Mohamed Ashraf

OT cybersecurity engineer

Invictux

Cairo, Egypt

10.2023 - Current

Performed security assessments, including IT, OT, and combined risk assessments, to identify vulnerabilities, weaknesses, and gaps within critical infrastructure sectors: electricity generation plants (Saudi Arabia, Bahrain), oil and gas plants (Saudi Arabia), water desalination plants (Saudi Arabia), petrochemical plants (Saudi Arabia).
Conducted comprehensive site visits to industrial facilities, collaborating with engineers, managers, CISOs to understand operational processes and cybersecurity posture of critical OT/ICS environments.
Engaged with plant personnel to gather detailed information on system architecture, cybersecurity practices, and potential vulnerabilities.
Identified cybersecurity gaps and control weaknesses through systematic evaluation, leveraging frameworks such as ISA/IEC 62443, NIST CSF, and OTCC/ECC.
Conducted threat modeling exercises for oil and gas facilities, identifying critical attack vectors to support proactive risk reduction and incident preparedness.
Conducted OT network architecture reviews for water desalination and electricity generation plants in Saudi Arabia, defining zones and conduits according to ISA/IEC 62443-3-2.
Developed, established, and enforced tailored cybersecurity policies and standards for OT environments, aligning with NIST 800-82, IEC 62443, and ISA/IEC 61511 across electricity, oil and gas, water desalination, and petrochemical industries.
Implemented network security measures including deployment of firewalls (FortiGate, Palo Alto) and industrial IDS solutions (Nozomi Networks, Dragos), applying network segmentation to safeguard critical OT environments in energy and oil and gas sectors.
Oversaw security patch management processes for OT environments, ensuring critical systems in energy and petrochemical sectors were updated with minimal operational disruption.
Delivered cybersecurity awareness training programs for employees and stakeholders across electricity generation, oil and gas, and petrochemical facilities, enhancing security culture and regulatory compliance awareness.
Conducted OTCC compliance gap assessments for petrochemical plants, providing detailed remediation roadmaps to meet NCA OTCC requirements.
Performed vulnerability assessments using Tenable Nessus and configuration compliance assessments using CIS-CAT Pro Assessor across oil and gas, electricity, and industrial sectors, ensuring alignment with best practice baselines.
Executed cybersecurity maturity assessments against NIST Cybersecurity Framework (CSF) and C2M2 for petrochemical plants, supporting strategic cybersecurity improvements.
Developed and implemented comprehensive Incident Response Plan (IRP) tailored to operational technology (OT) environment of Water Conversion Corporation in Saudi Arabia, ensuring alignment with NIST 800-61 and ISA/IEC 62443 standards.