Security Operations EngineerAvailable

Kevin
Gitau.

Security operations engineer with six years across enterprise cloud, fintech, and telecommunications infrastructure. Threat detection, SIEM deployment, penetration testing, and container security, backed by deep production systems experience.

Nairobi, Kenya · EAT (UTC+3) · Remote-ready
Kevin Gitau
6+
Years experience
30+
Certifications
3,000+
Endpoints managed
Remote
Ready
6+
Years
30+
Certifications
3,000+
Endpoints
99%
SLA
01 · About

“Six years in production taught me exactly how systems fail. Security is learning to close those gaps before someone else finds them.”

Six years across enterprise cloud, fintech, and telecommunications infrastructure gave me a ground-level view of how systems behave under pressure. That foundation drives the security work: SIEM deployment and alert tuning, web application and API assessments, Active Directory attack paths and detection, container vulnerability scanning. Security grounded in production systems knowledge.

Alongside the security track, I build and ship products independently: SaaS tools, automation workflows, mobile apps. From idea to deployed, without needing a team to form first.

Operations

Cloud and infrastructure operations across fintech, telecommunications, and SaaS platforms. Incident ownership, root-cause analysis, distributed system debugging, and monitoring automation. Six years of production context behind every security decision.

Security

SIEM deployments, web app and API assessments, AD attack and defence, container scanning. Certifications from Google, IBM, Cisco, APIsec. The labs run continuously.

Building

SaaS, automation platforms, and developer tooling. I ship products end-to-end without needing a team to form around me.

Technologies
AzureEntra IDWazuhBurp SuiteOWASP ZAPPythonKubernetesDockerLinuxGrafanaZeekpfSenseBloodHoundn8nSupabase
02 · Experience
2024
Technical Support Engineer
4R Digital Limited
UK · Remote · Cloud platform
Dec 2024 – Mar 2026

Production support for cloud-hosted platforms integrating software services and connected IoT hardware endpoints. Responsible for cloud infrastructure monitoring, bug investigation/triage, operational automation, and platform reliability.

  • Cut operational overhead by 40% through targeted automation
  • Administered Azure and Entra ID across the platform estate
  • Ran OWASP ZAP assessments against platform APIs
AzureEntra IDGrafanaPrometheusOWASP ZAPPostman
2023
Application Support Analyst
Ateo Finance
US · Remote · Regulated fintech / trading
Dec 2023 – May 2025

Production support for US fintech trading platforms. Led incident investigation, SQL-based root cause analysis, and QA testing across staging and production.

  • Reduced incident recurrence by 25% through structured post-mortems
  • Cut engineering escalation response time by 20%
SQLMS SQL ServerJiraLog AnalysisQA Testing
2022
Technical Support Engineer
KOKO Networks
Nairobi, Kenya · Climate tech / IoT
Apr 2022 – Aug 2024

Monitored a distributed IoT platform across 3,000+ field endpoints. Built automation that cut MTTR from 11 minutes to 3. Sustained 98% platform uptime across two years.

  • MTTR: 11 min → 3 min via Python automation
  • 98% uptime across 3,000+ IoT endpoints
  • 50% faster troubleshooting through improved diagnostic tooling
PythonGrafanaAWS CloudWatchSQLPostman
2020
NOC Engineer
Adrian Kenya Limited
Nairobi, Kenya · Enterprise ISP
Sep 2020 – Mar 2022

24/7 monitoring of enterprise network infrastructure: OLTs, core nodes, backhaul. 99% SLA adherence through structured escalation and field coordination.

  • 99% SLA adherence across enterprise accounts
  • 24/7 continuous coverage across the OLT estate
BMC RemedyOLTNetwork MonitoringSLA Management
2017
IT Support Engineer
Decko Africa
Nairobi, Kenya
Oct 2017 – Jul 2020

End-to-end IT support across hardware, software, network, and virtualised infrastructure. Windows Server administration: Active Directory, Group Policy, Hyper-V.

Windows ServerActive DirectoryGPOVirtualisationHyper-V
03 · Projects
A · Security Labs
01Live lab
Home SOC Lab
Wazuh · SIEM · Grafana · Detection Engineering

Wazuh deployed across Linux and Windows hosts with multi-source log ingestion, custom detection rules, and Grafana dashboards. Full analyst workflow from signal through investigation.

02Live lab
Web App & API Pentesting
Burp Suite · OWASP ZAP · API Security · OWASP Top 10

Ongoing OWASP Top 10 testing and API security labs: BOLA, rate limiting bypass, excessive data exposure, auth bypass. All findings documented in structured security reports.

03Live lab
Home Network Security Lab
pfSense · VLANs · Zeek · Wireshark

pfSense firewall with strict inter-VLAN routing, Zeek for passive traffic analysis, Wireshark to verify isolation. Mirrors real enterprise network segmentation architecture.

04Live lab
Active Directory Attack & Defense
Active Directory · BloodHound · Kerberoasting · Sysmon

Virtualised Windows Server AD environment. Practiced Kerberoasting, Pass-the-Hash, BloodHound enumeration, then hardened the same environment with Sysmon and event log analysis.

B · Products
01Shipped
AI Appointment Reminder
Claude API · n8n · Supabase

Deployed SaaS product. Natural-language scheduling via Claude, n8n for automation, Supabase backend. Calendar integrations and automated follow-up flows.

02Beta
GanjiFlow
React · TypeScript · M-Pesa API

Privacy-first M-Pesa statement analyser. All parsing and computation runs locally in the browser; no financial data leaves the device. Built for the Kenyan mobile-money market.

03Beta
Famio
Firebase · Dart

Gamified family engagement app: shared challenges, progress tracking, milestone celebrations. From product strategy through working prototype.

04In dev
NamePrint
Web App · React

Platform for parents to explore baby names by cultural origin, meaning, and phonetics, with shortlisting and side-by-side comparison tools.

05Stealth
DebtHuru
React · Node.js · Mobile-first

Debt-freedom platform built for the East African market. Users map all their debts in one place, then the engine generates a personalised payoff plan using avalanche or snowball strategy, with local payment integrations, reminders, and a running tracker so progress feels real. 'Huru' means freedom in Swahili.

04 · Skills
Security Operations & AppSec
WazuhSIEMHTTP Security HeadersTrivyContainer ScanningDocker Image SecurityOWASP ZAPBurp SuiteBloodHoundZeekpfSenseAPI Security Validation
Cloud & Infrastructure
AzureEntra IDAWS CloudWatchGoogle CloudKubernetesDockerLinuxWindows ServerActive DirectoryVLANsTCP/IP
Operations & Monitoring
GrafanaPrometheusAzure App InsightsBash ScriptingAzure Logic AppsWorkflow AutomationReal-Time AlertingLog CorrelationSolarWindsWiresharkn8n
AI-Assisted Tooling & Engineering
Skywork AISuno AIHighfieldn8nIdeogramReplitBoltBase44TypeScriptReactNext.jsSupabasePostgreSQL
ITSM & Support Tooling
JiraServiceNowBMC RemedyMS SQL ServerSysmonPostmanVercelGit
Communication
Technical writingStakeholder managementIncident communicationCross-functional collaborationDocumentationTraining deliveryExecutive briefings
Analytical
Root cause analysisLog correlationRisk assessmentData-driven troubleshootingProcess gap identificationMetrics reportingPost-incident reviews
Product Thinking
User researchProblem framingRoadmap prioritisationMVP scopingFeedback loopsMarket researchProduct specsRapid prototyping
05 · Writeups

Lab documentation written to professional report standard: setup, methodology, findings, detections, and lessons learned.

01

Home SOC Lab

Wazuh SIEM · Multi-Host Log Ingestion · Custom Detection Rules · Grafana
2026GitHub

Replicates the core SOC analyst workflow: ingest logs from multiple hosts, write and tune detection rules, triage alerts, and investigate incidents end-to-end. Goes beyond 'install SIEM and see alerts': custom rules written from scratch, noise tuned out, Grafana dashboards built for analyst use, and a structured investigation workflow applied to every simulated incident.

Techniques Practiced
  • Multi-source log ingestion: Linux syslog, auditd, auth.log; Windows Event Logs; Sysmon EIDs 1, 3, 7, 10, 11
  • Custom Wazuh rules: SSH brute force (rate-based, 8 events/60s), PowerShell encoded command detection, new Linux user creation
  • Attack simulation: SSH brute force via Hydra, Mimikatz renamed binary, /etc/passwd modification, encoded PowerShell
  • False positive tuning: suppression rules for known admin sudo activity; threshold calibration
  • Investigation workflow: triage in Kibana, pivot to full event context, correlated events, MITRE mapping
MITRE ATT&CK
T1110.001: Brute ForceT1027: Obfuscated FilesT1003.001: LSASS MemoryT1053.005: Scheduled Task
Tools
WazuhElasticsearchKibanaGrafanaSysmonauditdHydraMimikatzVirtualBox
02

Web App & API Pentesting Lab

OWASP Top 10 · API Security Top 10 · Burp Suite · Structured Reporting
2026GitHub

Hands-on penetration testing against intentionally vulnerable targets with a focus on producing professional-grade findings reports, not just exploiting but documenting reproduction steps, impact, and remediation guidance. Lab targets span OWASP Top 10 web vulnerabilities and the OWASP API Security Top 10, with emphasis on the API-specific issues most common in fintech and SaaS environments.

Techniques Practiced
  • BOLA (API1): accessed other users' vehicle location data by modifying GUIDs; no server-side ownership check
  • OTP brute force (API2): no rate limiting on 4-digit OTP; account takeover via Burp Intruder in under 3 minutes
  • Rate limiting bypass (API4): X-Forwarded-For header rotation, null byte email mutation, distributed request threading
  • SQL injection: login bypass and full user table extraction via UNION SELECT; MD5 hashes cracked offline with hashcat
  • GraphQL introspection enabled: full schema leaked including undocumented admin mutations (deleteUser, resetPassword)
  • All findings documented to professional report standard: severity (CVSS v3.1), endpoint, reproduction steps, evidence, impact, remediation
MITRE ATT&CK
API1: BOLAAPI2: Broken AuthAPI4: Rate LimitingA03: InjectionA10: SSRF
Tools
Burp SuiteOWASP ZAPDVWAcrAPIJuice ShophashcatDockerPostman
03

Home Network Security Lab

pfSense · VLAN Segmentation · Zeek Traffic Analysis · Wireshark
2025GitHub

Mirrors the segmented network architecture found in enterprise environments: separate VLANs for different trust zones, strict inter-VLAN routing enforced by firewall rules, and passive traffic analysis to validate that isolation is actually working, not just assumed. Built to understand network segmentation decisions from the ground up after years of monitoring enterprise networks without designing them.

Techniques Practiced
  • 5-VLAN design: Management (high trust), Servers, User Workstations, IoT/Untrusted (internet-only, zero RFC1918 access), DMZ
  • pfSense firewall rule logic: top-down first-match evaluation; specific denies before broad allows; common misconfiguration identified and corrected
  • Zeek conn.log analysis: confirmed allowed traffic, verified IoT isolation (S0 state = SYN sent, no SYN-ACK), DNS leak detection
  • Found DNS traffic bypassing VLAN isolation via a NAT redirect rule left from a previous config; fixed by explicit block on port 53
  • Detected IoT device making unexpected MQTT (port 1883) connections to unrecognised domain; isolated with host-specific block rule
  • VLAN hopping test (802.1Q double-tagging via scapy): not viable in virtual environment; limitation documented
MITRE ATT&CK
T1040: Network SniffingT1018: Remote System Discovery
Tools
pfSenseZeekWiresharkscapyVirtualBoxUbuntu
04

Active Directory Attack & Defense

BloodHound · Kerberoasting · Pass-the-Hash · Sysmon Hardening · Wazuh Detection
2026GitHub

Two-phase approach: attack a virtualised Windows Server AD environment using real adversary techniques, then harden the same environment and validate that the attacks now produce detectable signals. The two-phase structure is deliberate: detection rules can only be written well if you know exactly what attack traffic and logs look like from the attacker side.

Techniques Practiced
  • BloodHound enumeration: shortest path from low-priv domain user to Domain Admin identified in 3 hops via machine account ACL
  • Kerberoasting via Impacket GetUserSPNs: TGS ticket for SPN service account extracted and cracked in under 2 minutes (rockyou.txt)
  • Pass-the-Hash via CrackMapExec and psexec.py: SYSTEM shell on workstation using NTLM hash without plaintext password
  • Custom Wazuh detection rule for Kerberoasting: Event ID 4769 with RC4 encryption type (0x17), a high-confidence indicator
  • Custom detection for Pass-the-Hash: Event ID 4624 Type 3 NTLM network logons from non-system accounts
  • Sysmon LSASS access detection (EID 10): tuned to exclude known-good callers (AV, Wazuh agent); Mimikatz still fires
  • BloodHound detection: Event ID 4662 volume rule, 50+ LDAP queries from single source in 60 seconds
  • Hardening: gMSA replacement (240-char auto-rotated password), Protected Users group, Credential Guard, GPO audit policies
MITRE ATT&CK
T1558.003: KerberoastingT1550.002: Pass-the-HashT1069.002: Domain GroupsT1003.001: LSASS Memory
Tools
Windows Server 2019Kali LinuxBloodHoundImpacketCrackMapExecSysmonWazuhhashcatVirtualBox
06 · Certifications & Education
View all 30+ on Credly
30+

Credentials across cybersecurity, cloud, networking, and AI, from foundational CCNA through Google Cybersecurity, IBM Pentesting, Cisco CEH, APIsec, and Kubernetes. All verifiable on Credly and LinkedIn.

Cybersecurity (7)
Cloud & Network Security
Cyber Shujaa
2026
Google Cybersecurity Specialization
Google / Coursera
2024
Certified Ethical Hacker (prep)
Cisco
2024
Cybersecurity Training Programme
Lateral Connect
2025
Threat Intelligence Analysis
ArcX
2025
Penetration Testing, IR & Forensics
IBM
2023
Operationalizing MITRE ATT&CK
AttackIQ Academy
2023
API & Application Security (2)
APIsec Certified Practitioner
APIsec University
2026
OWASP API Security Top 10
APIsec University
2026
Networking (2)
Network Security & Firewall Technologies
Cisco
2024
CCNA Switching & Routing
Cisco
2014
Cloud & Infrastructure (2)
AZ-104 Azure Administrator (prep)
Whizlabs
2025
Introduction to Kubernetes
Linux Foundation
2025
Education
Bachelor of Business Information Technology
Jomo Kenyatta University of Agriculture and Technology (JKUAT)
Second Class Upper Division
2012 – 2015
07 · Contact

Let's work
together.

Open to technical support, cybersecurity, and infrastructure roles, remote or hybrid. If you have something worth discussing, reach out directly.

Send me a message
Currently available
Actively seeking remote or hybrid roles in technical support, security operations, or infrastructure. Nairobi, Kenya · EAT (UTC+3).
Typically responds within 24 hours