I came to security from software development. That background helps me understand how systems are built, and where they tend to go wrong. The case files below are my MSc work and my own lab.
An infostealer, traced from five minutes of traffic
Given 286 seconds of packets from a compromised Windows workstation, I reconstructed the whole attack: a suspected watering-hole site, a payload download, a Telegram ping to the operator, then a command-and-control server that fingerprinted the machine and shipped the details out. It matched documented Lumma Stealer behaviour.
What I found
- The first packet was a DNS lookup for a four-year-old site flagged by 8 vendors, which is what you would expect from a compromised legitimate site.
- A page titled "test" served JavaScript that harvested GPU, canvas, screen, audio and network details.
- VM artefacts suggested the malware may have held some behaviour back.
What I recommended
- Isolate the host, rotate its credentials and block the indicators straight away.
- Sweep the rest of the /24 within 24 hours.
- Add TLS inspection and EDR; report to the ICO within 72 hours (UK GDPR Art. 33).
Where it falls short
- The 16 MB payload was encrypted, so I couldn't confirm what hit disk.
- I could say the pattern matches Lumma, not that it is Lumma for certain. That would need a malware sample.
Six more case files.
All from my MSc, across offence, defence, governance and research. Filter, then open the ones you care about.
Where I practise between applications.
A small lab on my own PC. Select a machine to see what it does.
Honest note: this is practice, not a case file. A full lab write-up, with a real alert, the raw log and my verdict, is the next thing going on this page.
How a developer ends up in security.
Building web apps taught me how they break. Debugging taught me to read logs and test a theory before trusting it. Handovers taught me to write for whoever comes next.
- 2025 – 2026
MSc Cybersecurity
Sheffield Hallam UniversityThreat intelligence and forensics, penetration testing, standards-based auditing, network and cloud security, and a machine-learning dissertation.
- Nov 2021 – Jul 2025
Frontend Developer
Akaani (remote)Built the company's first website and worked across its web apps and the Akaani mobile app on Android.
- Contracts
Frontend & web developer
Altostrat Networks · Nectarium · LightEdDashboards for a network security platform, a product frontend wired to its APIs, and a mobile-first rebuild, each one handed over with proper documentation.
- 2019 – 2021
Freelance web developer
small businessesWebsites and backends, and often the first call for logins, email and device problems.
- 2015 – 2019
BSc Computer Science
Federal University OtuokeTechnical lead of the Google Developer Student Club (2018–2019).
- Nov 2025 – now
Weekend door supervisor (SIA)
alongside studyCalm under pressure, and accurate incident reports.
ISC2 Certified in Cybersecurity (CC)
certified
ISO/IEC 27001 Lead Auditor
certified
MSc Cybersecurity
Sheffield Hallam · 2026
CompTIA Security+ (SY0-701)
exam booked · November 2026
Investigate
- Wireshark, NetworkMiner
- Wazuh, Suricata, Splunk
- MITRE ATT&CK
- OpenCTI, VECTR, CyberChef
Attack
- Nmap, Metasploit
- Enumeration, exploitation
- Privilege escalation
- Hack The Box, TryHackMe
Govern
- ISO/IEC 27001:2022
- Audit evidence & NCRs
- Risk assessment
- UK GDPR
Build & network
- Cisco IOS, ACLs, VPN
- Firewalls, IDS/IPS
- Windows, Linux, Azure
- Web apps, Python, SQL
Want a graduate who shows the work?
I'm looking for a first security analyst role, in a SOC or GRC team, and happy to start in IT support. Hybrid, remote and shift work all suit me.