Okotie Omajuwa
I design secure CI/CD pipelines, harden cloud infrastructure on AWS and Azure, and build SIEM/SOAR detection and response capability with Microsoft Sentinel. Every project below is backed by a real, verifiable outcome, not a claim.
Profile
DevSecOps and Cloud Security engineer with over two years of hands-on experience designing secure CI/CD pipelines, hardening cloud infrastructure on AWS and Azure, and building detection and response capability. Recent work spans infrastructure as code security, pipeline security automation, application security and incident response, consistently backed by measurable outcomes.
This is underpinned by a background as a Full Stack Software Engineer (Python, Django, Node.js, MongoDB, distributed systems, cross-platform mobile development), which gives a practical, build-it-yourself understanding of the systems I secure rather than just how to scan them.
MSc in Computer Forensics and Cybersecurity, University of Greenwich, with an MSc Project (Dissertation) extending OWASP ZAP's vulnerability detection. Currently seeking DevSecOps, Cloud Security and Application Security Engineer roles, available immediately.
Skills
Cloud & DevSecOps
Detection & Response
Application Security & Testing
Governance & Frameworks
Backend & Data
Frontend & Mobile
Projects
Secure CI/CD Pipeline for a Vulnerable Banking Platform
A seven-stage GitHub Actions pipeline (Gitleaks, SonarQube, Trivy, Checkov, HashiCorp Vault, OPA Gatekeeper, Falco) securing a banking microservices codebase.
- Reduced Terraform infrastructure findings from 72 to 0 Checkov failures; every remaining exception formally documented.
- A live pull request was automatically blocked by the security gate (275 combined findings), proving the pipeline structurally prevents insecure merges.
- Monitored Falco, Gatekeeper and Vault with Prometheus and Grafana, including diagnosing and fixing a Grafana crash (SIGBUS, exit code 135) with a pinned, platform-compatible image.
Infrastructure Modernisation for a Simulated Fintech Client
Three-tier AWS architecture (Terraform, eu-west-1), addressing the root cause of a $214,000 security incident scenario caused by an over-permissive, manually opened database port.
- Security-group-reference-only database access and a validation block that structurally rejects any SSH rule broader than /32.
- Five-job pipeline with tfsec and Checkov scanning enforcing review-before-apply; caught a real formatting defect on its first run, before it reached production.
Automated Response with Microsoft Sentinel
Microsoft Sentinel SIEM/SOAR for a simulated logistics client, cutting credential-compromise detection-to-response time from 4+ hours to under 5 minutes end to end.
- Built and debugged a custom KQL detection rule for after-hours privilege escalation, diagnosing a case-sensitivity bug and an unresolvable schema field.
- Automated response via Logic Apps, firing within 13 seconds of incident creation, verified against a real test event.
Securing an Inherited Fintech Platform
Security Team Lead. Led a five-person team through a structured seven-cycle security process: STRIDE threat modelling, critical vulnerability remediation, cloud infrastructure build, and CI/CD hardening.
- Directed remediation of SQL injection, JWT verification bypass, IDOR, and a wallet-debit race condition, each validated with a before/after exploit demonstration.
- Hardened infrastructure and detection (KMS, GuardDuty, Security Hub, OPA policy-as-code) ahead of a timed attack simulation.
Enhancing Web Vulnerability Detection Granularity
MSc Project (Dissertation). A Python tool extending OWASP ZAP's detection logic with baseline-differential response verification, tested against DVWA and OWASP Juice Shop.
- Converted two of ZAP's three false negatives into confirmed true positives, with zero false positives introduced.
- Distinguished a basic injection alert from a confirmed six-record credential exfiltration, a level of detail standard scanner output cannot provide.
Internal Network Penetration Test
MSc coursework. Two-stage internal penetration test across a /24 network: host discovery, service enumeration, and manual exploitation validation.
- Live desktop access via a weak VNC password (Critical, CVSS 9.8), plus confirmed anonymous FTP and two exposed database admin interfaces.
- 15 findings documented with CVSS v3.1 scoring, evidence, and remediation guidance.
Experience
Part-time, Remote
Cloud Security Specialist (DevSecOps & Cloud Security Engineer)
- Designed, built, and hardened secure CI/CD pipelines and cloud infrastructure across AWS and Azure, covering pipeline security automation, infrastructure as code remediation, SIEM/SOAR detection and response, and application security.
- Delivered the SecureFlow, VaultBridge, Cloud Threat Detection and SentinelPay engagements above, on realistic client scenarios.
Part-time, Remote
Software Engineer
- Developed and deployed cloud-based applications, implementing system monitoring, automation and security enhancements for availability and compliance.
Self-employed
Project Lead / Mobile App Developer
- Led design, development and deployment of mobile and web applications, and mentored team members in Flutter/Dart and backend best practices.