For 23 years I've lived between code and security: writing software, hardening servers, attacking my own builds before anyone else can, and leading digital transformation for banks, enterprises, governments and international organizations across the MENA region.
attack_surface_assessed: web apps · APIs · Linux servers · mail / SMTP · payments · databases · networks & firewalls
I started in 2003 writing code and running Linux servers for a hosting company I founded, and I've been in technology ever since. In those first years I was the technical authority behind 400+ web projects: designing databases, building e-payment systems, hardening servers and running penetration tests as a Certified Ethical Hacker.
From there I moved into bigger arenas: leading e-commerce platforms for a global beauty brand across the Middle East, engineering APIs and mail infrastructure for a TV network in Abu Dhabi, and running regional digital transformation across three countries.
Today I'm an Assistant Manager in Technology Consulting at BDO Jordan, where I audit IT controls and cybersecurity for banks and enterprises, assess vulnerabilities, and design digital transformation roadmaps with donor-funded programs for UNDP, UNICEF and USAID.
My approach is simple: an attacker's mindset, an engineer's hands, and a consultant's clarity. I build things that work, test them the way a real adversary would, and explain the results in plain language that decision-makers can act on.
Thinking like the attacker so you don't have to meet one. Vulnerability assessments and penetration tests for web apps, servers and infrastructure, with clear remediation paths.
Server hardening, firewall design, encryption, threat detection and incident response, built around confidentiality, integrity and availability.
General IT controls, application controls, business continuity and disaster recovery, aligned with ISO/IEC 27001 and regulator requirements for banks and enterprises.
Roadmaps, process automation, platform strategy and readiness assessments that move organizations from paper and silos to secure, data-driven operations.
Full-stack engineering from the database up: PHP, MySQL, APIs, WordPress, LMS and government platforms, custom CRMs and system integrations.
Secure e-payment architecture, payment gateways, PSP and digital wallet setups, and digital banking studies grounded in regulatory compliance.
Every system can be broken. My job is to find out how, before someone else does.
Security has been part of my work since 2003, when I was configuring firewalls and hardening early-stage systems. Since then I've protected high-traffic platforms, mail infrastructures, news sites, enterprise networks and government data systems. Good security isn't a product you install, it's a process you repeat.
Understand the environment, the assets and the real business risk.
Map the attack surface and identify weaknesses before attackers do.
Prove impact safely, within agreed rules of engagement.
Fix root causes, not symptoms, and verify the fix.
Plain-language findings, and training so your team stays self-sufficient.
# engagement.sh — how I think about every system target = "your_business" for asset in map_attack_surface(target): risk = assess(asset) if risk.exploitable: prove_safely(asset) fix_root_cause(asset) verify(asset) document(findings, audience="humans") train(team) # so you don't need me forever
// what I attack (with permission)
// what I build & enforce
A government digital HR and data platform with complex API integrations and strict ethical-hacking-driven security controls.
Designed and developed a full LMS with UX testing and coordination with the implementing team.
Architected the payment service provider and digital wallet environment for regulatory readiness.
External IT audits and security assessments covering IT controls, risk management, resilience and data protection.
An AI-driven hiring platform with custom data architecture and automated workflows.
Secure survey distribution, vendor-categorization algorithms and CRM integration.
End-to-end cybersecurity program with AI-assisted threat detection and encrypted data management.
Platform architecture, payment gateway integration and performance tuning across the MENA region.
Secure email server infrastructure and data security controls on Linux for a large regional platform.
The cheapest vulnerability to fix is the one that never ships. I bring security into architecture and code from day one.
Policies, SOPs and documentation keep systems healthy long after the project ends.
From CRM workflows to data pipelines, I replace manual effort with reliable systems.
I've trained hundreds of people and mentored 70+ startups and SMEs, because real transformation happens when teams own the skills.
Whether it's a penetration test, an IT audit, a new platform or a digital transformation plan, let's talk.
I started my studies at Mutah University, majoring in Communications Engineering, in 2001. However, due to low grades, I received two warnings, which led to my dismissal from the university
As a Senior Digital Consultant at BDO Jordan, my multifaceted role revolves around elevating the marketing and operational landscape. My responsibilities span from the inception of infrastructure to enhancing sales, international agency partnerships, and implementing digital solutions for streamlined processes.
• Market Expansion: Led analysis to enter 16 countries in MENA, allocating budget based on target audience.
• Brand Building: Established Surgent brand in MENA region, fostering recognition and loyalty.
• Marketing Systems: Developed email marketing and CRM systems, integrating with social media platforms.
• Training Initiatives: Training staff on Digital marketing and E-learning System.
• Marketing Automation: Implemented automated systems, enhancing sales team performance.
• E-Learning Platform: Designed and implement BDO Jordan Academy e-learning system.
• Digital Forensics: Participated in digital forensics tasks, ensuring data integrity.
• Competitive Analysis: Prepared growth reports and analyzed competitors for strategic insights.
• Tender Proposal Development: Created proposals for tenders, supporting business development efforts.
• Data Integration: Collaborated on projects integrating data with AI systems.
• System Development: Programmed and developed systems for domestic and international projects.
As the IT & Digital Marketing Manager in Finance & Business across Jordan, Ukraine, and the UAE, I spearheaded transformative initiatives and achieved notable successes in leading-edge digital strategies. Below are my key responsibilities and accomplishments:
• Led diverse digital team, fostering continuous learning and innovation.
• Developed and executed company-wide digital transformation strategy.
• Established digital connectivity across company branches in Jordan, Ukraine, and the Emirates.
• Defined and implemented KPIs across critical departments for optimization.
• Evaluated and implemented cutting-edge digital tools for competitive advantage.
• Implemented robust data security measures to safeguard against cyber threats.
• Digital Marketing Leadership:Orchestrated comprehensive digital marketing campaigns across multiple channels.
• Fostered collaboration between IT and digital marketing teams.
• Leveraged data analytics for informed decision-making and optimized digital strategies.
As an E-commerce & Digital Marketing Manager at Markatcom, I’ve been instrumental in propelling the company’s online retail footprint throughout the MENA region. Here’s a breakdown of my key responsibilities and achievements:
• Led platform optimization for a seamless online shopping experience.
• Managed product listings and streamlined inventory processes.
• Implemented efficient payment and checkout systems.
• Crafted impactful campaigns boosting traffic, engagement, and conversions.
• Successfully executed email marketing strategies for lead nurturing and sales.
• Enhanced online content for improved search engine rankings and visibility.
• Conducted detailed data analysis to monitor KPIs and evaluate strategy effectiveness.
• Optimized UX for visual appeal and ease of navigation.
• Strategically planned and executed promotions to drive sales and loyalty.
• Stayed updated on industry trends and conducted competitor analysis for strategy enhancement.
• Managed budgets for cost-effectiveness and positive ROI
During my tenure at Abu Dhabi TV (ADtv), an esteemed Emirati television channel launched in 1969, I served as an SEO & Social Media Developer. My role primarily focused on SEO optimization and API development for multiple social media platforms. Here's a summary of my key accomplishments and contributions:
• Achieved 245% ROI in 2013 Ramadan Campaign via YouTube: Implemented strategic SEO techniques and optimized social media campaigns to achieve remarkable results, particularly during the Ramadan campaign on YouTube.
• Established Email Marketing System and SMTP Setup on Linux Servers: Built and deployed an Email Marketing system from scratch, including the setup of SMTP servers on Linux infrastructure, streamlining communication efforts and enhancing marketing reach.
Founder of Jordan Host at 20. Today Assistant Manager of Technology Consulting at BDO Jordan. Twenty-three years of building secure platforms, leading regional teams and growing businesses across banking, government, NGOs and retail.
What I can run, and how.
A founder-turned-consultant who has worked at every layer of technology: from running servers and writing code, to securing banks and setting digital strategy, to growing revenue.
I started Jordan Host at 20 and engineered hundreds of production systems. I then led e-commerce for a global retail brand, ran IT and digital transformation across three countries, and today audit and advise banks and institutions on IT governance, cybersecurity and digital strategy.
That range lets me set strategy with the board, review architecture with engineers, test defenses like an attacker, and build the growth engine that turns a platform into results. I lead through clear ownership, measurable KPIs and teams that become self-sufficient.
Growth treated as an engineering problem.
Instrument the funnel, find the leak, automate the fix, measure again. Because I build the systems myself, experiments ship in days, not quarters.
2013 Ramadan campaign on YouTube for Abu Dhabi TV, driven by SEO and social optimization.
Digital scaling and performance measurement for founders in the Orange Corners program.
Regional SEPHORA platforms via Markatcom: checkout, SEO, email, promotions, UX, budgets and ROI.
Multi-country funnels linking landing pages, webhooks and APIs to automated lifecycle communication.
Email and WhatsApp systems, donor and customer segmentation, predictive CRM models for retail and real estate.
Review optimization and online reputation strategy for an international hospitality brand.
Twenty-three years, five organizations, one thread: secure systems that drive results.
Lead IT audit, cybersecurity and digital transformation engagements across the MENA region for banks, enterprises, government bodies and international development organizations.
Led regional digital transformation and enterprise modernization across three countries, working directly with executive management.
Owned the technical design, performance and growth of regional e-commerce platforms for a multinational retail brand.
Built the secure technical foundation and the growth channels behind the broadcaster's digital platforms.
Started the company at 20 and served as its principal technical authority across 400+ local and international projects, from architecture to security.
Six disciplines, one profile.
Expert Advanced
Certified Professional Mentor · Certified SME Mentor, Mercy Corps.
I coach founders and SME owners on digital transformation, CRM and automation, digital identity and sustainable growth, with hands-on implementation rather than slides alone.
Business development, digital transformation and operational strategy, with monitoring and performance assessment for sustainable growth.
Digital expansion, marketing optimization, technology adoption and performance measurement.
Digital growth, operational processes and sustainability planning, including enterprise CRM deployment and digital operating frameworks.
Tools, frameworks and advisory for continuity and scalable operations: CRM implementation, follow-up automation, digital identity and team training.
Digital transformation consulting and SME mentoring: systems and process assessment, data management, risk reduction and capacity building.
Highlights shown in bold.
The full certificate library is on the Certificates page.
Al-Isra University, Amman, Jordan
Mutah University, Karak, Jordan
Native Arabic. Professional English (reading, speaking, writing).
ISO/IEC 27001 Lead Auditor (TÜV AUSTRIA, recognized by IRCA) · CISA track (candidate)
Sharing what I've learned.
Open to leadership roles, consulting engagements, audits, security assessments and growth projects.
I'm Mohammad Awwad: ISO 27001 & ISO 9001 Lead Auditor, ethical hacker and founder of host.jo. For 23 years I've built, attacked and secured systems for banks, enterprises, governments and international organizations across Jordan and the MENA region. Every service below is something I do myself, not something I outsource.
worked with / for: BDO · UNDP · UNICEF · USAID · SEPHORA · Abu Dhabi TV · Royal Scientific Society · Orange Corners
Seven services I deliver hands-on for clients in Jordan and across the MENA region. Each one can be booked as a few hours of advice, a defined project, or a standing retainer — tap a card to go deeper.
Authorized attacks on your web apps, APIs, servers and infrastructure to find what a real adversary would find first, with a clear fix for every finding.
General IT controls, application controls, business continuity and disaster recovery, aligned with ISO/IEC 27001 and central bank requirements for banks and financial institutions.
From scoping and risk assessment to policies, controls and internal audit, prepared by a CQI | IRCA certified Lead Auditor who knows what certification auditors look for.
Linux and web server hardening, firewalls, encryption, secure mail (SMTP) and fast response when something has already gone wrong.
Roadmaps, process automation, CRM and platform strategy that turn paper and silos into secure, data-driven operations, with KPIs your board can track.
Secure full-stack development: PHP, MySQL, APIs, WordPress, learning platforms and payment integrations, built by someone who also attacks his own code.
Data-driven growth using your own first-party data: SEO, CRM-based segmentation, email/WhatsApp automation, paid campaigns and conversion rate optimization, with the same engineering rigor as my security work.
A lot of security and digital advice is theoretical. Mine isn't. Everything below is something I built, broke or ran myself — not a framework I read about.
Started host.jo at 20. Grew it to 242 employees before COVID forced a painful downsize — and it still runs today.
Databases, payment systems, LMS platforms and APIs I personally architected and deployed, not just advised on.
External IT audits of commercial and digital banks against central bank requirements — regulator-grade, not theoretical.
ISO/IEC 27001:2022 and ISO 9001:2015 Lead Auditor (CQI | IRCA) — credentials a certification body actually checks.
No long contracts to start. You know the scope, the hours and the price before work begins.
Send a short message. I reply with questions and whether I'm the right fit.
A written scope, estimate and, for security work, signed authorization.
Calls, reviews, testing or build, with updates as I go.
Plain-language findings, fixes, and a retest or Q&A so your team can run it.
Pre-agreed blocks of hours for architecture reviews, security questions, vendor assessments or second opinions. Good for startups, SMEs and internal IT teams.
A penetration test, IT audit, ISO 27001 gap analysis, platform build or transformation roadmap with a clear scope, timeline and deliverable.
A reserved number of hours each month for continuous advice, periodic testing, growth work and on-call support when incidents happen.
I only test systems you own or are authorized to test, and I only use data you've given consent for. Each engagement has a signed scope, agreed rules of engagement, a data-handling policy and an NDA. Findings are shared only with you, and exploitation is controlled so production stays safe.
# rules_of_engagement.txt scope = "signed, in writing" authorized = "owner approval only" data = "consented, minimal access" impact = "controlled, no downtime" report = "plain language + fixes" retest = "included after remediation"
Send a short description of your project. I'll reply with questions, an honest view on fit, and an estimate of the hours.
Typical reply within one business day · Amman, Jordan (UTC+3)
