I'm a security engineer who builds and secures cloud and distributed systems, with a focus on making complex environments more observable, resilient, and easier to operate.
My work spans cloud security, identity and access, detection engineering, incident response, vulnerability management, and security automation. Across AWS, Kubernetes, and open-source projects, I investigate attack paths, improve defensive workflows, and turn security findings into practical fixes.
When I'm not working, you'll find me playing chess, solving math problems, or playing FIFA.
Gives security teams one explainable view of how repositories, workloads, and cloud roles connect, so overprivileged machine identities and risky trust paths are found before they become incidents.
Replaces standing privilege with approval-based, short-lived access that is automatically revoked and easy to audit.
Catches dangerous IAM policy combinations before deployment, including confused-deputy paths, privilege escalation, public exposure, and permission-boundary flaws.
Simulates a full-scale AWS attack and investigation, showing how responders trace identity abuse, contain the blast radius, and turn evidence into repeatable recovery actions.
Validated endpoint prevention and investigation in a controlled Windows lab by triggering the EICAR test, reviewing quarantine telemetry, and mapping the event to MITRE ATT&CK.
Analyzed a malware-infected PCAP to trace NetSupportRAT command-and-control traffic, extract indicators, identify the compromised user, and connect the activity to its initial access path.
Reconstructed a suspected Qakbot intrusion by correlating PCAP evidence, VirusTotal intelligence, PowerShell file hashes, and Splunk telemetry to confirm exfiltration and trace the attack path.
Deployed an internet-facing AWS honeypot and used Kibana telemetry to observe brute-force activity, attacker origins, and real-world probing against exposed SSH and FTP services.
KeycloakHardened enterprise identity flows across authorization, federation, OIDC, token exchange, session cleanup, and audit pagination, reducing privilege-escalation risk and improving policy and audit reliability.
View
Better AuthClosed authentication edge cases across OTP, multi-session cookies, cookie encoding, and OpenAPI session contracts, improving resistance to bypass and credential-handling errors.
View
Home AssistantHardened integrations and secret handling by removing legacy Supervisor tokens, redacting sensitive error data, and making OAuth refresh failures explicit across core integrations.
View
HashiCorp TerraformFixed web-identity credential precedence in the AWS provider, preventing valid configured tokens from being rejected when environment credentials are also present.
View
AuthentikHardened self-hosted identity workflows by clearing stale authenticator state, clarifying RBAC permissions, decoding OAuth2 credentials correctly, and handling LDAP data variants.
View
Cloud CustodianImproved cloud-policy enforcement and SecurityHub reporting by preserving AccessDenied semantics, normalizing IAM condition keys, and sanitizing Lambda network configuration.
View
ZITADELCorrected unauthenticated v1 gateway responses to return 401, preserving reliable client and security semantics in identity APIs.
View
LeapStackSecurity-reviewed an AWS launchpad for AI agents, focusing on the IAM, infrastructure, observability, and cost controls needed to move prototypes toward production.
View
Creator of Better Auth
Thank you @Oluwatobi-Mustapha for the PR fix and update, LGTM.
Principal Software Engineer at IBM
As I've raised the original issue, I've tested this change it and it works as expected. Thanks, Oluwatobi!
Solutions Architect at Stacklet
Thanks for the catch/fix/test Oluwatobi Mustapha 🍻 !
Home Assistant Core Developer
Looks good to me, Tobi! Thanks!
Head of Startups and VC, MENAT at NVIDIA
Thanks for your security review and updates, Oluwatobi!
Senior Full-stack Developer at Authentik Security and sister-software
Thank you sending such a detailed PR, Oluwatobi Mustapha! The changes here look great and align with an ongoing effort to make the flow stages easier to test and reason about.
Principal Software Engineer at IBM
Thanks for the updates and PR review.
Software Engineer at ZITADEL
Thank you very much for the contribution, Oluwatobi. Great job! Please keep contributing to Zitadel :)
Co-Founder & CTO at Stacklet
This looks good to me. Thank you.
Senior Security Engineer @ Home Assistant
Great work on this. The Unix socket approach has now proven reliable across multiple releases, making the old Supervisor token obsolete. This was a clean and well-timed removal of unnecessary legacy authentication. LGTM 👍
CTO at goauthentik
LGTM.
Principal Software Engineer @IBM
Thank you, @Oluwatobi-Mustapha for your PR fix and updates. Merged!
Principal Software Engineer @ HashiCorp
LGTM 🚀. @Oluwatobi-Mustapha Thanks for the contribution🎉 👏.
Open to opportunities in Cloud Security, Identity Security, Detection Engineering, and Security Operations Engineering.
