Skip to main content

From Intern to Analyst: NCITE's Hafso Ibrahim Brings Cybersecurity Training to Nelnet

From spotting phishing emails to shaping threat intelligence, Hafso Ibrahim’s journey from UNO intern to Nelnet cyber threat intelligence analyst shows how education–industry partnerships create real-world impact.

While plowing through your inbox, you open a short, vague email from a “coworker” with a link asking you to renew an expired software subscription.

Savvy technology user that you are, you check the sending email address, see that it’s missing a letter in the domain name, and smugly report it as a phishing attempt. The email disappears and you pat yourself on the back for a job well done.

“Yeah, I would be the person that goes through that process and makes sure the links are not malicious,” said NCITE’s Hafso Ibrahim, who graduated from UNO in May with her bachelor’s degree in cybersecurity from the College of Information Science & Technology.

Soft-spoken but self-assured, Ibrahim can usually be found at her desk, headset in tow, keenly scanning her screen while briefing virtually with colleagues. With cybersecurity internships at the University and Nelnet and exposure to NCITE research, her senior year went far beyond evaluating suspicious emails – it prepared her to be Nelnet’s next cyber threat intelligence analyst.

Born in Somalia, Ibrahim grew up in Kenya, learning to speak Somali, Amharic, and Swahili before moving with her family to Omaha when she was 10. After taking a computer science course at Omaha’s Burke High School, Ibrahim was intrigued by a career in IT and started doing research.

“I didn't want to, like, be stuck doing the same thing over and over again,” she said. “I don’t feel like coding for the rest of my life.”

The dynamic nature of cybersecurity was appealing.

“You have to learn how attackers are using new tools that are coming out, how they're changing up their tactics,” Ibrahim said. “They get very creative at moving around security controls so they don't get caught.”

Learning the Cyber Threat Landscape

After choosing UNO and making the decision to graduate in three years, she was eager to develop skills useful for the workforce. In August, she began an internship with the Nebraska University System’s Information Technology Services Omaha-based Security Operations Center (SOC), working within a team of students and professionals to detect and mitigate incoming cyber threats to University infrastructure.

In October, through the SOC’s close relationship with NCITE, Ibrahim was selected to be a trial intern for a workforce development initiative between NCITE and Nelnet, the financial services and education technology company headquartered in Lincoln, NE.

“This partnership is unique because Hafso was completing her work in the NCITE offices to learn about our research and how it applies to threat mitigation in the cybersecurity domains,” said Matt Allen, Ph.D., NCITE director of operations and research services.

“It’s been a tremendously fruitful experience,” Timothy Batts, Nelnet cybersecurity manager and Ibrahim’s supervisor, said. “The partnership gives us research depth and external perspective we couldn't easily replicate in-house.”

After the United Healthcare CEO assassination in 2024, Nelnet accelerated a cyber protection initiative following a spike in threats to their own executives. Ibrahim was tasked with monitoring such threats flagged in conversations on the dark web and social media.

The team evaluated nearly a hundred social media posts of concern calling for targeted cyber and/or physical attacks on the organization amidst the ongoing Iran conflict and the Canvas LMS breach in late April.

“This isn't reactive anymore,” Batts said. “We treat geopolitical and industry-wide events as predictable triggers for threat activity, and our executive protection and CTI capabilities are built to scale with them.”

It’s been a tremendously fruitful experience. The partnership gives us research depth and external perspective we couldn't easily replicate in-house.

 Timothy Batts, Nelnet cybersecurity manager and Ibrahim's supervisor

Entering the Cyber Workforce

One of the most important cybersecurity methods Ibrahim learned – and where NCITE research provided distinct value – was threat hunting. Threat hunting is the practice of identifying the latest threat indicators (signatures of different attackers) and proactively searching security log annals for traces of them.

To help develop such indicators, Ibrahim would regularly sync with NCITE research teams to build actor profiles.

“You have to find out what techniques they use and what an attack by that threat actor group would look like in our environment,” she said.

As a student, Ibrahim executed hunts. In her new role as a CTI analyst, she’ll shift to the other end of this workflow, researching adversaries, identifying indicators, and turning her findings into actionable intelligence for response teams.

Allen believes the partnership serves as a model for university–industry collaborations. “Part of UNO’s metropolitan mission is to provide real-world experiences to students and in support of local industry,” he said. “I think this program is a great example of how we can serve that mission.”

Ibrahim is grateful for her time in the University SOC, which allowed her to build threat detection skills and reinforced the lesson that cyber criminals tend to be opportunistic rather than targeting a specific sector. “A lot of times, it would be the same thing being briefed at Nelnet as well as in the SOC,” she said.

Ibrahim is Batts’ first intern hire as a manager, and he’s thrilled to have someone so dependable on his team. “[Hafso] isn't just executing tasks – she's contributing to how we think about threat intelligence at Nelnet,” he said. “She takes ownership in a way that's rare at any career stage.”

Jenn Disney, manager of the University’s Omaha SOC office, agreed. “She has a good head on her shoulders and will go far.”