Nairobi, Kenya · Open to remote and on-site SOC Analyst (L2) and Detection Engineer roles · Portfolio · Email · LinkedIn
I am a BTL1- and SAL1-certified SOC analyst with 10 years in IT.
I ran hotel IT at Kendas Hotels from 2016 to 2020. In 2021 I founded Mexil Tech Consultancy Limited, an IT support firm I still run. Since 2024 I have retrained in security operations, with about two years of hands-on SOC lab work. I investigate alerts, build and validate detections, and automate response. I write up every lab with step-by-step evidence.
| Project | Result |
|---|---|
| SOC Automation and Detection Engineering Homelab | Validated high-risk and low-risk alert paths end to end: a Splunk correlation search triggers n8n, which opens a DFIR-IRIS case, enriches with VirusTotal, and on high risk runs Velociraptor collection and Wazuh host isolation. |
| Network Forensics and Snort Detection Engineering | Traced keylogger exfiltration in packet captures and wrote three Snort rules, validated against Nmap -sS and ICMP traffic. |
| VulnBank Web, API, and Mobile Security Assessment | Documented fifteen security issues across web, API, and Android surfaces with ordered proof. |
| Credential | Issuer | Date | Verify |
|---|---|---|---|
| Blue Team Level 1 (BTL1) | Security Blue Team | Jul 2026 | Credly |
| Security Analyst Level 1 (SAL1) | TryHackMe | Aug 2025 | Credly |
| AfricaHackOn Cyber Security Swara | AfricaHackon Academy | Jun 2026 | Credly |
| AfricaHackon Cybersecurity Summit 2026 (attendee) | AfricaHackon Academy | Sep 2026 | Credly |
Education: BSc Information Technology, Jomo Kenyatta University of Agriculture and Technology (JKUAT).
- SIEM, detection and SOC operations: Splunk, Wazuh, Elastic, Security Onion, Suricata, Snort, Sysmon, MITRE ATT&CK
- SOAR and DFIR: n8n, DFIR-IRIS, Velociraptor, VirusTotal, Autopsy, Volatility
- Network: Wireshark, PCAP analysis, Nmap, pfSense, Zeek
- Application security: Burp Suite, OWASP ZAP, Postman, JADX, ADB, MobSF
- Offensive validation (authorized labs): Metasploit, Aircrack-ng, Hashcat, Bettercap, Subfinder, httpx
- Scripting: Python, Bash, PowerShell
- OWASP crAPI Web and API Security Assessment
- Android Application Security Assessment: Beetlebug
- Wireless Security Assessment Lab Series
- Web and API Vulnerability Validation Lab
- External Attack Surface Reconnaissance
- Python Reconnaissance Automation
- Controlled Windows Exploitation and Reverse Shell Lab
- Portable Bash Automation for Secure Data Transformation
- Flask and MySQL Student Records API