Tobi builds and secures cloud and distributed systems, with a focus on identity security, least-privilege architecture, threat detection, and incident response.
He works across AWS, Kubernetes, and cloud-native environments, using technologies such as IRSA, Kubernetes ServiceAccounts, workload identity federation, managed identities, and policy-as-code to reduce excessive access and enforce least privilege at scale.
He also builds security detections and automation to identify misconfigurations, shadow administrators, privilege-escalation paths, suspicious activity, and cloud security risks before they become major incidents.
His work combines security operations, detection engineering, vulnerability management, and automated response to improve visibility, reduce risk, and strengthen cloud security posture.
Identrail maps machine-identity trust paths across AWS, GitHub/OIDC, and Kubernetes, linking repository exposure and authorization gaps to evidence-backed findings.
ImpactUnifies machine-identity risk across cloud, code, and cluster surfaces in one explainable trust graph.
Boundary turns access requests into short-lived IAM Identity Center assignments with approval routing, automatic revocation, and reviewable audit evidence.
ImpactReduced privileged access turnaround from days to seconds using approval-based short-lived grants.
IAM Logic Fuzzer pressure-tests AWS IAM policies before deployment and reports confused deputy risk, escalation paths, public exposure, and permission-boundary flaws.
ImpactDetects 4 IAM flaw classes pre-deployment so escalation paths are caught before merge.
KeycloakHardened authorization correctness, FGAP/FGAPv2 policy evaluation, token exchange behavior, OIDC value persistence, session edge cases, and admin audit pagination. Reduces the risk of privilege escalation and audit gaps in enterprise identity deployments.
View merged PRs
Better AuthFixed OTP race conditions and OAuth2 credential handling. Prevents authentication bypass and credential leakage in applications using Better Auth as their identity layer.
View merged PRs
AuthentikImproved session integrity and MFA correctness. Closes gaps that could allow session hijacking or MFA bypass in self-hosted identity provider deployments.
View merged PRs
Cloud CustodianFixed AWS IAM AccessDenied telemetry accuracy and RBAC scope clarity. Ensures cloud governance policies produce reliable audit signals and correct enforcement decisions.
View merged PRs
Home Assistant CoreFixed OAuth recovery flow. Prevents authentication failures that could lock users out of their home automation systems after token expiry.
View merged PRs
ZITADELContributed merged fixes and updates to ZITADEL authentication behavior. Strengthens reliability in OSS identity workflows.
View merged PRs
Principal Software Engineer at IBM
As I've raised the original issue, I've tested this change it and it works as expected. Thanks, Oluwatobi!
Principal Software Engineer at IBM
Thanks for the updates and PR review.
Principal Software Engineer @IBM
Thank you, @Oluwatobi-Mustapha for your PR fix and updates. Merged!
Creator of Better Auth
Thank you @Oluwatobi-Mustapha for the PR fix and update, LGTM.
Solutions Architect at Stacklet
Thanks for the catch/fix/test Oluwatobi Mustapha 🍻 !
Co-Founder & CTO at Stacklet
This looks good to me. Thank you.
Home Assistant Core Developer
Looks good to me, Tobi! Thanks!
Head of Startups and VC, MENAT at NVIDIA
Thanks for your security review and updates, Oluwatobi!
Senior Full-stack Developer at Authentik Security and sister-software
Thank you sending such a detailed PR, Oluwatobi Mustapha! The changes here look great and align with an ongoing effort to make the flow stages easier to test and reason about.
Software Engineer at ZITADEL
Thank you very much for the contribution, Oluwatobi. Great job! Please keep contributing to Zitadel :)
CTO at goauthentik
LGTM.
Open to opportunities in Cloud Security, Identity Security, Detection Engineering, and Security Operations Engineering.
