MS Cybersecurity @ NYU Tandon · Open to GRC & Risk Roles
Cybersecurity graduate student at NYU Tandon (3.89 GPA, Cyber Fellows Scholar) and Cyber Intern at the NYS Executive Chamber's Chief Cyber Office. RIT alum focused on GRC, risk management, and compliance, building security programs that align with business goals, risk appetite, and regulatory obligations.
Who I Am
I'm a Master's student in Cybersecurity at NYU Tandon School of Engineering (3.89 GPA, Cyber Fellows Scholar), building on my B.S. in Computer Security from Rochester Institute of Technology, where I also minored in Web Development and immersed in Economics. I focus on the space where technical security meets organizational governance, making sure cybersecurity decisions align with business goals, risk appetite, and compliance obligations.
As a Cyber Intern at the NYS Executive Chamber's Chief Cyber Office, I run the statewide NYS Cyber Survey (mapping CIS Controls v8.1.2 across 98 agencies with R and Python automation), author threat intelligence and AI policy research briefed to the Governor and Director of Security & Intelligence, and build critical-infrastructure regulatory frameworks that map state statutory authority to real oversight gaps.
My portfolio spans a 15-page GRC risk assessment of NYC Public Schools, four deployed full-stack security apps, and IEEE research on behavioral GRC, IoT segmentation, and cryptographic media provenance. I'm fluent in English and Albanian, conversational in Spanish and French.
Capabilities
// Security & GRC
// Tools & Platforms
// Development & Research
Background
// Professional
FEB 2026 – PRESENT
@ NYS Chief Cyber Office · New York, NY
NYS
JAN 2023 – APR 2023
@ Rochester Institute of Technology
AUG 2022 – DEC 2022
@ Rochester Institute of Technology
MAY 2019 – PRESENT
@ FirstService Residential · NYC
FS
// Education & Certifications
SEP 2025 – MAY 2027
@ NYU Tandon School of Engineering
Applied Cryptography, Network Security, Application Security, AI in Cyber Security, Information Security & Privacy, Database Systems. Research: behavioral GRC, IoT segmentation, media provenance cryptography.
AUG 2019 – MAY 2024
@ Rochester Institute of Technology
Major in Cybersecurity · Minor in Web Development · Immersion in Economics. Coursework: Risk Management for Information Security, Network & System Security Audit, Disaster Recovery, Cyber Security Policy & Law.
Dean's List '21-'24 · RIT Founders Scholarship · Major GPA 3.42
2015 – 2019
@ Benjamin N. Cardozo H.S., Queens NYC
Arista Honor Society · National Honors Society.
Certification
@ Google / Coursera
Troubleshooting, networking, OS, system administration, and security fundamentals.
My Work
Risk Assessment · GRC
A 15-page open-source risk assessment of the largest U.S. school district (900K+ students, 700+ third-party data vendors), built entirely from public records. Translates the NYS Comptroller's 2026 audit, disclosed breach history, and K-12 threat research into a prioritized risk register rated with FIPS 199, STRIDE, and MITRE ATT&CK, and mapped to NIST CSF 1.1, 8 NYCRR Part 121, and FERPA.
Threat Intelligence
Real-time threat intelligence platform aggregating MITRE ATT&CK techniques and NIST NVD CVEs into a live, filterable dashboard. Flask/SQLite backend with a scheduled ingestion pipeline (APScheduler) feeding a React + Recharts frontend, fully deployed, no API keys required.
Machine Learning · Detection
ML-powered phishing URL detector using a scikit-learn Random Forest trained on 25+ lexical features: length, Shannon entropy, subdomain depth, punycode, and phishing-keyword signals. Real-time scoring via a Flask API and React frontend, trained on free OpenPhish + Tranco data.
Zero Trust · IAM
A working Zero Trust access control system enforcing continuous verification, least privilege, and assume-breach. Dynamic trust scoring from TOTP MFA, device fingerprinting, and session context gates access to tiered resources, with JWT/bcrypt auth with a full audit trail and React frontend.
AppSec · OWASP
OWASP Top 10-aligned scanner checking 15+ vulnerability classes: missing security headers, CSP/HSTS gaps, CORS misconfiguration, cookie flags, reflected XSS and SQLi indicators, with severity-ranked findings, evidence, and remediation guidance. Flask + BeautifulSoup backend, React/Recharts UI.
State Government · Policy
CIS Controls v8.1.2 mapping across state agencies, R/Python data tools to surface compliance gaps, and a cybersecurity incident reporting interface that triggered a formal red team review after beta vulnerabilities were discovered.
NYS Government · InternalWeb & Database
Three-tier Flask/MySQL CRUD application modeling a government cyber office workflow, tracking assets, CVEs, analyst assignments, and remediation actions. Includes ER model, stored procedures, ML risk-scoring function, and trigger automation.
NYU Coursework · AcademicResearch · IEEE Paper
Human-integrated GRC framework demonstrated 37.5% reduction in social engineering incidents (p<0.001) vs. traditional approaches. ML behavioral risk scoring achieved 82% predictive accuracy in a 200-user simulated enterprise over 30 days.
GitHub →Research · IEEE Paper
Simulated flat vs. VLAN-segmented architectures for 40 IoT devices using GNS3 and Python. Demonstrated 67% reduction in lateral movement success, 5x increase in time-to-compromise, and 180% improvement in detection rates via Zero Trust isolation.
GitHub →Research · Applied Cryptography
C2PA-compliant media provenance system: ECDSA P-256 signing, SHA-256 content fingerprinting, perceptual hashing, and RFC 3161 trusted timestamping. Addresses deepfakes at capture-time, directly motivated by disinformation work at the NYS CCO.
NYU Applied CryptographyMalware Analysis
Deep forensic analysis of WannaCry ransomware: encryption mechanism, lateral movement via EternalBlue/DoublePulsar, and kill-switch discovery. Controlled lab environment using Wireshark, x32dbg, VirusTotal, and MalwareDB.
View on GitHub →IoT Security · RIT Capstone
Authentication protocol for resource-constrained IoT devices: comparative analysis of existing methods, implementation in simulated environments, dynamic key management to reduce computational overhead while enhancing security.
View on GitHub →Cybersecurity Initiative
Security design for a virtual education company: NIST air gap policies, VM hardening, VLAN/subnet enforcement, and CIS compliance framework. Comprehensive final report and presentation delivered to client.
View on GitHub →Metadata & OSINT
Full analysis of TaleSocial: HTML/CSS/JS parsing, WHOIS lookups, metadata exposure risk evaluation, and vulnerability identification. Actionable mitigation plans delivered in a structured client-facing report.
Internal / AcademicBusiness Continuity
Full IT disaster recovery framework covering LAN, WAN, and remote connectivity: RTO/RPO objectives, failover procedures, key stakeholder identification, and department-specific recovery plans.
View on GitHub →Policy & GRC
Policy briefs on Facial Recognition Technology and the Data Economy, applying a public policy lens to technical cybersecurity issues with regulatory and strategic analysis. Evidence-based recommendations.
View on GitHub →Risk Management
Comprehensive risk assessment for a teaching hospital: FIPS 199 categorization, MITRE ATT&CK and STRIDE threat modeling, and quantitative/qualitative risk mitigations for critical patient data systems.
View PDF →Full Stack Development
Full-stack interactive portfolio with Google Analytics integration, modal pop-ups, hover effects, and Git version control. HTML5, CSS, PHP, JavaScript, Bootstrap.
Live Site →Get in Touch
Whether you want to discuss an open role, talk threat intelligence, collaborate on research, or just connect with someone who thinks constantly about cybersecurity risk, so reach out. Queens, NYC. Open to remote and hybrid.
// MS Cybersecurity student (May 2027). Open to summer 2026 internships, full-time security engineering and GRC roles post-graduation, and consulting engagements. NYC-based, open to remote.
Download Resume →