A defined project
A bounded review, documentation phase, infrastructure task, or editing brief with agreed outputs.
SECURITY PROFESSIONAL / CREATIVE PRODUCER
Osama Waer
Osaa601
I help teams understand security risks, strengthen infrastructure, and turn complex work into clear decisions. I also edit videos and explore interactive worlds.
CybersecurityNetworks & systemsVideo & stories
Based in Tripoli, Libya · Remote engagements · Arabic / English
01 / THE PERSON BEHIND THE HANDLE
Security is my work. Curiosity connects it all.
I'm Osama, known online as Osaa601. I work in information security in Libya's financial-services sector, with a background in networks and IT infrastructure.
Since 2022, my work has included security monitoring, incident investigation, awareness, infrastructure reviews, and security documentation. I enjoy turning a technical problem into a clear plan that people can act on.
Away from the desk: anime, Tolkien's worlds, retro games, lo-fi music, hiking, and taekwondo. Those interests shape my creative work—and this little corner of the internet.
How I work
I start by understanding the problem and the environment, then investigate, explain options, and document the outcome. I aim to leave people with a clear next step and a useful handover.
Across security and infrastructure
My experience connects monitoring and investigation with networks, Linux/Windows administration, access management, support, and security governance. I work with technical teams and communicate findings to the people making decisions.
The creative side
I have edited videos since around age ten. Content creation, filmmaking, gaming, and Unity/Unreal/VR experiments give me another way to explore ideas. My cooperative game prototype is an ongoing personal project.
Beyond the screen
I am based in Tripoli and work in Arabic and English. Anime, Tolkien, retro games, lo-fi and heavier music, hiking, basketball, and taekwondo all find their way into my interests. I hold a second-dan taekwondo black belt.
Tools and areas I work with
Security
Logs & SIEM · Burp Suite · Nmap · Wireshark · vulnerability assessment
Infrastructure
Linux · Windows / Active Directory · DNS / BIND · Nginx · Docker · Google Workspace
Creative exploration
Video editing · Arabic/English content · Unity · Unreal Engine · VR
02 / HOW I CAN HELP
Let’s solve the right problem.
Three ways to work together. Choose the work you need, explore the scope, and start a conversation.
Cybersecurity & GRC
Understand exposure, prioritize controls, and prepare clear evidence for decisions and reviews.
Cybersecurity
You need to understand what is exposed, which findings matter, and what your team should do next.
Explore scope & deliverablesSecurity governance & advisory
Security requirements exist, but ownership, documentation, and the implementation path need structure.
Explore scope & deliverablesTraining & documentation
People need practical guidance they can understand, use, and refer to after a session or handover.
Explore scope & deliverablesInfrastructure & Security Operations
Resolve operational friction, review access, and make systems easier to maintain securely.
Networks & system administration
Connectivity, server reliability, or unclear dependencies are consuming time and slowing your team.
Explore scope & deliverablesIT support & Workspace
Your team needs dependable accounts, secure access, and a repeatable onboarding and support process.
Explore scope & deliverablesMedia & Content Production
Shape your footage and ideas into clear, engaging stories for the right audience.
A clear way to work remotely.
- 01
Discovery
Understand the problem, context, and desired outcome.
- 02
Scope
Agree the boundaries, access, and responsibilities.
- 03
Proposal
Confirm deliverables, estimate, review points, and terms.
- 04
Delivery
Work through the scope with agreed progress updates.
- 05
Handover
Explain the findings, leave usable material, and agree next steps.
Timing is an estimate, subject to scope, access, feedback, and scheduling. Fees are proposed after discovery. Outcomes and certification are not guaranteed.
Discuss an engagementWe agree on scope, access, deliverables, and timing before work starts. Security testing requires authorization; compliance services support readiness rather than issuing certification.
03 / SELECTED WORK
Systems, documents, and worlds.
A selection of professional and personal work, with its context and current stage.
SECURITY OPERATIONS
Security in a financial-services environment
Monitoring, investigation, infrastructure coordination, and day-to-day security responsibilities.
Professional experienceRead project overviewGRADUATION PROJECT
PotStation
A honeypot-platform graduation project exploring deployment, visibility, and threat observation.
Academic project · 2024–2025Read project overviewSECURITY GOVERNANCE
ISMS documentation & planning
Policies, procedures, risk methodology, registers, and a roadmap for implementation.
Draft prepared · implementation on holdRead project overviewINDIE GAME
Don't Ruin the Wedding!
A cooperative game prototype, built around shared play and multiplayer experimentation.
In development · prototypeRead project overview04 / THE CREATIVE SIDE
Games to build. Stories to tell.
I've been editing videos since childhood. Today, I explore indie games, immersive experiences, and visual storytelling alongside my security work.
Don't Ruin the Wedding!
A cooperative game prototype exploring shared chaos, local play, and multiplayer systems.
See the game projectEditing, creating, experimenting.
My channels are where I share videos, creative experiments, and the things I'm exploring.
Visit my YouTube channelBeyond the workday.
Games, conversations, and a more informal side of Osaa601.
Find me on TwitchFootage → story → final cut
Bring a clear brief and footage you can share. We agree the edit, review rounds, captions, formats, and handover. Specialist motion graphics or VFX are scoped only against demonstrated samples.
Explore production servicesThe next chapter: AdventuresHave a project or opportunity in mind?
Tell me what you're working on, what kind of help you need, and your timeline. For security work, we can agree on scope before sharing technical details.
More places to find meWhat would you like to discuss?
Choose a topic to open an email draft. Nothing is sent until you send it from your email app.
Cybersecurity consultationInfrastructure reviewMonthly advisory engagementVideo editingContent-production partnershipGeneral business inquiry
Save my business contactStart with a high-level brief. Do not email credentials or confidential customer records. Secure access arrangements can be agreed during scoping.
AROUND THE INTERNET
Find me around the internet.
My channels, communities, and social profiles.
NOTES FROM MY DESK
The Osaa601 journal.
Practical security notes, creative ideas, and updates to this little desktop.
A useful security report answers five questions
A practical way to turn technical findings into a clear next step.
Editing starts with the story
Pacing, sound, and the small choices that make a video feel intentional.
A desktop with a story
Security work, creative projects, and a small adventure in one place.
No notes in this collection yet.
A useful security report answers five questions
A report should help someone understand a situation and decide what to do. Collecting logs is only the beginning; the explanation needs to connect the evidence to the affected service and the next action.
My starting questions are: What happened? What do we know for sure? What could be affected? What has already been done? What needs a decision or follow-up? Separating confirmed facts from possibilities keeps the report useful.
For a technical reader, include the relevant evidence and how to reproduce or check the finding. For management, explain the practical impact, the owner of the next action, and what remains uncertain. A long list of alerts cannot replace that explanation.
Public examples should use lab systems or approved, sanitized material. A portfolio can demonstrate the method without publishing an employer’s incident details or internal infrastructure.
Editing starts with the story
Before choosing transitions or effects, I want to know what the viewer should understand or feel. A short gaming clip, a technical explainer, and a personal film need different rhythms.
The first cut is about structure: remove repetition, keep the useful moments, and make the opening clear. Sometimes a quiet pause helps more than another effect. The order of shots can change the meaning without changing the footage.
Sound deserves its own pass. A strong visual cut can still feel unfinished when dialogue is hard to hear or music overwhelms it. Captions should support the message and remain readable on a phone.
I like the atmosphere of games, fantasy worlds, and lo-fi spaces. Those influences can give a video personality, but the editing still needs to serve its story.
A desktop with a story
I wanted this site to feel like my own corner of the internet. The desktop connects the professional side of my work with the games, stories, and music I enjoy outside it.
Projects and service details stay inside their app windows. Each window has its own history, and the layout can adapt from a phone to a large screen. The professional content should remain easy to find even when the presentation is playful.
Starfall Vale is a small original adventure built for this desktop. It links a village, forest, and temple with a quest, real-time combat, and local saves. It is an experiment and a place to take a short break.
This journal will be a home for practical notes, creative breakdowns, and updates to this little world. You can bookmark notes and discover archive seals around the desktop to unlock new wallpaper moods.
OSAA601 ADVENTURES
Stories beyond the screen.
Future Journeys · In planningOSAA601 Adventures is the next chapter I want to create: thoughtful travel documentaries, country-crossing challenges, and stories shaped by the people and places along the way.
This is a creative direction, not a completed travel series. Published journeys, episodes, routes, and photographs will appear here when genuine material is ready.
Across a country
A future documentary format following a real route, its challenges, and everyday encounters.
Field notes
Travel journals and cinematic photo essays grounded in journeys actually made.
Behind the story
Production notes on planning, filming, sound, and editing an adventure.
Security in a financial-services environment
Monitoring, investigation, infrastructure coordination, and day-to-day security responsibilities.
Professional experience
Objective
Support day-to-day security in a financial-services environment while coordinating with IT and management.
My role & contribution
Information Security Engineer: monitoring, investigation, security planning, documentation, awareness, and coordination.
Verified status & evidence
Ongoing professional responsibilities. This overview describes the work at a high level; operational records and employer systems are not published here.
Approach & focus
My information-security role combines operational investigation with the work needed to keep a security programme organized. The environment is financial services, where security decisions need to be practical, explainable, and coordinated with the teams operating the systems.
- Reviewing monitoring and security events.
- Investigating suspicious activity and preparing findings.
- Coordinating infrastructure and administrative-access security.
- Preparing employee awareness and security documentation.
PotStation
A honeypot-platform graduation project exploring deployment, visibility, and threat observation.
Academic project · 2024–2025
Objective
Explore how a honeypot platform can make deployment and threat observation more approachable.
My role & contribution
Graduation-project work combining security experimentation, deployment, platform design, and academic documentation.
Verified status & evidence
Presented as an academic project, not as a publicly available commercial service. The project stack included T-Pot CE, Ubuntu, Docker, Spring, MySQL, Node, and Nginx.
Approach & focus
PotStation explored a service-based approach to deploying and working with honeypots. The project connected security experimentation with infrastructure and platform design, using T-Pot CE and a supporting application stack.
- Honeypot deployment and operational architecture.
- Linux and container-based infrastructure.
- Threat observation and security visibility.
- Documenting the project design and graduation work.
ISMS documentation & planning
Policies, procedures, risk methodology, registers, and a roadmap for implementation.
Draft prepared · implementation on hold
Objective
Connect security policies, risks, ownership, and an implementation roadmap in one coherent documentation set.
My role & contribution
Prepared the draft policies, procedures, risk methodology, registers, and implementation planning.
Verified status & evidence
The draft documentation was prepared; implementation was placed on hold. This is documentation and readiness work, not a claim of a completed rollout, certification, or independent audit.
Approach & focus
This work organized the documentation and planning foundations of an information-security management system. It brought policies, procedures, risk management, and implementation planning into a connected set of documents.
- Security policies and operating procedures.
- Risk assessment methodology and supporting registers.
- Control and evidence organization.
- Implementation planning and management communication.
Don't Ruin the Wedding!
A cooperative game prototype, built around shared play and multiplayer experimentation.
In development · prototype
Objective
Explore shared cooperative play and the practical challenges of a multiplayer game prototype.
My role & contribution
Independent game experimentation and iteration on local split-screen, listen-server play, and replication.
Verified status & evidence
The game is in development. Local split-screen, listen-server play, and replication have been tested in the prototype. It is not presented as a released product.
Approach & focus
Don't Ruin the Wedding! is my independent cooperative-game project. It brings together game creation, iteration, and the technical challenges of getting several players to share the same experience.
- Cooperative gameplay and iteration in Unreal Engine.
- Local split-screen play.
- Listen-server multiplayer experimentation.
- Replicated gameplay systems and testing.
Cybersecurity
You need to understand what is exposed, which findings matter, and what your team should do next.
Find weaknesses, improve monitoring, and respond to security problems with clear evidence and practical next steps.
Who it suits
Businesses that need security reviews, authorized testing, investigation, or hardening support.
Duration · estimate
Estimated: 1–3 weeks for a bounded review; testing and investigations are scoped separately.
Scope, access requirements, deliverables, review points, and handover are agreed before work starts.
What I can provide
Security posture & risk reviews
Review exposed services, access, endpoint coverage, and operational practices; turn findings into a prioritized action plan.
Vulnerability assessment & penetration testing
Scope and carry out authorized assessments of web applications, networks, and selected mobile-app surfaces, then explain impact and remediation.
Security monitoring & alert investigation
Review SIEM/log coverage, investigate suspicious activity, and improve alert triage and escalation.
Incident investigation & reporting
Collect relevant logs, build an event timeline, identify likely causes, and document containment and follow-up recommendations.
Hardening & access security
Review Linux, Windows, endpoint, firewall, and administrative-access configurations; support MFA and least-privilege improvements.
Remediation guidance & retesting
Help technical teams understand findings, plan fixes, and check whether agreed issues have been addressed.
Example deliverables
- Findings report with evidence and priorities
- Remediation plan and a technical handover
- Retest notes when included in the scope
What we need to start
- Systems and assets in scope
- Written authorization for testing
- Your main concerns and an agreed access window
We agree on scope, access, deliverables, and timing before work starts. Security testing requires authorization; compliance services support readiness rather than issuing certification.
Start with a conversationNetworks & system administration
Connectivity, server reliability, or unclear dependencies are consuming time and slowing your team.
Set up, maintain, and troubleshoot the infrastructure that everyday work depends on.
Who it suits
Small teams and IT departments that need hands-on infrastructure help or a second technical opinion.
Duration · estimate
Estimated: 2–10 working days for a bounded review or troubleshooting engagement.
Scope, access requirements, deliverables, review points, and handover are agreed before work starts.
What I can provide
Network setup & troubleshooting
Plan and troubleshoot LAN/WAN connectivity, addressing, VLANs, routing, switching, and firewall rules.
Windows & Active Directory administration
Support domain, user, group, workstation, and access administration, with documented changes and practical handover.
Linux server operations
Help configure and troubleshoot server services, permissions, updates, processes, and service availability.
DNS, domains & web infrastructure
Configure DNS records and BIND services, investigate resolution problems, and support Nginx/reverse-proxy and TLS configuration.
Container & service deployment support
Support Docker-based deployments and existing service configuration, connectivity, log review, and operational documentation.
Remote access & infrastructure reviews
Review administrative access, VPN/jump-host arrangements, and service dependencies to make support and maintenance easier.
Example deliverables
- Configuration or troubleshooting notes
- Network/service diagrams and a change summary
- Operating instructions and handover
What we need to start
- The current setup and affected users/services
- Symptoms or the change you need
- Access and a maintenance window
We agree on scope, access, deliverables, and timing before work starts. Security testing requires authorization; compliance services support readiness rather than issuing certification.
Start with a conversationSecurity governance & advisory
Security requirements exist, but ownership, documentation, and the implementation path need structure.
Connect technical security work with policies, risks, business priorities, and implementation plans.
Who it suits
Teams building a security function or preparing their documentation and controls for a review.
Duration · estimate
Estimated: 2–6 weeks for a documentation or gap-review phase; implementation is a separate scope.
Scope, access requirements, deliverables, review points, and handover are agreed before work starts.
What I can provide
Policies, procedures & ISMS documentation
Develop and organize security policies, SOPs, ownership, and supporting registers around how your team actually works.
Risk assessment & treatment planning
Build risk methodology, asset/risk registers, treatment actions, and a practical tracking process.
Compliance readiness & control mapping
Support documentation and gap reviews against relevant ISO 27001, SOC 2, PCI DSS, and local financial-sector requirements.
Security roadmaps & management reporting
Turn gaps and operational work into phased plans, progress reports, presentations, and clear management decisions.
Tool, vendor & budget evaluation
Compare security options against actual needs, document trade-offs, and help prioritize spending and implementation.
Ongoing security consultation
Provide scoped guidance for IT teams, fintech/startup projects, security requirements, and operational priorities.
Example deliverables
- Policies, registers, or a readiness report
- A prioritized implementation roadmap
- Management summary and handover
What we need to start
- Your business context and applicable requirements
- Existing documents and control owners
- The review or implementation goal
We agree on scope, access, deliverables, and timing before work starts. Security testing requires authorization; compliance services support readiness rather than issuing certification.
Start with a conversationIT support & Workspace
Your team needs dependable accounts, secure access, and a repeatable onboarding and support process.
Practical help for devices, accounts, productivity tools, and the people using them.
Who it suits
Individuals, small businesses, and teams needing dependable technical support and clear guidance.
Duration · estimate
Estimated: 2–5 working days for a bounded account, domain, or Workspace review.
Scope, access requirements, deliverables, review points, and handover are agreed before work starts.
What I can provide
Helpdesk & troubleshooting
Diagnose common hardware/software, workstation, connectivity, and account problems; explain the fix in plain language.
Device setup & software installation
Prepare workstations, install legitimate software, configure users, and document a repeatable setup.
Google Workspace & business email
Help with account administration, domain/email configuration, access settings, and day-to-day Workspace usage.
Account security & user onboarding
Support MFA, account recovery planning, password practices, and clear onboarding/offboarding checklists.
Remote assistance & technical handover
Walk users through fixes, prepare step-by-step guidance, and leave the team with usable support notes.
Example deliverables
- A resolved or clearly diagnosed issue
- Setup/support notes
- User guidance and recommended next steps
What we need to start
- Device/service and the exact symptoms
- A screenshot or error message
- Remote access or an agreed visit in Tripoli
We agree on scope, access, deliverables, and timing before work starts. Security testing requires authorization; compliance services support readiness rather than issuing certification.
Start with a conversationVideo editing & media
You have footage or a message, but need structure, pacing, and a finish suited to its audience.
Shape footage into a clear story, from longer videos to short social clips and game trailers.
Who it suits
Creators, small brands, communities, and projects with footage or a story to share.
Duration · estimate
Estimated: 3–10 working days for a short edit after footage and the brief are ready.
Scope, access requirements, deliverables, review points, and handover are agreed before work starts.
What I can provide
Video editing & storytelling
Build structure, pacing, transitions, and a coherent story from supplied footage.
Short-form clips & highlights
Edit reels, shorts, TikTok clips, and highlights with framing and timing suited to the intended platform.
Gaming videos & project trailers
Turn gameplay, streams, or project footage into highlights, teasers, and clear showcase videos.
Captions, titles & finishing
Add Arabic/English captions, simple titles, basic color/audio cleanup, and exports for the required format.
Production planning & creative collaboration
Help shape ideas, outlines, shot lists, and the editing brief; collaborate on on-camera or voice content within an agreed scope.
Example deliverables
- Edited master video
- Platform-specific versions or clips
- Caption/export files as agreed
What we need to start
- Footage and reference style
- Audience, platform, and target length
- Deadline and required versions
We agree on scope, access, deliverables, and timing before work starts. Security testing requires authorization; compliance services support readiness rather than issuing certification.
Start with a conversationContent & digital presence
Ideas and publishing are scattered; you need a clear message and a manageable content workflow.
Make technical ideas and personal or business stories easier to understand and share.
Who it suits
Creators and teams looking for organized content, clearer messaging, or help running their channels.
Duration · estimate
Estimated: 1–2 weeks for an initial content plan; recurring production is agreed separately.
Scope, access requirements, deliverables, review points, and handover are agreed before work starts.
What I can provide
Content planning & publishing workflow
Organize topics, formats, and a manageable publishing calendar around the audience and the content you can produce.
Social-media administration
Help organize profiles, publish agreed content, manage routine channel updates, and keep presentation consistent.
Arabic/English content adaptation
Adapt captions, profiles, explainers, and promotional copy for the language and audience.
Technical explainers & scripts
Turn a topic into a readable article, video outline, tutorial, or short script that people can follow.
Creator & community collaboration
Support technology/gaming content, channel introductions, and practical ideas for community communication.
Example deliverables
- A content plan or ready-to-publish copy
- Channel/profile updates within scope
- Publishing and handover notes
What we need to start
- Audience and communication goal
- Existing channels and brand materials
- Topics, languages, and publishing capacity
We agree on scope, access, deliverables, and timing before work starts. Security testing requires authorization; compliance services support readiness rather than issuing certification.
Start with a conversationTraining & documentation
People need practical guidance they can understand, use, and refer to after a session or handover.
Clear sessions, practical guides, and documentation that help people use technology confidently.
Who it suits
Employees, small teams, and learners who need understandable technology guidance.
Duration · estimate
Estimated: 3–10 working days for a focused session and supporting reference material.
Scope, access requirements, deliverables, review points, and handover are agreed before work starts.
What I can provide
Employee security awareness
Prepare practical sessions on phishing, accounts, data handling, and reporting suspicious activity.
IT tools & user training
Guide people through everyday computer, productivity, account, and support tasks using real examples.
Technical reports & operating guides
Write clear incident summaries, troubleshooting records, SOPs, and step-by-step handover guides.
Presentations & onboarding material
Prepare structured slides, explanations, and reference material for employee or management briefings.
Bilingual operating guides
Adapt security and infrastructure guidance for Arabic- and English-speaking teams, with a scoped handover session.
Example deliverables
- A session, guide, or presentation
- Reusable reference material
- Questions, exercises, or a practical handover
What we need to start
- Audience and current knowledge
- Learning or documentation goal
- Preferred language and format
We agree on scope, access, deliverables, and timing before work starts. Security testing requires authorization; compliance services support readiness rather than issuing certification.
Start with a conversation