Operationally credible. Strategically fluent.

Where I've delivered.

Since 2018, three organisations, one throughline: security that holds up under audit and under attack.

1. Cyber Security Content Engineer & Researcher

   Jan 2022 – Mar 2026

   TryHackMe, Ltd · Remote (London, UK)

   Training and certification content only: rooms, modules, and exams for a platform of 7M+ users, from beginner to advanced level.

   Certification contributions

   • SAL1 (Security Analyst Level 1): Led the design of this defensive security certification, authoring 150+ scenario-based questions and simulations.
   • SAL2 (Security Analyst Level 2): Contributed to the advanced blue team certification.
   • SEC0 and SEC1: Contributed to the beginner-level certifications, completing work across the full ladder from entry level to advanced.

   Rooms & content

   • Authored rooms across SOC operations, SIEM, detection engineering, DFIR, and cryptography at beginner, intermediate, and advanced levels, including Sigma rule content mapped to MITRE ATT&CK.
   • Created framework content on NIST CSF, ISO 27001/27002, MITRE ATT&CK, and the Cyber Kill Chain; contributed to 4 consecutive editions of Advent of Cyber.
   • Built 4 new modules in one year with content drop-off below 6%, working in Agile cycles with product, engineering, and curriculum teams.
   • Tracked the threat landscape to keep content current, translating adversary behaviour into hands-on labs.

2. Cyber Security Engineer

   Jun 2019 – May 2022

   Tabiri Analytics, Inc. · Nairobi, Kenya

   • Primary security adviser across 10 client organisations for ISO 27001, NIST 800-53, and CIS Controls audits; coordinated internal and external compliance audits.
   • Led the end-to-end response to a live ransomware incident: containment, root cause analysis, remediation across 20+ endpoints, and the post-incident report to client executives.
   • Built and operated Elastic Stack SIEM for client environments of 5 to 80 endpoints, from log ingestion to correlation rules and Kibana dashboards, with mean detection time within 3 days.
   • Maintained risk registers with owners, treatment plans, and quarterly reviews reported to executive and board level; ran vendor and third-party risk assessments and authored ISMS policies and standards.

3. Web Application Security Engineer

   May 2018 – Dec 2018

   TeleTracking Technologies, Inc. · Kigali, Rwanda

   Securing a platform used live in clinical environments: patient flow, bed management, capacity operations.

   • Ran OWASP Top 10 assessments of production web applications with IBM AppScan.
   • Defined security specifications and countermeasures for a telemedicine platform; developed 10 security policies covering detection, prevention, and incident handling.

Skills & frameworks.