DDevineSecurity Engineer
Nairobi, Kenya · Security engineering · 5 Projects

Devine Nyaenya

Security Engineer • Modern Workplace Operations • Application Security

I build security-focused software, investigate vulnerabilities in authorized labs, and ship defensive controls that are implemented and tested — not just described. Building security systems that prove their security through implementation and testing.

Tamper-evident auditDual-control approvalLeast-privilege RBACSecurity testingProfessional engineering
View projectsGitHub (opens in a new tab)LinkedIn (opens in a new tab)

Each project serves a distinct purpose — Chokepoint for security control plane, Android management for fleet operations, OrbitDesk for workplace operations training, and EndoPima for community health. Focused engineering with verifiable security properties.

automated tests
0+automated testsVitest + pytest
lab attacks detected
0 / 6lab attacks detectedself-run red team
control gates
0control gatesper sensitive action
dependency CVEs
0dependency CVEsnpm audit, this site
documented builds
0documented buildssource on GitHub

Selected work

My projects — click to open

Real security controls, built and tested. Tap any window to go straight into that project's case study.

Modern Workplace Operations Lab — Training environment for IT support

OrbitDesk

Live demo

Professional training environment for Modern Workplace operations — Entra ID, Intune, Exchange, and Teams troubleshooting with realistic tickets, voice communication, remote desktop, and team collaboration. Designed for support engineers and interview preparation.

Modern Workplace OperationsEntra ID and Conditional AccessIntune Device ComplianceExchange and DefenderVoice CommunicationRemote Desktop Operations
Open case study →

Least-Privilege Dual-Control with Tamper-Evident Audit

Chokepoint

Live demo

Security control plane for sensitive operations — least-privilege access control with dual-control approval, hash-chained tamper-evident audit log, anomaly detection, and policy simulation. Designed for human and AI agent operations under OWASP ASI03.

Least PrivilegeDual-ControlTamper-Evident Audit
Open project →

Security simulation — RBAC, dual-control, and tamper-evident logging

Android Reset Lab

Simulation / lab

Simulation of Android device reset operations with security controls — role-based access, four-eyes dual-control, hash-chained audit logging, and attack detection. Built as isolated lab for security engineering learning.

Security SimulationRBAC and Dual-ControlTamper-Evident Logging
Open project →

Community health platform — bilingual and privacy-conscious

EndoPima Kenya

Experimental / WIP

Bilingual community platform for endometriosis awareness and care navigation in Kenya. Provides symptom exploration, health timeline, and care guidance with privacy-conscious local-first design.

Health-techBilingual UXCommunity-first
Open project →

All repositories

More on GitHub

Browse every build, commit, and test on the GitHub profile — including experiments and work in progress.

@Nyaenya-Devine ↗

How it works

One request, six gates

No high-impact action happens without passing layered, verifiable controls. Click a stage to see the principle — and what breaks if it fails.

Request path · control plane

01

Actor

Identity

A human operator or an automated/AI agent initiates a request. Every actor — person or machine — is a named identity with a role, because access control begins with knowing who is acting.

If this control failed

Anonymous or shared accounts make every later control un-auditable: you cannot enforce least privilege or attribute actions you cannot tie to an identity.

Interactive request flow — click a stage to inspect the security principle.

Proof over claims

Where each control exists

Security controls mapped across the builds — implemented, partial, or out of scope, verified against each repo.

Security control coverage

What each project actually ships — verified against the repos.

implemented partial / concept out of scope
ControlChokepointReset LabDevice Mgmt
Least-privilege RBAC (default-deny)
Dual-control / four-eyes approval
Tamper-evident ledger (hash chain)
HMAC-signed audit entries
Anomaly / threat detection
Strong password hashingPBKDF2 / Argon2id
MFA (TOTP)
Session hardeningHttpOnly · SameSite · TTL · CSRF
Brute-force lockout / rate limitingChokepoint detects failed logins; Reset Lab locks out
CSRF protectionChokepoint relies on SameSite=Strict
Security headers + strict CSP
Automated security tests
Human + AI actor model

Partial / concept marks reflect the experimental Device Management build and evolving controls — documented honestly, not assumed complete.

Capabilities

Skills & training

Grouped by where I focus, with honest proficiency labels. Security training, led by the Cisco curriculum, is prioritized.

Cybersecurity

Where I focus most of my time — designing and testing controls rather than only reading about them.

  • Security engineeringCore focus
  • Application securityCore focus
  • Authentication & authorizationCore focus
    RBAC, least privilege, separation of duties
  • Threat modelingCore focus
    Assets, attackers, controls, detection
  • Tamper-evident logging & audit integrityCore focus
    Hash chains, HMAC
  • Vulnerability assessmentWorking knowledge
    In authorized labs
  • Linux security & privilege escalationWorking knowledge
    Lab environments
  • Network security & analysisWorking knowledge
  • Security testing & automationWorking knowledge
  • SOC / defensive security conceptsFamiliar / labs
    Detection rules, alerting, SIEM shipping
  • AI security / securing AI agentsWorking knowledge
    Identity & privilege abuse in agentic systems
  • Secure software developmentCore focus

Programming & Development

The tools I build with. Python for security tooling and labs; TypeScript/Next.js for product surfaces.

  • PythonCore focus
    Security tooling, labs, stdlib-only projects
  • TypeScriptWorking knowledge
    Next.js apps
  • JavaScriptWorking knowledge
  • Next.js / ReactWorking knowledge
    App Router, full-stack
  • SQLWorking knowledge
    SQLite / relational data
  • HTML & CSSWorking knowledge
  • Git & GitHubCore focus
    Commits, PRs, CI workflows

Security Tools & Platforms

Hands-on in controlled lab environments — used to learn, not run against systems I don't own.

  • Kali LinuxWorking knowledge
    Lab platform
  • LinuxCore focus
    Daily driver for security work
  • NmapWorking knowledge
    Recon & scanning in labs
  • MetasploitWorking knowledge
    Exploitation in controlled labs
  • WiresharkWorking knowledge
    Packet analysis
  • tcpdumpWorking knowledge
    CLI capture/analysis

Cybersecurity & core technical training

Ethical Hacker

Core

Cisco Networking Academy

Offensive security mindsetExploitation lifecycleDefensive controls

Introduction to Cybersecurity

Core

Cisco Networking Academy

Security fundamentalsThreats & defensesSecurity domains

Python Essentials 1

Core

Cisco Networking Academy

Python foundationsScripting for automation

Additional technical training

Python Essentials 2

Cisco / OpenEDG style curriculum

Intermediate PythonModules, OOP, error handling

Python Programming

Online training

Applied programmingAutomation

Coding with AI

Online training

AI-assisted developmentPrompting & verification

Create AI Agents with Copilot Studio

Microsoft / online training

Agent buildingAutomation design

AI for Beginners

Online training

AI fundamentalsCapabilities & limits

Broader learning

Data Entry

Online training

Microeconomics

Online training

Introduction to Greenhouse Gas Accounting for IT

Online training

Hands-on security

Security lab

Practical exercises in authorized, isolated environments — recon, exploitation, privilege escalation, and the fix for each.

Authorized labs only

Every exercise here was performed in an isolated, intentionally-vulnerable training environment that I was explicitly permitted to attack — never against real organizations or systems I don't own. These are learning write-ups, not professional penetration tests or findings against real companies.
ExploitationNetwork SecurityLinux Privilege EscalationWeb SecuritySecurity AutomationThreat Modeling
ExploitationBeginner

Exploiting the UnrealIRCd Backdoor

A classic, well-documented vulnerability used to teach the full exploit chain: recon, service identification, exploiting a known backdoor for a reverse shell, and then escalating privileges on Linux. A clean first example of moving from a foothold to local privilege escalation in a legal lab.

Read write-up

Web SecurityComing soon

Web Security write-up

Planned: auth/authorization testing and input-validation exercises in intentionally vulnerable web apps.

Network SecurityComing soon

Network Security write-up

Planned: packet analysis with Wireshark/tcpdump and traffic interpretation.

Security that's built and proven

I'm Devine, a self-taught security builder in Nairobi, Kenya — focused on application security, access control, and securing AI agents.

Get in touchExplore OrbitDesk — FlagshipExplore Chokepoint