About Me
I am an Application Security and Offensive Security practitioner focused on uncovering real-world abuse paths across web applications, APIs, mobile platforms, and enterprise systems.
My work combines manual business-logic testing, authentication analysis, red teaming techniques, and DevSecOps integration to identify risks that automated scanning alone cannot detect.
I have grown from security operations into full-time application security and offensive testing, taking ownership of complex assessments and secure SDLC initiatives while collaborating closely with engineering teams to build systems that are resilient by design.
Below, you can explore my professional experience, educational background, and certifications in more detail.
Experience
Jan 2026 - Present
Assistant Manager, Application Security
I&M Bank Group
Driving application security initiatives across enterprise and digital platforms, with focus on secure architecture reviews, offensive security assessments, DevSecOps integration, and strengthening secure SDLC practices. Supporting security strategy, mentoring junior team members, and driving collaboration between security, engineering, and infrastructure teams to improve overall security posture across the group.
Jan 2024 — Dec 2025
Senior Application Security Engineer
I&M Bank Group
Conduct internal and external penetration testing engagements across web, APIs, mobile, and infrastructure environments. Drive DevSecOps initiatives including secure SDLC integration, CI/CD security reviews, and threat modelling. Represent cybersecurity in IT change enablement reviews and contribute to enterprise-level risk decisions while coordinating cross-team security efforts.
Jan 2023 — Dec 2024
Application Security Associate
I&M Bank Group
Conducted structured VAPT assessments across applications and infrastructure. Performed business logic testing, authentication and authorization analysis, and API security reviews. Delivered actionable remediation guidance to engineering teams and supported ISO 27001 compliance evidence preparation.
Feb 2022 — Dec 2022
Cybersecurity Analyst
I&M Bank Group
Started in security operations center (SOC) supporting 24/7 monitoring, incident triage, and vulnerability management, while gradually contributing to application security assessments. This period built foundational visibility into detection engineering, attack patterns, and enterprise security controls.
Mar 2024 — Present (Part-Time)
Security Consultant — Application Security
Bitwise Digital Solutions
Deliver security assessments for SaaS platforms including web application testing, API reviews, and DevSecOps advisory. Support in integrating practical security validation into fast-moving engineering environments.
Education
Sep 2017 — Dec 2021
Bsc. Software Engineering
Multimedia University of Kenya
First Class Honors
Jan 2013 — Dec 2016
Kenya Certificate of Secondary Education - KCSE
Machakos High School
Grade: A- (Minus)
Certifications
April 2023
Certified Ethical Hacker (CEH)
EC-Council
Certification Number: ECC8419605273
Let’s Connect
You can find me on LinkedIn and GitHub, or reach me via email.