Skip to content

$ whoami Muhammad Murtuza Hussain

Every system has a story. Risk is the plot.

Cybersecurity risk and governance specialist who writes the software too. ISO 27001, NIS2 and Horizon Europe by day, Python by night.

Open case files

Currently Programme Manager at TFC Research & Innovation. I own the risk register for FITTER, a Horizon Europe programme, consult on ISO 27001 for SaaS start-ups, and ship open-source security tooling in Python at night.

Currently Programme Manager at TFC Research & Innovation. I own the risk register for FITTER, a Horizon Europe programme, consult on ISO 27001 for SaaS start-ups, and ship open-source security tooling in Python at night.

2021 / Nagpur, India

My first risk register was a rack of PlayStations.

In January 2021 I started a console rental business. Every console that left the shop was an asset walking out the door, and every customer account was a password someone else could reuse. I learned the vocabulary later. Back then I just built access rules, account hygiene and a maintenance routine so the business kept running. Three and a half years later, I knew what I wanted to protect for a living. 

risk_register.csv, reconstructed

assetthreattreatment
Console fleetWear and faultsPreventive maintenance
Customer accountsAccount compromiseAccess control, account hygiene
Customer dataMishandlingWritten SOPs
Service uptimeDowntimeIncident-response routine

2024 / Galway, Ireland

One suitcase. One Master's. Then a hall of 3,800 people.

I landed in Ireland for an MSc in Cybersecurity Risk Management at the University of Galway. Within a year I was elected Societies Chairperson, founded the Cybersecurity Society to 350+ members, was named Socs Hero at the Societies Awards, and was handed a microphone in front of 3,800 new students at orientation. 

Murtuza taking a selfie on stage in front of a waving audience of international students

2025 / Hackathons

Hackathons turned a risk person into a builder.

SAP Enterprise Challenge, Climathon Galway, Empathy Jam, the AtlanTec AI Challenge. Every weekend competition forced the same question: can you ship it by Sunday? I started writing the code myself. Then, at BSides Belfast, I walked into a Capture the Flag with no offensive background and walked out with second place. 

Murtuza on stage collecting second place at the BSides Belfast Hacker House CTF
BSides Belfast CTF, 2nd place
Murtuza holding a certificate with his team at the ISCG x Deloitte Case Competition
Deloitte x ISCG, Best Speaker and 2nd place team
Murtuza with fellow winners at Empathy Jam Galway
Empathy Jam Galway 2025, Best Civic Sense
Murtuza pitching TradeTribe, a student-to-student exchange for Galway, with his team
Climathon Galway, 1st prize for TradeTribe

Now / Dublin and Galway

Now I run risk for Horizon Europe programmes, and build the tools I wish existed.

At TFC Research & Innovation I designed the risk framework for FITTER, a 36-month Horizon Europe programme, and I lead workstreams on B-Prepared and PEERS. On the side I consult on ISO 27001 for SaaS start-ups and publish open-source security tooling on GitHub. Governance on weekdays. Python at night. 

FITTER

Risk Management Officer

Horizon Europe, GA 101132546

B-Prepared

Uptake, Sustainability & Comms Lead

ISO 22398 live drill, Ustka

PEERS

Co-Creation & Beneficiary Guide Lead

Beneficiary Guide, two editions

a newsletter by Murtuza

Word on the Quay.

Quay, as in Quay Street. Pronounced key, as in the one you never share.

AI and cyber news, Galway events, and who’s hiring in Ireland. Written for students and young professionals. Because the best opportunities in Galway travel by word of mouth, and not everyone is in the room yet.

Every two weeks, free, with the odd early issue when something can’t wait. One click to unsubscribe. Your email is used for this newsletter and nothing else.

Inside every issue

every two weeks

  1. AI spotlight

    One AI story that matters, explained in two minutes, and what it means for your career.

  2. Cyber spotlight

    One breach, law or tool worth knowing, and the lesson behind it.

  3. What’s on in Galway

    Meetups, hackathons, CTFs and conferences in the next two weeks, with free and student-friendly ones flagged.

  4. Who’s hiring

    AI and cybersecurity roles in Ireland, graduate to mid-level only. No “senior, 8+ years” listings.

For international students, graduates and anyone early in AI or cyber in Ireland who keeps asking, “how did you even hear about that?”

Six years, one thread: protect what people depend on.

  1. 2025 - present

    Programme Manager, Risk Management Lead (FITTER)

    TFC Research & Innovation

    Risk Management Lead across every work package of a 36-month Horizon Europe programme (GA 101132546).

  2. 2025 - present

    Cybersecurity Consultant, GRC & ISO 27001

    Freelance

    ISO 27001 enablement for four early-stage SaaS clients across Ireland and Dubai.

  3. 2024 - present

    Volunteer Lead & Social Media Manager

    BSides Galway

    Volunteering since September 2024. Runs the volunteers and all of the social media for BSides Galway 2025 and 2026, with 2027 on the way.

  4. 2025 - 2025

    Digital Innovation Intern

    University of Galway IdeasLab

    Power BI dashboards for programme and campaign KPIs.

  5. 2025 - 2025

    Societies Chairperson

    University of Galway Students' Union

    Elected to the Students' Union Executive. Chaired meetings between the Union and every society.

  6. 2024 - 2026

    Ambassador

    Global Galway

    Welcomed and guided international students; spoke at orientation to 3,800+.

  7. 2021 - 2024

    Founder & Owner

    PlayStation Rental, Nagpur

    Bootstrapped and ran a console rental business for three and a half years. Access control, account hygiene, SOPs.

education

  • MSc, Cybersecurity Risk Management

    University of Galway 2024 - 2025

  • Diploma, Computer Science

    IIT Madras 2023 - 2024

  • BSc, Mathematics & Computer Science

    RTM Nagpur University 2020 - 2023

honours

Socs Hero

University of Galway Societies Awards, 2025

Chosen by a judging panel or nominated by the Societies Office and the Students’ Union for outstanding creativity, dedication and impact across student societies.

  • Gold President’s Award for Innovation & EntrepreneurshipUniversity of Galway IdeasLab, top tier, 2025
  • Invitation to Áras an UachtaráinThe President’s residence, 2025
  • President’s Award for Volunteering (ALIVE)2025
  • 4 more Societies Awards2025
  • Employability Award2025

Curriculum vitae

PDF, 2 pages

Download CVor view LinkedIn

Not a generalist. A specialist with range.

My depth across the eight CISSP domains, self-assessed and backed by shipped work. Deep in risk and software security, broad everywhere else.

D1Risk & GovernanceD2Asset SecurityD3ArchitectureD4NetworkD5IAMD6AssessmentD7SecOpsD8Software Security

Security & Risk Management

9/10

Owns the live risk register for a Horizon Europe programme. ISO 27005 methodology, NIS2 mapping, board-level KRI packs, policy suites for four SaaS clients.

proven in

Mapped against the CISSP Common Body of Knowledge. A self-assessment, not a certification.

Case files. Open one, they all run.

JavaScriptD1D2

NIS2 Compliance Mapper

Maps 54 obligations from Articles 20, 21 and 23 to the people who own them and the evidence that proves them.

  • Entity classification with legal basis
  • 17 roles with fallback chains
  • Evidence register ranked by leverage
nis2-compliance-mapper

1. Which sector are you in?

2. How big is the organisation?

3. DNS, TLD registry or qualified trust service?

answer three questions to classify the entity

PythonD3D5D6

AWS Posture Checker

Ten read-only checks across every region, each finding mapped to CIS, ISO/IEC 27001:2022 and NIS2 Article 21.

  • Standard library only, no SDK
  • A check that cannot run is never a pass
  • Console, JSON, Markdown and HTML reports
aws-cspm-checker
ready. read-only, standard library only.
JavaScriptD1D7

STORMSURGE Tabletop

A 380 Gbps flood becomes a Layer 7 attack, a ransom note and a smokescreen intrusion. Every decision moves four readiness metrics.

  • Eight decision points, RACI for each
  • NIS2 and GDPR notification clocks
  • Exports a blameless post-mortem
ddos-tabletop-exercise

Service

5

Trust

5

Compliance

5

Cost control

5

T+00:40

380 Gbps volumetric flood. Checkout is down. Your ISP offers scrubbing diversion, billed per hour.

ShellD7D6

Wazuh Home SOC

Three hand-written detections mapped to MITRE ATT&CK, each with an attack simulation and an offline regex test harness.

  • SSH brute force, web attack, privilege escalation
  • Optional ELK sidecar
  • Honest limitations section
wazuh-home-soc-lab
Sep 29 09:12:01 target sshd[811]: Accepted publickey for murtuza from 10.0.0.4
matches in window: 0/5
JavaScriptD1D7

MOVEit / Cl0p Timeline

One SQL-injection zero-day, 2,700+ organisations, roughly 96 million people. Every claim cited to a primary source.

  • 17 dated events, 11 sources
  • Mapped to MITRE ATT&CK
  • Shows Cl0p's pattern before the headline
moveit-clop-breach-timeline

27 May 2023 / zero-day

Mass exploitation of MOVEit Transfer begins over a US holiday weekend.

PythonD4D3

TLS Config Auditor

Threaded probes for every protocol version, weak-cipher detection and certificate expiry, graded against RFC 8996.

  • One thread per domain
  • CI-friendly exit codes
  • Mozilla Intermediate baseline
tls-config-auditor

$ tls-audit tls-v1-0.badssl.com:1010

protocolTLS 1.0 accepted
cipherECDHE-RSA-AES128-SHA
certificatevalid
gradeFAIL

sample output against public badssl.com test hosts

also shipped

Hardened AWS baseline

Private subnets, per-AZ NAT, flow logs from day one, default security group stripped.

HCL / terraform-hardened-baseline-network

Webhook alert router

Severity triage to Slack and email with deduplication windows.

JavaScript / webhook-alert-router

Remember Me

A consent-first Telegram memory companion for caregivers.

TypeScript / remember-me

Cyber Security Society

A sandboxed mission platform where students learn through investigations and an escape room.

TypeScript / cyber-security-society-2026

I write the controls and the code that checks them.

python
def check_s3_public_access(account) -> Finding:
    blocks = account.s3.public_access_block()
    if not all(blocks.values()):
        return Finding("S3-001", "high",
            refs=["CIS 2.1.4", "ISO 27001 A.8.3", "NIS2 21(2)(i)"])
    return Finding.passed("S3-001")

shipped in: aws-cspm-checker, tls-config-auditor, helmet-detection capstone

The person behind the risk register. Poke around.

Open the apps in the dock. Two of them are games.

Murtuza OS

GALWAY

Tuesday

29

MTWTFSS123456789101112131415161718192021222324252627282930

Can’t Rush Greatness

Central Cee

the Galway canal commute

my playlists

7 spoken languages, and counting

Send me something worth encrypting.

Roles in GRC and security engineering, speaking, or a risk problem you want a second pair of eyes on.

Prefer paper? Download CV

murtuza@galway ~ % contact --new --encrypt

Delivered straight to my inbox.