Available for senior roles U.S. Citizen

Ashar S.
Ahmed

Software Engineer  ·  Cyber Security Advisor  ·  CISSP

I build and secure production systems for regulated environments: secure cloud infrastructure, detection pipelines, and compliance programs aligned to NIST CSF, CIS Controls v8, and ISO 27001. Engineering depth applied to defensible security outcomes.

View selected work Contact
4+
Years eng + security
<1h
MTTD, down from days
85%
CI/CD code coverage
CISSP
+ AWS · SSCP

From software engineering
to security assurance.

I bring an engineer's discipline to security: building the controls, instrumenting the telemetry, and shipping the tooling that proves a program is working.

I spent my early career building cloud infrastructure, backend services, and developer tooling: production systems on AWS with Terraform and Terragrunt, CI/CD pipelines, and automation across Python, TypeScript, PowerShell, and Bash.

That foundation is what makes the security work hold up. I do not just write the policy. I script the controls, instrument the telemetry, and maintain the tooling that demonstrates compliance. I work where security operations, governance and risk, and DevSecOps meet.

Citizenship
U.S. Citizen · Clearance-eligible
Focus
Security Ops · GRC · DevSecOps
Education
MSc Cybersecurity · BCompSci
Availability
Senior roles · Remote-friendly

Capabilities

Where I work: security operations, governance,
and the engineering underneath both.

Security Operations & Detection

Correlation-driven log pipelines across identity, endpoint, and network telemetry, engineered to cut detection time from days to under an hour.

Key areas
SIEM pipelines · MITRE ATT&CK · Telemetry · Alerting · MTTD under 1h

Governance, Risk & Compliance

Risk tracking, remediation SLAs, and KPI dashboards built on recognized frameworks, turning compliance into something measurable and prioritized.

Key areas
NIST CSF · CIS Controls v8 · ISO 27001 · Zero Trust (SP 800-207) · Remediation SLAs

Secure Software & Cloud

Production AWS infrastructure with policy-as-code, CI/CD quality gates, and secure SDLC practices baked into every module and pipeline.

Key areas
AWS · Terraform / Terragrunt · Checkov policy-as-code · CI/CD quality gates · Docker & Kubernetes
Stack & methods
01Languages
Python · TypeScript · PowerShell · Bash · SQL · PL/SQL
02Cloud & Infrastructure
AWS (IAM, S3, DynamoDB) · CloudWatch & CloudTrail · Azure · Terraform · Terragrunt · Docker · Kubernetes
03CI/CD & Tooling
GitHub Actions · Automated testing · Checkov · Coverage gates
04Observability
Prometheus · Grafana · Loki · Alertmanager · Structured logging
05Security & Compliance
Secure SDLC · Threat modeling · NIST CSF · CIS Controls v8 · ISO 27001 · MITRE ATT&CK · Zero Trust

Experience

Four roles across government, healthcare,
and applied AI · 2020–present.

May 2026 – Present

Technical Contractor

Mercor Intelligence · San Francisco, CA

  • Provide technical expertise and structured feedback to a frontier AI lab, supporting the training and evaluation of large language models.
  • Assess model outputs for accuracy, reasoning quality, and specification adherence across technical and general-knowledge domains.
Jan 2023 – Present

Cyber Security Advisor

Dr. Shariq Mumtaz Medicine Professional Corp.

  • Scripted end-to-end automation in Python, PowerShell, and Bash for endpoint configuration, telemetry collection, and compliance reporting across a fleet of macOS and Windows devices.
  • Built correlation-driven log pipelines instrumenting identity, endpoint, and network telemetry; cut Mean Time to Detect from days to under 1 hour.
  • Automated MDM policy deployment, patch cadences, and DNS filtering; standardized baselines reduced spam and unsolicited traffic by 80%.
  • Designed internal tooling for risk tracking, remediation SLAs, and KPI dashboards, enabling data-driven prioritization across the security program.
Feb 2021 – Jan 2022

Software Developer

Department of Industry · Canadian Digital Service

  • Engineered secure AWS infrastructure (IAM, S3, DynamoDB, CloudWatch) via Terraform/Terragrunt; enforced policy-as-code scanning with Checkov across all modules.
  • Designed passive request validation to eliminate bot-driven abuse, removing user friction while increasing detection coverage across all form endpoints.
  • Implemented CI/CD quality gates and automated testing, raising code coverage from ~20% to 85% and cutting client-reported incidents from 4–5 to 1–2 per cycle.
  • Awarded the Directors' General Award of Merit for delivery impact on national spectrum operations.
Sep 2020 – Dec 2020

Software Developer Intern

National Research Council of Canada

  • Developed full-stack Oracle Database applications powering research data pipelines across multiple NRC divisions.
  • Engineered PL/SQL stored procedures and SQL-based automation to replace manual workflows, eliminating ~10 hrs/week of manual processing.

Selected work

Independent projects, shipped end to end.

Open source · CLI qr-cli.dev

QR-CLI

A cross-platform Node.js CLI that generates QR codes as ASCII art with PNG export. Fully offline, MIT-licensed, distributed via npm and GitHub.

Built with
Node.js · npm · Offline-first · MIT licensed
iOS · Privacy-first tally.aahmed.ca

Tally Habit Tracker

A privacy-first iOS habit tracker: three habit types, flexible scheduling, streak heatmaps, and CloudKit sync. Zero telemetry, no third-party SDKs.

Built with
Swift / SwiftUI · SwiftData · WidgetKit · CloudKit

Credentials

Certifications & education.

Certifications

CISSP
Certified Information Systems Security Professional · (ISC)²
2026
SSCP
Systems Security Certified Practitioner · (ISC)²
2023
AWS Solutions Architect & Developer
Associate · Amazon Web Services
2022

Education

MSc Cybersecurity & Information Assurance
Western Governors University
2024
BCompSci, Computer Science
Dalhousie University
2024