Available for Industrial Attachment · 2026
Software Developer · Systems Engineer
Security Practitioner
Building security tooling, systems infrastructure, and open-source developer libraries from Kenya. I run a full offensive security lab on real hardware, maintain a cluster of purpose-built security MCP servers, and ship production code across Python, JavaScript, and C++.
I'm a software developer and security practitioner in my fourth year at Chuka University, pursuing a BSc in Applied Computer Science. I've been writing code for over six years across systems programming, backend engineering, infrastructure automation, and offensive security tooling.
My security work is grounded in a real lab — a Kali Linux container wired to a cluster of eight discipline-specific security servers covering reconnaissance, web exploitation, binary analysis, cryptography, forensics, and reverse engineering. The tooling is used to compete in CTF challenges and develop practical skill across the MITRE ATT&CK framework.
My open-source work includes ssh-shell-mcp — a 57-tool Python SSH orchestration library — and headscale-mcp, a server for managing self-hosted VPN infrastructure. Both are production-deployed and actively maintained.
I'm looking for an Industrial Attachment placement where I can contribute immediately — in security, systems, backend engineering, or infrastructure.
Not a generalist who dabbles — these are the four areas I go deep in, every day.
Production-grade Bash and Zsh scripting — cron pipelines, daemon scripts, signal handling, process orchestration. If it runs on Linux, I can automate it. Shell is my first language.
Building developer tools and infrastructure that runs in production. SSH orchestration libraries, self-hosted VPN control planes, media processing pipelines, and communications servers.
Running a full offensive security lab with a Kali Docker container, 8 discipline-specific security servers, and 155+ tools covering 11 of 13 MITRE ATT&CK tactics. Active CTF competitor.
Vector illustrations, UI mockups, system architecture diagrams, and design systems. Design thinking applied to technical communication — making complexity legible.
Real systems. Real problems. Real code.
A Python SSH orchestration library exposing 57 structured tools for programmatic infrastructure control — one-off commands, persistent sessions, fleet broadcasting, tunnelling, SFTP, tmux, and playbooks. Async connection pool, built-in audit trail, and a security policy gate. Production-deployed and open source.
A songwriting application built around structured identity reasoning. Three-tier stack: React 18 frontend, Node.js/Express backend with 15 engine modules, Python/Flask ML microservice. 23 REST endpoints, Kiswahili and Sheng language support, lyric analysis toolkit.
MCP server for managing a self-hosted Headscale control plane — user and node management, pre-auth key lifecycle, subnet route control, and DERP map inspection via the Headscale REST API.
Multi-threaded simulation of the spaghetti sort algorithm in C++ — a physical sorting thought experiment implemented with concurrent threads. Demonstrates thread synchronisation and unconventional algorithm design.
Not a course. A working lab built and maintained on real hardware — used daily for CTF competitions and security research.
The lab is structured around toolBOX — a private repository housing a cluster of eight discipline-specific security servers, each running independently with its own tools and Kali Linux Docker container as the execution backend.
The architecture mirrors how real security operations teams are structured: web exploitation, reconnaissance, binary analysis, cryptography, forensics, and reverse engineering each have their own server and mental model. The cluster covers 11 of 13 MITRE ATT&CK tactics at enterprise depth.
The lab also runs an isolated Docker network hosting OWASP Juice Shop, DVWA, and WebGoat — accessible only via private Tailscale mesh — for safe web exploitation practice.
| MITRE Tactic | Server | Coverage |
|---|---|---|
| Reconnaissance | recon-mcp | Full |
| Initial Access | web-mcp | Full |
| Execution | kali-mcp | Full |
| Privilege Escalation | pwn-mcp | Full |
| Credential Access | crypto-mcp | Full |
| Collection | forensics-mcp | Full |
| Defense Evasion | ops-mcp | Full |
| Lateral Movement | ops-mcp | Roadmap |
| Exfiltration | ops-mcp | Partial |
Three projects in active development — designed to prove full-stack, infrastructure, and open-source competency for both Kenyan and global markets.
A real-world fintech application integrating the Safaricom Daraja API for M-Pesa STK Push, C2B, and B2C payment flows. Includes transaction ledger, SMS notifications via Africa's Talking, and an offline-first PWA for low-bandwidth areas.
A benchmarking and observability project for distributed caching. Measures Redis vs in-process caching under load, with a live dashboard showing hit rates, latency distributions, and memory usage.
A typed, modular Node.js/Python SDK for the Safaricom Daraja API — the M-Pesa integration layer every Kenyan developer has had to re-implement from scratch. Full ISP compliance, retry logic, and webhook signature verification.
Every project in this portfolio is architected around these principles — not as theory, but as working code decisions.
Understanding the local tech ecosystem is a competitive advantage. These are the competencies that matter for Kenyan engineering roles — from Safaricom to early-stage startups.
STK Push, C2B, B2C, and account balance integrations. The payment layer behind nearly every Kenyan product — I'm building a typed SDK to make it accessible to every developer.
SMS, USSD, and voice integrations for low-bandwidth, feature-phone-first markets. Building for real Kenyan network conditions, not ideal ones.
Kenya's growing fintech and data sectors need security practitioners who understand local threat models. My lab and CTF practice are directly applicable to this gap.
Building reusable SDKs and tooling that other Kenyan developers can use — reducing duplicated work across the ecosystem and raising the baseline for everyone.