Omar Hassan Alghamdi
Cybersecurity and Software Developer | Application Security | Threat Modeling
Taif, Saudi Arabia | Mobile/WhatsApp: +966 50 759 6095 (wa.me/966507596095) | Email: button.elated.9g@icloud.com
LinkedIn: linkedin.com/in/orxx | Portfolio: orxx.vercel.app | All 19 certificates: orxx.vercel.app/#certs
Digital products: omaralghamdi.gumroad.com

SUMMARY
Saudi student in defensive cybersecurity and software engineering; founder of Moderneex Studio. Fourteen systems built across mobile, web and cloud; eight delivered to clients. Evidence-first: authorization in the data layer, security claims verified by measurement, automated checks on the build that shipped. Finalist, SAIF 2026, with SAQR; national finalist in Informatics, NSMO 2026; Harvard CS50P. Open to mentorship and cyber programs. Long-term goal: Governor of the National Cybersecurity Authority.

EXPERIENCE
Founder
Moderneex Studio | Saudi Arabia | Dec 2025 - Present
- Built the studio's governance foundation from zero: 37 bilingual governance, legal and policy documents, including an IT security policy, an incident response plan and a risk register.
- Built Dhura, a grades 5 to 9 learning platform at zero hosting cost: 46 complete first-term courses, with 1,340 lessons from the Ministry textbooks, and 42,661 practice questions live across the platform; an interface in five languages, an AI assistant confined to the lesson, TOTP two-step sign-in and a strict CSP.
- Building SeeScript, one of the studio's six sub-brands: an Arabic Python course (32 lessons, 179 auto-graded exercises), in development.

Freelance Software Developer
Self-employed | Remote | Jun 2026 - Present
- Delivered eight systems to clients in 2026: apps on the App Store and Google Play (ProFleet, Smart Pen, Beezato) or in closed testing (Tatabbu), an agricultural services platform (AgriDustria), and school, exam-paper and 3D-map platforms.
- Smart Pen: store receipts verified on the server; AI voice relayed through the server with one-time tickets and per-minute billing. AgriDustria: 162 client messages traced to a verdict with evidence; a rollback per change.
- Owned release engineering on both stores (signed builds, data-safety and permission declarations, closed testing) and verified every delivery: 476 automated tests on one, plus guard scripts that check each contract clause against the built artifact.

EDUCATION
Al-Rayyan Intermediate School
Taif, Saudi Arabia | Grade 9, final year of the intermediate stage | 2026 - 2027

PROJECTS
SAQR: Cyber-Physical Defense for Critical-Facility Cameras | 2026
Sole designer and engineer | Python, FastAPI, WebSocket, HMAC, JWT, RBAC, STRIDE | orxx.vercel.app/p/saqr
- Finalist, SAIF 2026 (Ministry of Interior with Tuwaiq Academy); final stage in Riyadh, 24 to 26 Nov 2026. Zero-trust design: each camera earns trust from the consistency of its own telemetry; evidence from a distrusted camera is excluded, not merely flagged.
- HMAC-signed, nonce-protected telemetry against replay; JWT with role-based access control (RBAC) on a separated WebSocket control plane; serialized tamper-evident audit log.
- Digital-twin proof of concept: 2,400 seeded runs (five attack scenarios and a benign baseline, 100 runs each, on SAQR and three baselines). All modelled attacks detected, zero false alerts and 98% evidence integrity, against 75% per baseline. 73 automated tests, 19 of 19 DAST checks, clean bandit and pip-audit scans.

Tatabbu: Family Safety Application, in Closed Testing | 2026
Architecture, security, release | React Native, Expo, Supabase, PostgreSQL | orxx.vercel.app/p/tatabbu
- Moved all authorization from the application into the database as row-level security (RLS) policies, so a missing filter in client code cannot widen access; EU data residency (Frankfurt).
- Proved the policy layer by measurement: 25 SQL privilege probes, which caught all 34 policy mutations.
- Cleared Google Play review in 14 minutes, including foreground-service and background-location declarations; closed testing on Google Play (176 countries) and TestFlight.

Alwaei Alfikri: Platform with an Autonomous Security Agent | 2026 - Present
Designer, engineer, operator | Cloudflare Workers, Durable Objects, KV, WebRTC | orxx.vercel.app/p/alwaei
- Lead an eleven-member school awareness team and operate its platform at zero cost (closed until its official launch), guarded by an always-on agent: 60-second alarm, 10-minute cron, per-message hooks.
- Adaptive defense (normal, elevated, lockdown), automatic bans on accumulated threat score, honeypot routes, and a prompt-injection guard that scores each attempt and suspends a source for an hour after three.

Halqat Wasl: School Conduct and Guardian Communication System | 2025 - 2026
Designer, engineer, trainer | PWA, JavaScript, Cloudflare Workers, D1, offline sync | orxx.vercel.app/p/halqat
- In daily use at a government school: 22 staff, 103 students, more than 1,300 documented events, offline-first.
- Encoded the official Conduct and Attendance Rules (5th edition) as code: no message reaches a guardian without the principal's approval; four separated roles; three school stages isolated; no student address or phone number stored (PDPL).

PediaQuick: Pediatric Clinical Reference | 2026 - Present
Developer | Next.js, TypeScript, Supabase, PostgreSQL | orxx.vercel.app/p/pediaquick
- Free Arabic and English pediatric and neonatal reference for a practising pediatrician who owns the site; every dose, range and threshold traced to its primary source and checked by a test (more than 1,700 tests).
- Review gate: a page shows as reviewed only once the pediatrician approves that exact version, and any edit reverts it; doses quoted verbatim from the Harriet Lane Handbook; row-level security on accounts and roles.

SKILLS
Security: Defensive Security, Application Security, Network Security, Threat Modeling (STRIDE), Zero Trust Architecture, Row-Level Security (RLS), Role-Based Access Control (RBAC), JSON Web Tokens (JWT), HMAC, Static Application Security Testing (SAST, bandit), Dynamic Application Security Testing (DAST), Dependency Auditing (pip-audit), Mutation Testing, Rate Limiting, Tamper-Evident Audit Logging, Content Security Policy (CSP), Prompt-Injection Defense, Incident Response Planning, Risk Register, Data Protection (Saudi PDPL)
Programming Languages: Python, C++, JavaScript, Dart, PHP, SQL
Frameworks and Platforms: FastAPI, Flask, React Native, Expo, Flutter, Cloudflare Workers, Durable Objects, Cloudflare D1, Cloudflare KV, Supabase, PostgreSQL, SQLite, WebRTC, WebSocket, MapLibre, OpenStreetMap, PWA
Engineering Practice: Release Engineering, Google Play Console, TestFlight, Automated Testing, Digital Twin Simulation, Algorithms (Dijkstra), Competitive Programming, Technical Writing (Arabic and English)

CERTIFICATIONS
CS50's Introduction to Programming with Python (CS50P) | Harvard University | Sep 2026 | cs50.harvard.edu/certificates/17f2003a-a64b-408e-b859-e90abec1a564
Cybersecurity | Doroob, Human Resources Development Fund (HADAF) | 2024 | orxx.vercel.app/c/doroob-1
AI Training Hackathon | Kanz with LAU Academy of Continuing Education | Jul 2026 | orxx.vercel.app/c/kanz (ID KANZ-ADV-2183)
Python (Basic) | HackerRank | orxx.vercel.app/c/hr-python
Problem Solving (Basic) | HackerRank | orxx.vercel.app/c/hr-problem
C++ 101 to 104; Python 101 to 103 | Satr | Jun 2026 (C++ 104) | orxx.vercel.app/c/satr-cpp104
Intellectual Security Appreciation | Al-Rayyan Intermediate School | orxx.vercel.app/c/alwaei-appreciation

HONORS AND AWARDS
Finalist, SAIF 2026 | Oct 2026 | SAQR, Cybersecurity and Defense Technologies track, ages 12 to 17 (Ministry of Interior with Tuwaiq Academy); final stage in Riyadh, 24 to 26 Nov 2026.
National Finalist, Informatics | 2026 | NSMO 2026 (Mawhiba with the Ministry of Education); three qualifying stages cleared. NSMO 2027: 100/100 in the stage-one test (Oct 2026).
AI Showcase Featured Project | Jul 2026 | Kanz AI Training Hackathon, for Dhaleel.
Participant in a Guinness World Records-setting AI lesson | 15 Jul 2026 | One of 14,075 participants in the Guinness World Records title for the most participants in an AI video lesson; the record was achieved by Kanz and the Ministry of Human Resources and Social Development (HRSD).
1,617 of 2,000, Multiple Cognitive Abilities Test | 2024 | Mawhiba

LANGUAGES
Arabic (Native) | English (Full professional proficiency)