Sami Ali

Resume

Security tools, checked against what they claim. One page each, text-searchable PDF.

Security Engineering resume (PDF, 166 KB) Red Team version (PDF, 168 KB)

The Red Team version has the same experience and education and leads with vulnlab, then tripline's evasion measurements and sinkline's independent benchmark; it leaves out the kevgate pipeline. The PDFs are exports of the facts below.

Education

  • George Mason University, B.S. Information Technology, Cybersecurity Minor. Expected May 2028.
  • Northern Virginia Community College, A.S. Information Technology, May 2026. GPA 3.7.

Experience

U.S. Department of Homeland Security (CBP), HS-POWER Program, Vulnerability Assessment Team analyst intern, Ashburn, VA, May 2026 to August 2026. Bullets on the experience page.

Projects

  • tripline (v0.3.0): detection-as-code quality gate in Python. Compiles Sigma rules to Python predicates, replays recorded telemetry for 14 ATT&CK techniques, fails pull requests when an expected rule stops firing. 212 tests; 13 scenarios passing, 1 pending; 98% prevalence-weighted coverage, 52% on unmodified SigmaHQ rules alone; 200 of 251 evasion variants caught, 2 false-positive matches on 675 benign events. Reading: the stock SigmaHQ setuid rule flagged 0 of the 2 attack events among 36 recorded events; the replacement flags both. Recording run, red because the stock rule missed the attack: run 41838714456 failed 2026-11-04; latest passing run on main: run 43100952362 passed 2026-11-11
  • sinkline (v0.5.1): static analyzer for Python web apps. Interprocedural taint analysis, 43 rules and 151 sink signatures mapped to OWASP Top 10 and CWE, SARIF output, GitHub Action, no dependencies, 184 tests. On OWASP BenchmarkPython v0.1 (10 taint categories) it scores +0.52 TPR minus FPR (0.4.1: +0.21; Bandit +0.07), but the fixes were chosen from the 0.4.1 failures, and over all 14 categories Bandit leads, +0.36 to +0.27. run 43136290658 passed 2026-11-12
  • kevgate (v0.1.1): FastAPI vulnerability-intake service ranking findings by CISA KEV, EPSS, CVSS and asset criticality. Hashed scoped API keys, rate limiting, JSON logs, Prometheus metrics, container, Helm chart, Terraform validated against LocalStack, and a GitHub Actions security pipeline. 277 tests. run 42960808156 passed 2026-11-11

Skills

Python. Sigma, MITRE ATT&CK, Atomic Red Team, taint analysis and SAST, OWASP Top 10, Nessus/Tenable, CISA KEV, EPSS and CVSS, NIST CSF. AWS fundamentals, Docker, Kubernetes and Helm (kind in CI), Terraform, GitHub Actions, Prometheus. Git, pytest, Power BI, Wireshark, Linux.

Certifications

CompTIA Security+, AWS Certified Cloud Practitioner. In progress: AWS Certified Security - Specialty, OSCP.

Contact

samiali38183@gmail.com, linkedin.com/in/sami-ali-1a4b89345, github.com/samiali38183. U.S. citizen.