Skip to content

$ whoami Muhammad Murtuza Hussain

Every system has a story. Risk is the plot.

Cybersecurity risk and governance specialist who writes the software too. ISO 27001, NIS2 and Horizon Europe by day, Python by night.

Open case files

Currently Programme Manager at TFC Research & Innovation. I own the risk register for FITTER, a Horizon Europe programme, consult on ISO 27001 for SaaS start-ups, and ship open-source security tooling in Python at night.

Currently Programme Manager at TFC Research & Innovation. I own the risk register for FITTER, a Horizon Europe programme, consult on ISO 27001 for SaaS start-ups, and ship open-source security tooling in Python at night.

2021 / Nagpur, India

My first risk register was a rack of PlayStations.

In January 2021 I started a console rental business. Every console that left the shop was an asset walking out the door, and every customer account was a password someone else could reuse. I learned the vocabulary later. Back then I just built access rules, account hygiene and a maintenance routine so the business kept running. Three and a half years later, I knew what I wanted to protect for a living. 

risk_register.csv, reconstructed

assetthreattreatment
Console fleetWear and faultsPreventive maintenance
Customer accountsAccount compromiseAccess control, account hygiene
Customer dataMishandlingWritten SOPs
Service uptimeDowntimeIncident-response routine

2024 / Galway, Ireland

One suitcase. One Master's. Then a hall of 3,800 people.

I landed in Ireland for an MSc in Cybersecurity Risk Management at the University of Galway. Within a year I was elected Societies Chairperson, founded the Cybersecurity Society to 350+ members, was named Socs Hero at the Societies Awards, and was handed a microphone in front of 3,800 new students at orientation. 

Murtuza taking a selfie on stage in front of a waving audience of international students

2025 / Hackathons

Hackathons turned a risk person into a builder.

SAP Enterprise Challenge, Climathon Galway, Empathy Jam, the AtlanTec AI Challenge. Every weekend competition forced the same question: can you ship it by Sunday? I started writing the code myself. Then, at BSides Belfast, I walked into a Capture the Flag with no offensive background and walked out with second place. 

Murtuza on stage collecting second place at the BSides Belfast Hacker House CTF
BSides Belfast CTF, 2nd place
Murtuza holding a certificate with his team at the ISCG x Deloitte Case Competition
Deloitte x ISCG, Best Speaker and 2nd place team
Murtuza with fellow winners at Empathy Jam Galway
Empathy Jam Galway 2025, Best Civic Sense
Murtuza pitching TradeTribe, a student-to-student exchange for Galway, with his team
Climathon Galway, 1st prize for TradeTribe

Now / Dublin and Galway

Now I run risk for Horizon Europe programmes, and build the tools I wish existed.

At TFC Research & Innovation I designed the risk framework for FITTER, a 36-month Horizon Europe programme, and I lead workstreams on B-Prepared and PEERS. On the side I consult on ISO 27001 for SaaS start-ups and publish open-source security tooling on GitHub. Governance on weekdays. Python at night. 

FITTER

Risk Management Officer

Horizon Europe, GA 101132546

B-Prepared

Uptake, Sustainability & Comms Lead

ISO 22398 live drill, Ustka

PEERS

Co-Creation & Beneficiary Guide Lead

Beneficiary Guide, two editions

october, in public

Hacktoberfest 2026.

One open-source project a day, every day of October, built for the community. Small, useful, open tools, shipped daily and logged here as they land.

days shipped
31/31
projects
32
streak
0 days
won
5 prizes

Hacktoberfest Hack Day Galway

Done

Hosted with Major League Hacking and the University of Galway Cybersecurity Society, sponsored by Liberty IT. Teams formed on the day, built with open-source AI and open-weight models, and demoed: 12 projects, 2 winners. Afterwards we went on to BurbSec Galway at Murty Rabbitt's. Thank you to everyone who came.

Thu 29 Oct 2026 · 11am–5pm · The Cube, Áras na Mac Léinn, University of Galway

Watch the recap

October 2026

shipped today featured won

Mo
Tu
We
Th
Fr
Sa
Su

day 31 · closing the month

Don't Ask Again

Approve, approve, approve, don't ask again. Then read it first.

A frame from the Don't Ask Again music video: a terminal asking Make the bucket public? with a green YEAH stamp featured

day 31 · closing the month

Don't Ask Again

Approve, approve, approve, don't ask again. Then read it first.

A music video for everyone who hits approve without reading. "Yes, and don't ask again" is the second option on every coding agent's permission prompt, and lately the only one students press. A Suno rap, word-aligned to the lyrics with whisper, and 26 hand-written HTML scenes rendered with HyperFrames at 60 fps. It ends on the fix: write the PRD, go phase by phase, read before you approve. The repo has the full pipeline.

of video at 60 fps, from a song, a transcript and one story file
3:30
of video at 60 fps, from a song, a transcript and one story file
lyric words matched exactly to the song by whisper alignment
446/510
lyric words matched exactly to the song by whisper alignment
hyperframessunowhispermusic video
Four screens of the Ward app: a night-time check-in with a sleepy ghost, a serious verdict with helpline and evidence buttons, the lesson path, and the same app in Urdu featured

day 29 · week 4 challenge · ghost in the machine

Ward

The bully is the ghost haunting the chat. Ward is the ghost on your side.

A guardian that lives on a child's own device. It spots cyberbullying in English, Roman Urdu, Hinglish and Bangla, keeps the evidence, coaches the next step and trains kids to bounce back. Open-weight Gemma runs locally: no server, no account, and a child's messages never go to us or to any AI company. A preview, with a draft safeguarding policy to read before anyone gives it to a child.

of Roman Urdu abuse caught by Gemma 4 E4B on a computer, against 59% for word lists alone
88%
of Roman Urdu abuse caught by Gemma 4 E4B on a computer, against 59% for word lists alone
messages sent anywhere: it runs on the child's own device
0
messages sent anywhere: it runs on the child's own device
gemma 4androidsafeguarding4 languages
SAIL showing a lecture transcript on the left and a concept map of study techniques on the right, with a banner noting two of 43 model items were held by code featured

day 25 · idea, finally built

SAIL

from: Pitched with Clued-In at the Liberty IT PromptAthon

One paste, many ways in. A study kit where every claim has to quote your own material.

Supported AI Learning: paste lecture notes or a transcript and get a Universal Design for Learning study kit with a summary, concept map, audio script and worked examples, plus a quiz, explain-back and a progress tracker. Local Gemma 4 writes it, and every claim must quote your material or code holds it back. An idea my team Clued-In pitched at the Liberty IT PromptAthon and never built, until now.

of Gemma's 252 proposed items passed the checks (231 kept, 21 held)
91.7%
of Gemma's 252 proposed items passed the checks (231 kept, 21 held)
deliberately corrupted claims rejected by the validators
128/128
deliberately corrupted claims rejected by the validators
typescriptreactgemma 4udl

Winner · Best Use of Arduino

DEV Hacktoberfest Week 3 Challenge: Slow and Steady

Winners announcement
The Arduino UNO Q's LED matrix glowing blue, showing the sloth's sleepy face winner

day 23 · week 3 challenge · slow and steady

Morning Sloth

Look at the sloth, not your phone. One face on an LED matrix tells you whether last night's email needs you.

Look at the sloth, not your phone. An Arduino UNO Q reads your Gmail overnight, open-weight Gemma 4 decides on the board whether anything needs you, and one face on the LED matrix tells you: asleep, one eye open, or wide awake. It never changes your mailbox. Built for the Week 3 challenge, Slow and Steady.

wake-or-stay-asleep calls right on 42 emails the rules were never tuned on
98%
wake-or-stay-asleep calls right on 42 emails the rules were never tuned on
per email on the board's own CPU, no GPU, no cloud, while you sleep
~35 s
per email on the board's own CPU, no GPU, no cloud, while you sleep
gemma 4arduino uno qpythonedge ai

Winner · Best Overall

DEV Hacktoberfest Week 2 Challenge: Side Hustle

Winners announcement
Deis: jobs you can actually get. A phone showing a tailored CV where each highlighted line traces back to a confirmed fact winner

day 13 · week 2 challenge · side hustle

Deis

Jobs you can actually get. Swipe right, and Gemma tailors your CV while code cuts anything it can't back up. Deis is Irish for opportunity.

A swipe-to-apply job app for early-career people in Ireland. It hides the roles you can't get before you see them, then open-weight Gemma 4 tailors your CV, letter and answers while code removes any line your confirmed facts can't back up. Deis never applies for you.

CVs I tailored by hand this autumn, which is why Deis exists
83
CVs I tailored by hand this autumn, which is why Deis exists
for a full kit with Gemma 4 E4B on a 16 GB MacBook, offline if you like
38 s
for a full kit with Gemma 4 E4B on a 16 GB MacBook, offline if you like
gemma 4mastraelectronserpapi
Four Return Route phone screens: pick a walk length, Gemma's planned loop on a map with an estimate of €1.22 to €4.02, an itemised voucher for a photographed haul, and a thank-you screen for €1.05 given to a food bank featured

day 11 · week 1 challenge · touch grass

Return Route

Gemma plans the litter loop, code counts the money. A real walk in Galway, and the deposit voucher to prove it.

A walk that pays. Gemma plans a loop past the spots where cans and bottles get left behind and ends it at a deposit return machine. Take one photo of your haul: Gemma counts the containers, and plain code works out the refund from the deposit table. Keep the money, or give it to a cause.

the Lidl voucher from a real 90-minute walk in east Galway, 11 Oct
€0.30
the Lidl voucher from a real 90-minute walk in east Galway, 11 Oct
Gemma 26B plans the guard left untouched, once the rules moved into code
8/8
Gemma 26B plans the guard left untouched, once the rules moved into code
Crushed doesn't pay. Pick them up anyway. And bring gloves.
What the walk taught us, from the README
gemma 4mastrarendersentry
Campus Circular Hub home page for University of Galway: Borrow it. Fix it. Pass it on., with photos of shared items and live reuse numbers featured

day 10 · rebuild, now open source

Campus Circular Hub

from: Finalist, EY Student Sustainability Challenge 2025

My EY Student Sustainability Challenge idea, rebuilt and open-sourced so any university can run it for free.

A free, open-source lending, give-away and repair hub for universities. Students borrow chargers, tripods and textbooks instead of buying new, staff hand things out with a QR scan, and the sustainability office gets live impact numbers for ESG reporting. Each university runs its own copy, with its own database and its own login.

to run. No central service, no account with us, nothing to pay
€0
to run. No central service, no account with us, nothing to pay
ways to deploy: Docker on a campus VM, Render, Vercel or any Node host
4
ways to deploy: Docker on a campus VM, Render, Vercel or any Node host
next.jspostgresqlbetter authsustainability

Winner · 1st place

Prompt-injection CTF, Lakera Agent Breaker

The AgentBreaker site, a red-team playbook for LLM agents, stacked above the AgentArmor site, a hardening checklist against prompt injection winner

day 05 · won, then shared

AgentBreaker & AgentArmor

I came first in a prompt-injection CTF, then turned my field notes into two open skills: one to break agents, one to harden them.

Two companion Claude skills from breaking ten AI agents in Lakera's Agent Breaker. AgentBreaker is the red-team playbook: recon the agent, read its refusal, pick one of seven injection techniques. AgentArmor is the defender's mirror, mapping each attack to a control outside the model, with OWASP LLM Top 10, NIS2 and ISO 27001 framing.

injection techniques, each paired with the control that stops it
7
injection techniques, each paired with the control that stops it
AI agents attacked, and the four that held are written up too
10
AI agents attacked, and the four that held are written up too
Any guardrail the model enforces by its own reading of untrusted text is bypassable.
AgentArmor, the core principle
llm securityprompt injectionclaude skillsowasp llm top 10

Winner · Best Open-Source AI Project

Hack for Humanity: Dublin

MLH submission
Droichead's Pulse screen ranking roles to grow into, with Forward Deployed Engineer as the strongest fit at 84 percent winner

day 03 · hack day build

Droichead

Bridge the gap to the job that's coming. Droichead is Irish for bridge.

A calm, private career navigator for people whose work is being reshaped by AI. A 90-second check-in ranks emerging roles by honest fit, shows what you already have and what to build, then lays out a dated week-by-week plan that favours free and government-funded Irish courses. Open-weight Gemma 4, seven languages, no accounts and no tracking.

built solo in Dublin, in a room of about 15 teams
1 day
built solo in Dublin, in a room of about 15 teams
languages, including Gaeilge, Polski and Українська
7
languages, including Gaeilge, Polski and Українська
That's the role I want.
Nithin, the live-demo volunteer, on the role Droichead suggested for him
gemma 4next.jsollama7 languages

Winner · Best Use of SerpApi

DEV Hacktoberfest Weekend Challenge: Build for a Friend

Winners announcement
Pīzhù showing an essay on grid paper with underlined phrases and bilingual margin notes beside each line winner

day 02 · weekend build

Pīzhù 批注

A writing tutor that never rewrites your essay. Built for my friend Joy.

A writing tutor for Mandarin-speaking students at UK and Irish universities. It underlines the exact words a marker would pause on and explains why, in English and Chinese, but never rewrites the essay. Gemma 4 runs locally, so coursework never leaves the laptop.

recall on seeded habits, Gemma 4 12B on a laptop
94.7%
recall on seeded habits, Gemma 4 12B on a laptop
rewrites. Hints only, with nudges capped at a few words in code
0
rewrites. Hints only, with nudges capped at a few words in code
The Chinese explanation is easier to understand than the criteria written in our module.
Joy, after testing it on her dissertation
gemma 4next.jsmastraserpapi
a newsletter by Murtuza

Word on the Quay.

Quay, as in Quay Street. Pronounced key, as in the one you never share.

AI and cyber news, Galway events, and who’s hiring in Ireland. Written for students and young professionals. Because the best opportunities in Galway travel by word of mouth, and not everyone is in the room yet.

Every two weeks, free, with the odd early issue when something can’t wait. One click to unsubscribe. Your email is used for this newsletter and nothing else.

Inside every issue

every two weeks

  1. AI spotlight

    One AI story that matters, explained in two minutes, and what it means for your career.

  2. Cyber spotlight

    One breach, law or tool worth knowing, and the lesson behind it.

  3. What’s on in Galway

    Meetups, hackathons, CTFs and conferences in the next two weeks, with free and student-friendly ones flagged.

  4. Who’s hiring

    AI and cybersecurity roles in Ireland, graduate to mid-level only. No “senior, 8+ years” listings.

For international students, graduates and anyone early in AI or cyber in Ireland who keeps asking, “how did you even hear about that?”

Six years, one thread: protect what people depend on.

  1. 2025 - present

    Programme Manager, Risk Management Lead (FITTER)

    TFC Research & Innovation

    Risk Management Lead across every work package of a 36-month Horizon Europe programme (GA 101132546).

  2. 2025 - present

    Cybersecurity Consultant, GRC & ISO 27001

    Freelance

    ISO 27001 enablement for four early-stage SaaS clients across Ireland and Dubai.

  3. 2024 - present

    Volunteer Lead & Social Media Manager

    BSides Galway

    Volunteering since September 2024. Runs the volunteers and all of the social media for BSides Galway 2025 and 2026, with 2027 on the way.

  4. 2025 - 2025

    Digital Innovation Intern

    University of Galway IdeasLab

    Power BI dashboards for programme and campaign KPIs.

  5. 2025 - 2025

    Societies Chairperson

    University of Galway Students' Union

    Elected to the Students' Union Executive. Chaired meetings between the Union and every society.

  6. 2024 - 2026

    Ambassador

    Global Galway

    Welcomed and guided international students; spoke at orientation to 3,800+.

  7. 2021 - 2024

    Founder & Owner

    PlayStation Rental, Nagpur

    Bootstrapped and ran a console rental business for three and a half years. Access control, account hygiene, SOPs.

education

  • MSc, Cybersecurity Risk Management

    University of Galway 2024 - 2025

  • Diploma, Computer Science

    IIT Madras 2023 - 2024

  • BSc, Mathematics & Computer Science

    RTM Nagpur University 2020 - 2023

honours

Socs Hero

University of Galway Societies Awards, 2025

Chosen by a judging panel or nominated by the Societies Office and the Students’ Union for outstanding creativity, dedication and impact across student societies.

  • Gold President’s Award for Innovation & EntrepreneurshipUniversity of Galway IdeasLab, top tier, 2025
  • Invitation to Áras an UachtaráinThe President’s residence, 2025
  • President’s Award for Volunteering (ALIVE)2025
  • 4 more Societies Awards2025
  • Employability Award2025

Curriculum vitae

PDF, 2 pages

Not a generalist. A specialist with range.

My depth across the eight CISSP domains, self-assessed and backed by shipped work. Deep in risk and software security, broad everywhere else.

D1Risk & GovernanceD2Asset SecurityD3ArchitectureD4NetworkD5IAMD6AssessmentD7SecOpsD8Software Security

Security & Risk Management

9/10

Owns the live risk register for a Horizon Europe programme. ISO 27005 methodology, NIS2 mapping, board-level KRI packs, policy suites for four SaaS clients.

proven in

Mapped against the CISSP Common Body of Knowledge. A self-assessment, not a certification.

Case files. Open one, they all run.

JavaScriptD1D2

NIS2 Compliance Mapper

Maps 54 obligations from Articles 20, 21 and 23 to the people who own them and the evidence that proves them.

  • Entity classification with legal basis
  • 17 roles with fallback chains
  • Evidence register ranked by leverage
nis2-compliance-mapper

1. Which sector are you in?

2. How big is the organisation?

3. DNS, TLD registry or qualified trust service?

answer three questions to classify the entity

PythonD3D5D6

AWS Posture Checker

Ten read-only checks across every region, each finding mapped to CIS, ISO/IEC 27001:2022 and NIS2 Article 21.

  • Standard library only, no SDK
  • A check that cannot run is never a pass
  • Console, JSON, Markdown and HTML reports
aws-cspm-checker
ready. read-only, standard library only.
JavaScriptD1D7

STORMSURGE Tabletop

A 380 Gbps flood becomes a Layer 7 attack, a ransom note and a smokescreen intrusion. Every decision moves four readiness metrics.

  • Eight decision points, RACI for each
  • NIS2 and GDPR notification clocks
  • Exports a blameless post-mortem
ddos-tabletop-exercise

Service

5

Trust

5

Compliance

5

Cost control

5

T+00:40

380 Gbps volumetric flood. Checkout is down. Your ISP offers scrubbing diversion, billed per hour.

ShellD7D6

Wazuh Home SOC

Three hand-written detections mapped to MITRE ATT&CK, each with an attack simulation and an offline regex test harness.

  • SSH brute force, web attack, privilege escalation
  • Optional ELK sidecar
  • Honest limitations section
wazuh-home-soc-lab
Sep 29 09:12:01 target sshd[811]: Accepted publickey for murtuza from 10.0.0.4
matches in window: 0/5
JavaScriptD1D7

MOVEit / Cl0p Timeline

One SQL-injection zero-day, 2,700+ organisations, roughly 96 million people. Every claim cited to a primary source.

  • 17 dated events, 11 sources
  • Mapped to MITRE ATT&CK
  • Shows Cl0p's pattern before the headline
moveit-clop-breach-timeline

27 May 2023 / zero-day

Mass exploitation of MOVEit Transfer begins over a US holiday weekend.

PythonD4D3

TLS Config Auditor

Threaded probes for every protocol version, weak-cipher detection and certificate expiry, graded against RFC 8996.

  • One thread per domain
  • CI-friendly exit codes
  • Mozilla Intermediate baseline
tls-config-auditor

$ tls-audit tls-v1-0.badssl.com:1010

protocolTLS 1.0 accepted
cipherECDHE-RSA-AES128-SHA
certificatevalid
gradeFAIL

sample output against public badssl.com test hosts

I write the controls and the code that checks them.

python
def check_s3_public_access(account) -> Finding:
    blocks = account.s3.public_access_block()
    if not all(blocks.values()):
        return Finding("S3-001", "high",
            refs=["CIS 2.1.4", "ISO 27001 A.8.3", "NIS2 21(2)(i)"])
    return Finding.passed("S3-001")

shipped in: aws-cspm-checker, tls-config-auditor, helmet-detection capstone

The person behind the risk register. Poke around.

Open the apps in the dock. Two of them are games.

Murtuza OS

GALWAY

Tuesday

29

MTWTFSS123456789101112131415161718192021222324252627282930

Can’t Rush Greatness

Central Cee

the Galway canal commute

7 spoken languages, and counting

Send me something worth encrypting.

Roles in GRC and security engineering, speaking, or a risk problem you want a second pair of eyes on.

Prefer paper? Download CV

murtuza@galway ~ % contact --new --encrypt

Delivered straight to my inbox.