Alan Haddad

Alan Haddad

Associate Security Engineer, FedRAMP, at Genesys.
Cyber Effects Officer, Air National Guard.

Example detectionCloudTrail, last 24 hours
_sourceCategory=aws/cloudtrail "ConsoleLogin"| json "eventName" as event| json "userIdentity.type" as type| json "userIdentity.userName" as user| json "additionalEventData.MFAUsed" as mfa| json "sourceIPAddress" as src_ip| where event = "ConsoleLogin" and mfa = "No"// federated SSO sign-ins enforce MFA at the IdP| where type = "IAMUser"| count by user, src_ip

1 match

usersrc_ip_count
svc-legacy-admin203.0.113.241

Illustrative query in Sumo Logic syntax. The account and IP are made up.

I protect cloud systems built to federal standards. From the first alert to the final fix.

On the FedRAMP security team at Genesys, I own incident response for a FedRAMP-authorized cloud environment, from the first alert through containment, recovery and follow-up. I build and tune detections, tighten IAM across AWS accounts, and work with engineering teams so every release ships secure and compliant.

I didn't start in security, and that's an advantage. After a BBA in logistics management from Ohio State, I spent more than seven years at the same Cleveland steel plant, from production planning to leading a slab yard team of 112. Operations taught me that most failures are process failures, so I bring that thinking to security: find where a process breaks, then make it hold.

I've served in the Air Force for 15 years, 12 of them enlisted, and now as a commissioned Cyber Effects Officer in the Air National Guard. What ties it together is people: I'm passionate about mentorship and developing the people around me. Next, I plan to pursue an MBA with an emphasis in cybersecurity, working toward a bigger goal of helping businesses of every size use technology safely and responsibly.

15 yearsIn the Air Force: 12 enlisted, now a commissioned Cyber Effects Officer
FedRAMPIncident response for an authorized cloud environment
GIACGPEN and GWAPT, plus Security+ and AWS Cloud Practitioner
Ohio StateBBA in logistics, materials and supply chain management

Selected work.

Projects I build on my own time to go deeper than the day job allows.

AWS security lab

A purpose-built AWS environment where I attack a deliberately vulnerable web app, scan it for weaknesses, and follow the logs into a SIEM. The whole thing deploys from one Terraform file.

  • EC2
  • S3
  • IAM
  • Kali
  • Nessus
  • DVWA
  • Sumo Logic
  • Terraform
AWS security lab architecture Inside a VPC, a Kali attack platform and a Nessus scanner both target a DVWA web server in one public subnet. The web server ships Apache logs to a private S3 bucket outside the VPC, and Sumo Logic ingests the bucket for dashboards and alerts. VPC 10.0.0.0/16 Public subnet 10.0.1.0/24 Attack platform Kali in Docker on EC2 Vulnerability scanner Nessus on Ubuntu EC2 Target web server DVWA, Apache, MySQL Nmap, Metasploit Scheduled scans Security groups allow SSH and the Nessus UI from one admin /32. Only the target exposes HTTP. Log bucket S3, private Apache logs cron + AWS CLI Sumo Logic Dashboards, alerts S3 source ingest

Detection engineering notes

Patterns I use to turn AWS logs into alerts worth acting on, from MFA-less console sign-ins that account for SSO to GuardDuty triage backed by flow logs.

Claude MCP connector

A local Model Context Protocol server that gives Claude read-only access to my fantasy leagues. A small, practical exercise in deciding exactly what an AI agent is allowed to touch.

Experience.

  1. Oct 2025 – Present

    Associate Security Engineer, FedRAMP

    Genesys

    • Own incident response for a FedRAMP-authorized cloud environment end to end: detection, investigation, containment, recovery and post-incident follow-up.
    • Build and tune SIEM detections across AWS CloudTrail, GuardDuty and VPC Flow Logs, so alerts lead to action instead of noise.
    • Lead remediation of overly broad IAM across multiple AWS accounts, scoping wildcard sts:AssumeRole permissions down to named roles.
    • Embed security and compliance into deployment pipelines with development and infrastructure teams, so releases meet FedRAMP requirements before they ship.
    • Investigate compliance gaps such as FIPS-validated endpoint use, and review cloud configurations to recommend design changes before risks become incidents.
  2. Dec 2023 – Present

    Cyber Effects Officer

    Air National Guard

    Commissioned in 2023 after 12 years of enlisted service.

    • Plan, coordinate and execute offensive and defensive cyberspace operations.
    • Oversee personnel and collaborate across agencies to deliver mission objectives.
  3. Apr 2018 – Oct 2025

    Cleveland-Cliffs

    Formerly ArcelorMittal USA, three roles at the same Cleveland plant

    1. Senior Planner, Manufacturing Planning

      Mar 2023 – Oct 2025

      Built monthly and annual operating plans and the production reporting leadership used for strategic planning.

    2. Process Manager, Slab Yard

      Jan 2022 – Mar 2023

      Led 112 hourly employees running slab shipping and receiving, consistently meeting production and logistics targets.

    3. Production Planner

      Apr 2018 – Jan 2022

      Scheduled production and inventory movement between units. Joined ArcelorMittal USA; the plant became part of Cleveland-Cliffs when Cliffs acquired it in December 2020.

  4. Oct 2011 – Dec 2023

    Air Transportation Specialist

    Air National Guard, enlisted

    Planned cargo and passenger movement for domestic and international airlift missions, and trained junior airmen.

Certifications.

GIAC

GWAPT

GIAC Web Application Penetration TesterIssued Jul 2025
Amazon Web Services

AWS CCP

AWS Certified Cloud PractitionerIssued Dec 2024
GIAC

GPEN

GIAC Penetration TesterIssued Aug 2024
CompTIA

Security+

CompTIA Security+Issued Feb 2024

The Ohio State University, BBA, Logistics, Materials, and Supply Chain Management, 2017

Let's talk.

Cloud security, detection engineering, or a role on your team. LinkedIn is the fastest way to reach me.