Abdullah Aljamal

This intensive training provided strong exposure to key concepts and hands-on activities in Governance, Risk, and Compliance (GRC) and enabled me to gain new skills and knowledge across different areas of the field, including: - Information security concepts and governance. - Overview of organizational structure and architecture. - Information security strategy development. - Development of information security policies, processes, and procedures. - Learning about several GRC tools, including ISO/IEC 27001 toolkits, CISO Assistant, and Aperitisoft. - Risk management, assessment, analysis, treatment, and mitigation fundamentals, including the ISO/IEC 27005 standard. - In-depth understanding of the ISO/IEC 27001 standard. - Data protection and privacy. - Business continuity and disaster recovery fundamentals. - Information security auditing and the ISO/IEC 19011 standard. The training concluded with a project focused on ISO/IEC 27001 implementation, which included the following requirements and deliverables: - Technical proposal, including company profile, scope of work, and high-level project plan. - Financial proposal, including detailed project costs. - Detailed project plan, including phases, activities, owners, timelines, and deliverables. - Policies and process documents. - Standards documentation. - Strategy document. - Risk register.

The program consisted of two stages. • Stage 1 (self-paced learning): Completed EC-Council’s Certified Cybersecurity Technician (C|CT) coursework to build security fundamentals. • Stage 2 (hands-on practice): Performed scoped penetration testing and light policy critique/analysis; in addition to reconnaissance, enumeration, exploitation attempts, and documenting every step to simulate real-world penetration testing report writing. Learned how to conduct privilege escalation, reverse shell, and brute force attack. Tools: Nmap, Nikto, Metasploit, WPScan.

University-required training via SMT Academy — blended theoretical foundations with practical SOC analysis — completed a multi-course pathway spanning multiple security domains — strengthened fundamentals while practicing alert/log analysis, event correlation, and incident triage.

Selected Coursework: InfoSec Fundamentals; InfoSec Governance & Mgmt; IT Risk Mgmt; Cryptography; Pen Testing; IDS & Network Forensics; Ethical Hacking Lab; Computer Networks (+Lab); Network Programming & Applications; Network Security (+Lab); Wireless Networks (+Lab); AI & ML. Highlights: • Governance & Mgmt: COBIT 2019 (goals cascade/design factors), capability assessment on a COBIT process, NIST CSF + ISO 27001 foundations, control mapping/planning with NIST CSF, translated NIST SP 800-171 Access Control to 800-53, built current/target profiles, multi-year roadmap, and policy/regulatory analysis. • Risk Mgmt (ISACA IT Risk Fundamentals): practiced identify/assess/respond/monitor; built ISO/IEC 27001:2022 ISMS case study incl. security policies, asset inventory, risk register with likelihood/impact scoring, risk treatment options, KRIs, and Annex A SoA. • AI & ML: supervised ML project with model comparison, metrics evaluation, and K-Fold cross-validation.

Completed a 22-week Full-Stack Web Development Bootcamp by Meraki, where I developed two web projects, one independently and one as part of a team.