Cybersecurity practitioner in Nairobi focused on application security, authorized security testing and access-control engineering.
I work in systems I own or have explicit permission to assess. My projects combine attack simulation with remediation: map the trust boundary, test the control, preserve the evidence, fix the weakness and rerun the test.
A least-privilege control plane for sensitive human and agent operations. It enforces distinct-requester approval, context-bound mandates and a verifiable audit chain. The test suite covers authorization, cryptography, ledger integrity and anomaly handling.
A simulation for testing abuse paths around irreversible device operations. Seventy-five tests cover authorization, negative paths, detection, workflow safety and sanitization decisions. Attack scenarios include brute force, replay, privilege escalation, unknown devices and unapproved execution.
An experimental Android Enterprise console with explainable fleet posture, policy management and a simulator for high-impact commands. The live Google API path is implemented but remains clearly separated from the public simulation.
A local-first Modern Workplace operations lab used to practise identity, Conditional Access, endpoint-compliance and audit-driven troubleshooting. It does not connect to a production tenant.
Open the lab · Product recording
A bilingual, mobile-first health-awareness and care-navigation prototype. It is not a diagnostic tool and keeps entered information on the device.
I am pursuing junior penetration-testing, application-security, security-engineering and detection roles. Current lab work covers web application testing, Linux and network reconnaissance, access-control abuse, attack simulation and clear remediation reporting.