Amir HazimZulhazmi

The problem. Malaysians lose money to payment scams every day, and the official checks (PDRM Semak Mule, the SC Investor Alert list) are scattered and slow to consult at the moment someone is about to pay.

What I built. A verification service reachable from a Telegram bot or the web. Forward a suspicious message and a deterministic, auditable verdict engine extracts bank accounts, phone numbers and company names (Malay/Manglish-aware), checks them against the live PDRM Semak Mule API and a 1,954-record Securities Commission alert snapshot, runs behavioural detectors, and returns one of three verdicts — JANGAN BAYAR, SEMAK DAHULU, TIADA AMARAN — in under a second.

Security decisions. The engine fails closed and never reassures by default. Integrating the PDRM endpoint surfaced a missing TLS intermediate certificate; rather than disabling verification, I shipped a pinned CA bundle. AI sits at the edges: a reviewer agent may only strengthen a verdict, and an autonomous engineering agent writes new detectors plus test suites on a branch and opens a real pull request when a detection gap is found — tests run independently, a human merges.

The problem. Compliance assessments and internal audits live in spreadsheets, Word documents and email threads. Evidence is hard to trace back to a control, and AI drafting tools tend to hallucinate conclusions.

What it does. Versioned frameworks are decomposed into reusable assessment areas; Design Effectiveness and Operating Effectiveness are evaluated separately; planning, risk-and-control matrices, sampling, findings and reporting live in one workspace. Evidence is stored in S3-compatible storage and indexed with pgvector so an audit copilot can draft objectives, test procedures and findings with explicit [E#] citations back to source excerpts.

My contributions. I built the custom assessment-clause model, a penetration-test report generator that produces client-format DOCX from structured findings, hardened the production migration path (schema compatibility checks, legacy-schema guards), and maintained the containerised deployment. Every LLM call is traced through Langfuse with per-user, per-feature token and cost attribution.

Governance stance. AI never silently changes a sample. Drafts stay disabled until an auditor confirms they were checked against the cited evidence.

Context. The upstream Agentic SOC Platform lets AI agents triage alerts, enrich indicators, correlate cases and run SOAR-style playbooks. It was built for a single organisation. Running it as a managed security service means one instance must serve many customers with zero data bleed.

What I changed.

• Tenant data-plane scoping enforced at the API layer, so every core resource is filtered by tenant before it reaches business logic — not left to the UI.
• Realtime auth: JWTs carried via Sec-WebSocket-Protocol instead of query strings, with reconnect-storm protection.
• Session continuity across token expiry without weakening revocation.
• Playbook approvals that require an administrator decision and block requester self-approval.
• Transactional case merging so correlation and locking cannot leave half-merged state.
• Dev/compose hardening: authenticated Redis health checks, object-storage readiness gates, tenant-aware demo data.

This is the same “AI in the SOC” R&D thread I lead at work, applied to a real codebase with real isolation requirements.

The problem. NACSA’s National Cyber Security Baseline is distributed as a spreadsheet questionnaire. Organisations fill it in, but get no scoring, no history and no idea how they compare to peers.

What we built. A dashboard that imports the official NCSB workbook via management commands, presents the questionnaire online, computes automated maturity scores per domain using a documented risk-maturity model, stores submission history, and benchmarks each organisation against sector averages and distributions. A threat-intelligence news feed keeps the dashboard useful between assessments.

My role. I led a team of four, owned the Django/DRF backend and the scoring calculations, and set up the containerised deployment behind Nginx.

The problem. A Wazuh alert tells you that something talked to an IP. Deciding whether it matters means opening the threat-intelligence platform, searching, waiting for enrichment, and copying the answer back.

What I built. A Wazuh integration script that takes the alert, extracts the destination IP, de-duplicates against a local SQLite cache, looks up or creates the observable in OpenCTI, triggers VirusTotal enrichment, pulls linked indicators and analyst notes, and pushes the enriched context back into Wazuh as a new event — with explicit handling for every error and rate-limit path.

Small in lines of code, large in analyst minutes saved.