Asyraf Arshad

• Build and operate enterprise security infrastructure for a fast-scaling tech company.
• Work across identity and access management, zero trust, endpoint protection, cloud governance, and AI risk.
• Evaluate new technology, including AI tools, against security and regulatory frameworks such as MAS TRM.

• System operations and incident management.

• Application development with JavaScript and Oracle SQL.

• Planning, analysis, and logistics management.

• Data extraction and business analysis for operations.

Security Feeds Pipeline

A self-updating threat-intelligence page: around twenty sources (CISA KEV, NVD, GitHub Advisories, abuse.ch, malware news, AI-security research) normalised into one view and scored by a deterministic KEV/CVSS/EPSS risk engine. No servers, no database.

Vendor Breach Watch

A supplier watchlist checked twice a day against public breach and incident sources. A match opens one deduplicated GitHub issue with source links and a remediation checklist, so 'is any vendor of ours in the news?' gets answered automatically.

Password Exposure Checker

Check whether a password has appeared in known breaches without the password, or even its full hash, ever leaving the browser. Built to be shown, not just used: the page explains exactly what is sent and why that is safe.

MCP Threat-Model Template

A fill-in-the-blanks STRIDE threat model for MCP servers: an interactive 18-question checklist plus a downloadable worksheet, so threat-modelling every new agent integration takes an afternoon instead of starting from a blank page.

Sakinah

Islamic funeral guidance for families in Singapore: the next correct step, offline, and a direct line to an ustaz, a mandi jenazah team, or a provider in one tap. A case study in designing for the user's worst moment, and in reducing risk by deciding what not to build.