Beirut
Hi, I’m
Computer and Communications Engineer. Graduate Fellow at the American University of Beirut.
I build and test systems with an attacker’s model of them in mind.
I’ve taught ethical hacking, written four hundred tests for a codebase that had none, found a bug in a NASA website, and built a currency-exchange platform when the official rate stopped meaning anything. Somewhere in there I stopped thinking of building and breaking as two different jobs.
Two threads run through everything since 2019: building things, and taking them apart to see how they fail. They have been converging for a while.
Pick a thread to follow it.
A B.Eng. in Computer and Communications Engineering.
Undergraduate teaching assistant for Python, programming fundamentals and electric circuits: 150-plus students over two years.
Lebanon’s banks froze deposits, then the campus shut for the pandemic. The sessions I was teaching moved to video calls, and my grades went up anyway.
A graduate course, taken as an undergraduate. The term paper benchmarked Windows Server, Ubuntu and CentOS under DDoS attack; it’s on Zenodo.
Python modules for passive reconnaissance across rogue app stores and social platforms, packaged in Docker for the team’s deep- and dark-web collection.
The Python and Twitter-API pipeline behind Lebanon’s Economic Policy Uncertainty index, from raw tweets to weekly and monthly series.
Coding coach for the web and mobile development lab through the spring; then a degree with Distinction, a 100 in Ethical Hacking, and my name in the acknowledgments of the published index report.
Two sections of the web and mobile development lab, the same lab I had taken as a student two years earlier.
Networks and Security, on a graduate fellowship. Started instructing the Ethical Hacking labs the same term.
More than 400 tests for internal tooling and a .NET proof of concept for HashiCorp Vault: building and securing in the same codebase. Earned TryHackMe’s SAL1 the same year, and finished six years of teaching in the fall.
Finished with an A in DevSecOps and Infrastructure Automation. In May, NASA recognized and publicly disclosed a vulnerability I had reported in January: a stored cross-site scripting flaw on its GLOBE platform. The same month I added CompTIA DataSys+.
Scheduled for the summer. Then whatever comes next.
–The codebase had no tests when I arrived.
Murex, Beirut
–presentTaught the material I’d scored 100 in.
American University of Beirut
–The lab I’d taken as a student two years earlier.
American University of Beirut, Department of Electrical and Computer Engineering
–Three hours a week, in the lab.
American University of Beirut, Department of Electrical and Computer Engineering
–An economics project that needed a programmer.
American University of Beirut
–My first job in security.
Potech Consulting, Beirut
–Started in my second year.
American University of Beirut, Department of Electrical and Computer Engineering
– (expected)Coursework done; the thesis is the rest.
American University of Beirut
–Done through a currency collapse and a pandemic.
American University of Beirut
May 2026
A letter of recognition from NASA’s Senior Agency Information Security Officer. The finding: a stored cross-site scripting vulnerability, reachable through an arbitrary file upload, on NASA’s GLOBE platform (globe.gov). Reported on 27 January 2026, accepted at P2 priority and fixed, and publicly disclosed by NASA through Bugcrowd’s CrowdStream on 22 May 2026.
August 2023
Research report by M. Barakat and S. Altug, Issam Fares Institute for Public Policy and International Affairs, AUB. I’m acknowledged by name for building the Python code behind the index.
December 2021
An empirical comparison of three server operating systems under denial-of-service load, written for Internet Security at AUB with Vincent Nakhle, Ghida Al Hajj Chehade and Hussein Al Moussawi.
Also listed on my ORCID record.
Near-instant arithmetic in finite fields up to GF(2571), the sizes elliptic-curve cryptography runs on. Python and Tkinter. Here is a working corner of it: a multiplier for GF(28), the field AES runs on.
Built during the collapse of the Lebanese pound: a platform that published parallel-market exchange statistics and matched people who wanted to trade.
My final-year project, built for a community I spent eight years in. It collects, validates and stores the organization’s records, with authentication, authorization and fine-grained permissions designed in from the start.
This site, and the short links on it. The page is one HTML file; the links run through a small Cloudflare Worker I wrote, one file and one redirect table; and the domain is set up to current standards, with IPv6, DNSSEC, HTTPS and RPKI. It scores 100% on Internet.nl’s website test and is listed in their Hall of Fame.
CompTIA certifications
CompTIA stackable certifications
Security Analytics ProfessionalCSAP
Network Vulnerability Assessment ProfessionalCNVP
Network Security ProfessionalCNSP
Security Analytics ExpertCSAE
Secure Infrastructure ExpertCSIEThe top of CompTIA’s stackable path: Security+, CySA+, PenTest+ and SecurityX, which along the way also earn the Security Analytics Professional (CSAP), Network Vulnerability Assessment Professional (CNVP), Network Security Professional (CNSP) and Security Analytics Expert (CSAE) stackables.
Databases, end to end: deploying and maintaining them, scripting against them, securing them, and getting them back after a failure. Earned in May 2026.
Python. Profile
Coursera. Certificate
I spent eight years in the Scouts, as a patrol leader and then a rover, and that community is why my final-year project was built for the Lebanese Scouts. I keep my hands in with competitive-programming problems on LeetCode and Codeforces, and I follow technology and economic news closely, which is partly how a computer engineer ended up writing the code behind an economic-policy index.
If you’re hiring, working on something in security or infrastructure, or just want to compare notes on a problem, I’d like to hear from you.
Anthony J. Saab, Beirut. Last updated .
This site is one page of HTML, with no analytics and no cookies. Identity proofs are on Keyoxide.
