Mustafa Yousry

Fifteen years, five companies, and one half of the work most builders leave until last.

The tools matter far less than where the boundaries between them fall — but people ask, so here they are, bottom-up. Security is the bottom layer because that is where I start.

1. L4

   Interface

   The part people actually touch. Fast, accessible, and built to survive a bad network.

   • Next.js
   • React
   • TypeScript
   • Server-first rendering
   • i18n & RTL
2. L3

   Application

   Where the business logic lives. Clear boundaries, honest data models, no clever tricks.

   • Django
   • Python
   • PostgreSQL
   • Celery
   • Redis
   • OpenAPI contracts
   • Event-driven workflows
3. L2

   Infrastructure

   What it all runs on. Reproducible environments, real pipelines, and a way back when something breaks.

   • AWS
   • Terraform
   • Docker
   • ECS Fargate
   • Linux
   • CI/CD pipelines
   • Observability
4. L1

   Security

   The layer most teams bolt on last. I start here — threat model first, features after.

   • Threat modelling
   • OAuth2 / OIDC
   • Encryption at rest
   • Least privilege
   • Audit trails
   • Secrets management

Eight years of it: four inside the Egyptian Center for Combating Terrorism, the rest consulting for companies that wanted the gap found before someone else found it. Here is what that adds up to in practice, rather than on a certificate.

• OFFENSE

  Penetration testing

  The only honest way to know whether something holds is to attack it. Scoped, authorised, and written up so your engineers can act on it on Monday.

  • Kali Linux
  • Web application testing
  • Network & infrastructure testing
  • Vulnerability assessment
  • Privilege escalation
  • Actionable reporting
• FORENSICS

  Digital forensics

  After an incident the questions are always the same: what happened, when, and what left the building. Answering them takes evidence, not guesses.

  • Disk & file system analysis
  • Memory analysis
  • Log & artifact timelines
  • Evidence handling
  • Malware triage
• INTEL

  Investigations

  This is where the counter-terrorism years actually went. Tracing an actor across what they left behind is a different discipline from securing a server, and it changes how you read every system afterwards.

  • OSINT
  • Incident investigation
  • Threat intelligence
  • Attribution
  • Case documentation
• DEFENSE

  Hardening & response

  Everything above is only useful if it changes the system. This is the part that does: closing what was found, then making sure the next one is noticed early.

  • Linux hardening
  • Network segmentation
  • Monitoring & detection
  • Incident response
  • Team training

People usually arrive with one of three problems.

• BUILD

  Build it

  You have something to build and no team to build it. I take it from an empty repository to a product running in front of real users, with the architecture decided on purpose rather than by accident.

  • Web and mobile products
  • APIs and data models
  • Cloud setup on AWS
• SECURE

  Secure it

  You have something already running and you are not certain it would survive someone trying. I go through it the way an attacker would, then harden what needs hardening.

  • Security review and hardening
  • Digital forensics
  • Incident response and training
• OWN

  Own it

  You have engineers but nobody holding the technical direction. I take that seat part-time: architecture, hiring, delivery — so you can stay on the business.

  • Architecture and tech decisions
  • Hiring and mentoring engineers
  • Delivery process and code quality

I cannot publish client work, so here is the next best thing: describe what you have built and watch the first pass run.

Where all of it happened, most recent first.

1. NowChief Technology OfficerEdura — UAE
2. NowChief Technology OfficerAggarly Inc.
3. 2022 →FounderCosmos TechnologiesSoftware studio — web, mobile and AI products
4. 2021 — 2025Cyber SecurityEgyptian Center for Combating TerrorismWhere I learned to read a system the way an attacker does
5. 2018 →Security Consulting & AdvisoryIndependentReviews, hardening and incident work, running alongside the building
6. 2018 →FounderJobatak Inc.
7. 2018 — 2021Software & Business DevelopmentIndependent — BerlinBerlin years — TU Berlin, and building for European clients
8. 2015 →FounderCosmos CommunitySocial enterprise
9. 2005 — 2018Administration & ManagementBusiness operationsRunning the operation itself — the years that taught me how a business actually holds together

The part you can verify.

I work through ideas in public, on YouTube.

If any of this maps to what you are building, write to me. I read every message myself.