi, Pakistanlinkedin.com/in/sfa6667

Open to remote cyber security leadership roles
  • Head of Cyber SecurityF Tech Solutions (Dawat-e-Islami), since February 2023
  • Bachelor of Technology (Hons), TelecommunicationNewports Institute of Communications and Economics
  • CISM
  • CISA
  • CHFI
  • CEH
  • PNPT
  • eJPT
  • CSA
  • ISO 27001
View my LinkedIn profile
Contact

Let's Connect

Want to talk about a role or a security problem? Let's talk.

Emailsyedfarhan6669@gmail.com
Phone+92 311 1256221
LinkedInlinkedin.com/in/sfa6667
Curriculum VitaeDownload PDF