About Me
I'm Mohammad Awwad.
I build systems, and I break them to make them safer.
For 23 years I've lived between code and security: writing software, hardening servers, attacking my own builds before anyone else can, and leading digital transformation for banks, enterprises, governments and international organizations across the MENA region.
attack_surface_assessed: web apps · APIs · Linux servers · mail / SMTP · payments · databases · networks & firewalls
STATUS: ACTIVE · CLEARANCE: LEVEL 23
Who I Am
I started in 2003 writing code and running Linux servers for a hosting company I founded, and I've been in technology ever since. In those first years I was the technical authority behind 400+ web projects: designing databases, building e-payment systems, hardening servers and running penetration tests as a Certified Ethical Hacker.
From there I moved into bigger arenas: leading e-commerce platforms for a global beauty brand across the Middle East, engineering APIs and mail infrastructure for a TV network in Abu Dhabi, and running regional digital transformation across three countries.
Today I'm an Assistant Manager in Technology Consulting at BDO Jordan, where I audit IT controls and cybersecurity for banks and enterprises, assess vulnerabilities, and design digital transformation roadmaps with donor-funded programs for UNDP, UNICEF and USAID.
My approach is simple: an attacker's mindset, an engineer's hands, and a consultant's clarity. I build things that work, test them the way a real adversary would, and explain the results in plain language that decision-makers can act on.
- nameMohammad Awwad
- based_inAmman, Jordan
- roleAssistant Manager, Tech Consulting
- companyBDO Jordan
- founderJordan Host (host.jo)
- degreeB.Sc. Software Engineering
- coding_since2001
- languagesArabic · English
- freelanceAvailable
Focus Areas
Ethical Hacking & Pentesting
Thinking like the attacker so you don't have to meet one. Vulnerability assessments and penetration tests for web apps, servers and infrastructure, with clear remediation paths.
Cybersecurity & Hardening
Server hardening, firewall design, encryption, threat detection and incident response, built around confidentiality, integrity and availability.
IT Audit & Governance
General IT controls, application controls, business continuity and disaster recovery, aligned with ISO/IEC 27001 and regulator requirements for banks and enterprises.
Digital Transformation
Roadmaps, process automation, platform strategy and readiness assessments that move organizations from paper and silos to secure, data-driven operations.
Software & Platform Development
Full-stack engineering from the database up: PHP, MySQL, APIs, WordPress, LMS and government platforms, custom CRMs and system integrations.
Payments & Digital Finance
Secure e-payment architecture, payment gateways, PSP and digital wallet setups, and digital banking studies grounded in regulatory compliance.
The Hacker Mindset
Every system can be broken. My job is to find out how, before someone else does.
Security has been part of my work since 2003, when I was configuring firewalls and hardening early-stage systems. Since then I've protected high-traffic platforms, mail infrastructures, news sites, enterprise networks and government data systems. Good security isn't a product you install, it's a process you repeat.
Recon & scoping
Understand the environment, the assets and the real business risk.
Discovery & assessment
Map the attack surface and identify weaknesses before attackers do.
Controlled exploitation
Prove impact safely, within agreed rules of engagement.
Remediation & hardening
Fix root causes, not symptoms, and verify the fix.
Reporting & transfer
Plain-language findings, and training so your team stays self-sufficient.
# engagement.sh — how I think about every system target = "your_business" for asset in map_attack_surface(target): risk = assess(asset) if risk.exploitable: prove_safely(asset) fix_root_cause(asset) verify(asset) document(findings, audience="humans") train(team) # so you don't need me forever
// what I attack (with permission)
// what I build & enforce
Technical Arsenal
Things I've Built & Secured
Foras Platform
A government digital HR and data platform with complex API integrations and strict ethical-hacking-driven security controls.
IPSAS Learning Platform
Designed and developed a full LMS with UX testing and coordination with the implementing team.
PSP & Digital Wallet Setup
Architected the payment service provider and digital wallet environment for regulatory readiness.
Banking IT & Cyber Assessments
External IT audits and security assessments covering IT controls, risk management, resilience and data protection.
AI Recruitment Ecosystem
An AI-driven hiring platform with custom data architecture and automated workflows.
Vendor Data Automation
Secure survey distribution, vendor-categorization algorithms and CRM integration.
Corporate Security Framework
End-to-end cybersecurity program with AI-assisted threat detection and encrypted data management.
Regional E-Commerce Platforms
Platform architecture, payment gateway integration and performance tuning across the MENA region.
Large-Scale Mail Infrastructure
Secure email server infrastructure and data security controls on Linux for a large regional platform.
How I Work
Security is built in, not bolted on
The cheapest vulnerability to fix is the one that never ships. I bring security into architecture and code from day one.
Governance makes technology sustainable
Policies, SOPs and documentation keep systems healthy long after the project ends.
Automate everything repeatable
From CRM workflows to data pipelines, I replace manual effort with reliable systems.
Teach, don't just deliver
I've trained hundreds of people and mentored 70+ startups and SMEs, because real transformation happens when teams own the skills.
Need to secure, audit or transform something?
Whether it's a penetration test, an IT audit, a new platform or a digital transformation plan, let's talk.