Hassan El Hajj

Cybersecurity & Infrastructure Engineer · AI Security Research

Beirut, Lebanon · LinkedIn · ORCID · GitHub · Email

About

I am a cybersecurity and infrastructure engineer with eighteen years of production experience across network security, security monitoring, telemetry, automation, and resilient infrastructure. I currently lead IT infrastructure and security for a 24/7 broadcast operation, and I am developing research in AI and cybersecurity.

My research interest is practical: AI-assisted defence has to keep working when the environment changes, when evidence is incomplete or manipulated, and when actions have consequences. I study those failure modes and build systems that make verification part of the workflow rather than an afterthought.

In 2015 I founded NextCare (formerly the Rabab Cancer Foundation), a registered cancer-support non-profit, and I continue to lead its strategy, governance, and technology direction.

Research interests

ML-based cyber detection and evaluation — concept drift, post-deployment degradation, label-efficient adaptation, temporal evaluation, and the validity of intrusion-detection benchmarks.
AI agents for cyber defence — telemetry and evidence integrity, tool and capability boundaries, action verification, bounded autonomy, provenance, and auditability.
Adversarial ML and security of AI-enabled defence — manipulation of model inputs or evidence, robustness of AI-assisted security systems, and failure modes of automated defence.
Deception and active defence — honeypots, adaptive deception, moving-target defence, and AI-driven approaches to increasing attacker cost and uncertainty.

Research activity is currently at a pre-publication stage: systematic literature reviews and research-oriented systems developed in 2026. A general overview is available in the research overview; unpublished artifacts and operational data are kept private.

Selected systems

BASIRA — multi-agent orchestration platform with an observe/decide/act loop, mission planning, graph-based memory, provider failover, and cost-aware routing.
Research radar — LLM-assisted literature screening, metadata extraction, and novelty checks with Zotero integration and verification trails.
AI-NOC — Python/OpenCV monitoring of live television output; sustained-black gating reduced internal alert false positives by roughly 90%.
Honeypot sensors — internet-facing Cowrie deployment with MITRE ATT&CK mapping for SIEM enrichment.
Network telemetry collector — persistent MikroTik/NetFlow collection and parsing for flow-level visibility.
Arabic broadcast ASR evaluation — faster-whisper large-v3 benchmark on live Arabic and mixed-language speech.
Healthcare RAG assistant — bilingual Arabic/English assistant with human verification and control layers.

Experience

IT Infrastructure & Cybersecurity Lead — AIBU Broadcast Media

Beirut, Lebanon · 2014–present

Lead IT infrastructure and security for a 24/7 broadcast operation serving 600+ users, with a five-person team, a >$500K infrastructure budget, and 99.95% on-air availability. Implemented segmented network security and zero-trust design across broadcast, production, management, and guest domains; aligned controls with ISO 27001; built security monitoring with Wazuh, CrowdSec, and Cowrie; own VMware/vCenter, SAN/NAS, and FortiGate HA infrastructure.

Founder & President — NextCare (formerly Rabab Cancer Foundation)

Lebanon · 2015–present

Founded and lead a registered cancer-support non-profit with 300+ volunteers and 50+ partner organisations. Responsible for strategy, governance, partnerships, and technology direction, including a bilingual healthcare RAG assistant with human verification and control layers, and a React/TypeScript + Supabase/PostgreSQL platform with row-level security.

Technical Advisory Board Member — European Profiles

World Bank-funded e-learning project · 2019–2020

Provided technical input on infrastructure and security.

IT Help Desk Coordinator — LCG / LGGTV Broadcast Network

2008–2014

Windows domain support at approximately 500-user scale, patch management, virtualisation, and standardised operating-environment documentation.

Skills

Security & infrastructure — network segmentation and zero-trust design · Wazuh SIEM · CrowdSec · Cowrie honeypots · incident response · ISO 27001 · FortiGate HA · VMware/vCenter · SAN/NAS · Linux · Docker

Engineering & automation — Python (OpenCV, threading, asyncio, Streamlit) · SQLite and PostgreSQL · NetFlow collection and parsing · LLM orchestration and RAG pipelines (LangChain, ChromaDB) · faster-whisper · PowerShell · n8n · Git

Research methods — experimental design and statistics · drift detection and conformal methods · agentic AI for cyber defence · AI control and bounded autonomy · evaluation methodology for security ML

Languages — Arabic (native) · English (C1) · French (B1) · German (A1, in progress)

Education

Professional Master (120 ECTS), Engineering of Social and Cooperative Economy Projects — Lebanese University, Institute of Social Sciences (2017–2019)
B.Sc. Computer Engineering — Lebanese International University (2003–2008)