I build automated security control planes that combine deep binary analysis
with systems engineering discipline. From event-driven supply chain factories to universal Flutter
cryptography interceptors. I engineer the defensive infrastructure that sets enterprise-wide
standards.
The Runtime Factory: Automated Container Security Engine
The Problem: Scheduled cron-rebuild models
leave windows of exposure between scans. Public base images carry stale vulnerabilities
and lack provenance, creating an insecure foundation for production APIs.
The Architecture: Engineered an event-driven pipeline using apko and
Wolfi base packages that automatically triggers multi-architecture rebuilds the moment a
fixable CVE drops. Each build is independently compiled, scanned (Trivy), signed
(Cosign), and attested with SLSA Level 3 provenance — all without human
intervention.
Impact: Zero critical CVEs in production. Base images reduced from
135MB to 45MB (66% reduction). Idle memory overhead dropped from 4–6MB to under 1MB.
Containers execute natively as uid/gid 1000 — no root.
WolfiapkoCosignTrivySLSA L3GitHub Actions
graph TD
A[CVE Monitor] -->|Trigger| B[apko Build Matrix]
B --> C{Parallel Scan}
C -- AMD64 --> D[Trivy x86]
C -- ARM64 --> E[Trivy arm]
D & E -- Pass --> F[Cosign Sign]
F --> G[SLSA L3 Attest]
G --> H[Verified Gold Image]
H --> I[Event-Driven Deploy]
style H fill:#312e81,stroke:#818cf8
style A fill:#7f1d1d,stroke:#fff
02
ZERO-TOUCH AUTOMATION
Zero-Touch Identity & Access Automation
The Challenge: Manual onboarding created "ghost
accounts" and delayed access revocation by up to 48 hours, risking compliance failures
and unauthorized access.
The Architecture: Engineered a fully automated lifecycle using Jira
Service Management, Okta Workflows, and JumpCloud. Access is granted based on Role
(RBAC) and revoked instantly upon contract termination via webhook-driven
orchestration.
Impact: Eliminated ghost accounts and reduced offboarding time from 48
hours to under 5 minutes.
Morag: Automated Binary Analysis for AOT-Compiled Flutter
The Problem: AOT-compiled and obfuscated
Flutter applications hide cryptographic operations behind native binaries, evading
standard Java-level interception tools and runtime instrumentation.
The Architecture: Built a Dual-Layer Discovery engine that combines
high-level JVM interception (javax.crypto, flutter_secure_storage) with native memory
pattern scanning. Integrated static AOT parsing via Blutter to mine data from object
pools, automating extraction of hardcoded keys, initialization vectors (IVs), and
platform MethodChannels.
Impact: Fully automated extraction of cryptographic material from
obfuscated Flutter binaries without manual reverse engineering.
graph TD
A[Flutter APK] --> B{Static Analysis}
B -- AOT Binary --> C[Blutter Parser]
B -- Dart VM --> D[JVM Hook]
C --> E[Object Pool Mining]
D --> F[flutter_secure_storage]
E & F --> G[Key/IV Extraction]
G --> H[MethodChannel Map]
style C fill:#312e81,stroke:#818cf8
style G fill:#7f1d1d,stroke:#fff
The Challenge: Modern Android apps use native
SSL implementations (BoringSSL) and the Flutter engine's built-in certificate validation,
requiring rooted devices or complex setups for traffic inspection.
The Solution: Created a rootless automation framework that performs
byte-level patch orchestration via reFlutter to permanently modify compiled native
binaries (libflutter.so), neutralizing BoringSSL validation structures. Standardized
output parsing generates SARIF auditing data mapped to OWASP MASVS risk
baselines.
Impact: Rootless SSL pinning bypass integrated directly into CI/CD
security validation workflows with standardized compliance reporting.
reFlutterBoringSSLSARIFOWASP MASVSFridaPython
graph TD
A[Target APK] --> B{Binary Analysis}
B --> C[reFlutter Patch]
C --> D[Neutralize BoringSSL]
D --> E[Rootless Hook]
E --> F[Traffic Intercept]
F --> G[SARIF Generator]
G --> H[OWASP MASVS Map]
H --> I[CI/CD Report]
style C fill:#312e81,stroke:#818cf8
style H fill:#7f1d1d,stroke:#fff
05
ADVERSARIAL RESEARCH
NetShield: Automated Mobile SSL Bypass Suite
The Challenge: Modern mobile apps use native
SSL implementations (BoringSSL) and Flutter's built-in certificate validation that
evade standard interception tools and proxies.
The Solution: Built an orchestration engine that combines static
pattern matching with Frida-based runtime instrumentation to bypass pinning in Flutter,
OkHttp, and custom TrustManagers. Supports both Java-level and native hook
strategies.
Impact: Automated SSL pinning bypass across diverse Android
architectures enabling comprehensive security testing without manual reverse
engineering.
FridaBoringSSLPythonReverse Engineering
graph TD
A[Target APK] --> B{Static Detection}
B -- Flutter --> C[Native Hook libflutter]
B -- Java --> D[Hook TrustManager]
C & D --> E[Runtime Bypass via Frida]
E --> F[Intercept Encrypted Traffic]
style E fill:#312e81,stroke:#818cf8
The Challenge: Standard SCA tools flag every
library vulnerability regardless of reachability, flooding teams with false positives and
creating alert fatigue.
The Architecture: Built a static analysis engine that parses abstract
call-graphs from application bytecode and cross-references them with SCA vulnerability
databases. Only reachable code paths are flagged, eliminating noise from dormant library
code.
Impact: Mapped 158K+ call-graph nodes in under 30 seconds. Validated
against WebGoat: 36 of 39 flagged CVEs were reachable — proving 3 were false positives
that standard tooling would have required manual triage to identify.
JavaSootWebGoatCall Graph AnalysisPython
graph TD
A[App Bytecode] --> B[Call Graph Builder]
C[SCA Vuln DB] --> D{Reachability Engine}
B --> D
D -- Reachable --> E[Flagged]
D -- Unreachable --> F[Suppressed]
E --> G[Prioritized Report]
F --> H[Noise Eliminated]
style D fill:#312e81,stroke:#818cf8
style F fill:#065f46,stroke:#6ee7b7
Technical Capabilities
Technical Arsenal
Offensive Security
Web/API: Burp Suite Pro, OWASP ZAP
Mobile: Frida, Objection, Jadx-GUI, APKTool
Network Recon: Nmap, Wireshark
Exploit Development: Python & Bash
Cloud & Container Hardening
AWS Security Hub & GuardDuty
Wolfi (Undistro) & apko Hardening
Kubernetes NetworkPolicies & RBAC
Terraform (IaC) & Linux Hardening
AppSec & Supply Chain
SLSA L3 Provenance & Sigstore/Cosign
Snyk, Checkmarx, SonarQube
SARIF & OWASP MASVS Mapping
GitHub Advanced Security
Mobile Binary Analysis
Blutter AOT Object Pool Mining
reFlutter Byte-Level Patching
BoringSSL / Native Hook Engineering
Call Graph & Reachability Analysis
Governance & Identity
ISO 27001 & PCI DSS Compliance
Zero Trust (Okta/JumpCloud)
RBAC Design & Policy Enforcement
Incident Response & Forensics
Career Timeline
Professional Experience
Senior Application Security Engineer
Moniepoint Group
Jan 2026 — Present
Threat Modeling: Led STRIDE-based threat models for payment processing
pipelines, driving risk-based decisions that reduced the production attack surface across
multi-tenant financial trust boundaries.
Vulnerability Discovery: Identified and drove remediation for a wide
range of application-layer flaws across banking platforms including SSRF, IDOR, broken
access control, HTTP desync attacks, BFLA, and mass assignment vulnerabilities through
systematic grey-box assessments.
Product Security Advisory: Performed security architecture reviews and
risk evaluations for mobile attestation tooling, assessing detection coverage for SSL
pinning bypass, rooted devices, and emulator environments to validate security
requirements ahead of production deployment.
Security Training: Led Knowledge Sharing Sessions (KSS) for the
engineering teams on common vulnerability classes and remediation patterns,
equipping developers to prevent security defects earlier in the development lifecycle.
Enterprise Standards: Architected and enforced immutable Kubernetes
NetworkPolicies isolating internal banking microservices to authorized endpoints via explicit
label matching, setting a company-wide configuration standard.
Cybersecurity Engineer
FCMB Group
Oct 2024 — Dec 2025
DevSecOps Orchestration: Architected the end-to-end security lifecycle
integrating automated gates for SAST, SCA, DAST, IaC scanning, and SBOM verification across
production banking environments.
Database Hardening: Coordinated end-to-end transport and static encryption
policies with corporate DBAs, aligning database access limits with PCI DSS and ISO 27001
audit standards.
Vulnerability Discovery: Uncovered critical business-logic flaws including
double-spend race conditions and IDOR-based account takeovers during grey-box assessments of
flagship banking platforms.
Application Security Engineer
First Bank Plc
Sep 2023 — Sep 2024
AppSec Pipeline Integration: Automated native application security checks
within enterprise CI/CD, reducing production deployment risk indicators by 40% through
automated SAST/DAST gates.
WAF Layer Protection: Deployed Web Application Firewall protections to
intercept edge manipulation traffic targeting backend endpoints and relational databases.
Security Assessments: Conducted technical target assessments and application
layer penetration tests on web, API, and mobile architectures serving 2M+ users.
Toolchain Integration: Managed deployment and configuration for Symantec
Remote Browser Isolation, NoName API Security, and Prisma Cloud across the enterprise.
Cybersecurity Instructor & Mentor
10alytics
Jan 2022 — Apr 2024
Curriculum Design: Built a repeatable education framework featuring the
VulnBank Kubernetes lab environment, training 300+ security practitioners on real-world
defensive engineering concepts.
Technical Workshops: Orchestrated deep-dive sessions on perimeter
penetration testing, vulnerability lifecycle management, and SIEM monitoring (Wazuh, Elastic,
Graylog).
Career Pipeline: Guided students from fundamentals to job-ready skill
verification, achieving measurable placement outcomes through structured lab-based assessment.
Open Source
Projects & Research
Runtime Factory
Event-driven container security engine using apko/Wolfi with SLSA Level 3 provenance. Rebuilds,
scans, and signs images automatically when fixable CVEs drop. 66% size reduction, rootless
execution.
Universal Flutter cryptography interceptor combining JVM interception with Blutter AOT object
pool mining. Automates extraction of hardcoded keys, IVs, and MethodChannels from obfuscated
Flutter binaries.
Call-graph driven SCA engine that eliminates false positives by analyzing reachable vs.
unreachable code paths. Benchmarked at 158K+ nodes in under 30 seconds on WebGoat.
Delivered "Threat Modeling for Complex Ecosystems," detailing defense-in-depth strategies for
multi-tenant financial trust boundaries, legacy core banking integrations, and defensive mapping
using STRIDE/DREAD frameworks.
CPE ProviderKeynote
Private Offensive Security Series
Instructor for a 2-part offensive security training series using the Banking Infrastructure Lab
to train professionals on multi-stage attack vectors, zero-trust validation, and defensive
engineering patterns.
SME TrainingPrivate
Technical Workshops
Hosted live interactive training sessions on attack vector exploitation and defensive security
automation for professional audiences of 120+ attendees across multiple organizations.
120+ AttendeesHands-On
Let's build something secure.
Interested in collaborating on security architecture, adversarial research, or DevSecOps strategy?
Let's connect.
