Gbenga KakaGbenga Kaka
Capabilities

A practiced toolkit, not a buzzword list.

Focused capability areas across application, cloud and platform security — each elaborated below with its capabilities, tools, proficiency and measurable outcomes.

08
Capability areas
01
Discipline
40
Tools & platforms
By discipline
Security & Engineering
8 areas
Tools & platforms
40
Application Security01SAST02DAST03Cloud Security04DevSecOps05API & Identity Security06Technical Program Management07AI / LLM Security08
01
Secure SDLCThreat ModelingVuln Mgmt

Application Security

Embedding secure-by-design into the SDLC.

Lead AppSec strategy across web, API, and cloud-native platforms. Identify and remediate vulnerabilities at the design stage and across the entire delivery pipeline.

30–40%
Production security defects reduced
25%
Faster remediation turnaround
Explore this skill
Capabilities
5 areas
  • SAST, DAST and SCA tooling integration
  • Secure code review across .NET, Java, Node.js
  • Threat modeling using STRIDE
  • Authentication, authorization and input validation review
  • Vulnerability management lifecycle ownership
Tools & stack
5 tools
Burp SuiteExpertOWASP ZAPAdvancedCheckmarxAdvancedSnykAdvancedSonarQubeProficient
02
Source AnalysisCI GatingSecure Code

SAST

Static analysis that finds flaws in source before it ships.

Embed static application security testing across the SDLC — scanning source and dependencies for vulnerabilities early, with automated gates that catch issues before code reaches production.

30–40%
Production defects reduced
Pre-merge
Findings caught in CI
Explore this skill
Capabilities
5 areas
  • Static code analysis across .NET, Java and Node.js
  • CI/CD-integrated SAST gating and policy enforcement
  • Triage, false-positive tuning and finding prioritization
  • Secure code review of authentication and input handling
  • Software composition analysis (SCA) for dependencies
Tools & stack
5 tools
CheckmarxAdvancedSonarQubeAdvancedSnyk CodeAdvancedSemgrepProficientCodeQLProficient
03
Runtime TestingAPI FuzzingPen Testing

DAST

Dynamic testing that probes running apps like an attacker.

Validate running applications and APIs from the outside in — combining automated dynamic scanning in CI with manual penetration testing to surface vulnerabilities that only appear at runtime.

25%
Faster remediation turnaround
Runtime
Risks caught pre-release
Explore this skill
Capabilities
5 areas
  • Automated DAST scanning integrated into CI/CD
  • Manual web and API penetration testing
  • Authentication, session and access-control testing
  • Business-logic and chained-vulnerability validation
  • Remediation guidance and re-test verification
Tools & stack
5 tools
Burp SuiteExpertOWASP ZAPAdvancedNucleiProficientPostmanAdvancedSQLMapProficient
04
AWSAzureIAM

Cloud Security

Hardening cloud-native estates at enterprise scale.

Drive cloud security posture across AWS and Azure environments — from infrastructure hardening to IAM governance and workload isolation.

40%
Over-privileged access reduced
30%
Faster secure onboarding
Explore this skill
Capabilities
5 areas
  • AWS and Azure security controls
  • IAM policy design and enforcement
  • Workload segmentation and isolation
  • Centralized logging and audit pipelines
  • Control gap assessment and remediation
Tools & stack
5 tools
AWS IAMExpertAzure ADAdvancedAWS Security HubAdvancedCloudTrailAdvancedTerraformProficient
05
CI/CDContainersIaC

DevSecOps

Automating security as code into every pipeline.

Integrate security validation directly into CI/CD pipelines so that risks are caught before code reaches production — without slowing engineering teams down.

40%
Manual security effort reduced
100%
Pipelines with automated gating
Explore this skill
Capabilities
5 areas
  • CI/CD security gating (SAST, DAST, SCA)
  • Container image scanning and runtime protection
  • Kubernetes workload hardening
  • Security automation in Python and Bash
  • Secrets management and policy as code
Tools & stack
5 tools
GitHub ActionsExpertDockerAdvancedKubernetesAdvancedJenkinsAdvancedTrivyAdvanced
06
OAuth2OIDCAPI Gateway

API & Identity Security

Securing the perimeter of distributed systems.

Design and enforce strong identity and access controls across REST, GraphQL and gateway-fronted APIs in distributed enterprise systems.

25%
Escalations reduced via early risk mapping
100%
APIs gated by identity policy
Explore this skill
Capabilities
5 areas
  • OAuth2 and OpenID Connect implementation
  • API gateway hardening (Azure APIM)
  • REST and GraphQL access control
  • Traffic policy and rate-limit design
  • Federated identity and SSO governance
Tools & stack
5 tools
OAuth2ExpertOIDCExpertAzure API ManagementAdvancedKeycloakProficientSAMLProficient
07
DeliveryGovernanceReporting

Technical Program Management

Turning security strategy into delivered outcomes.

Own end-to-end delivery of complex, cross-functional security programs. Structure intake, prioritization and execution to keep work tracked, prioritized and shipped.

30%
Program throughput improvement
25%
Fewer escalations
Explore this skill
Capabilities
5 areas
  • Structured intake and prioritization workflows
  • Cross-team dependency mapping
  • Executive dashboards and governance reporting
  • Resource allocation and program planning
  • Change enablement and stakeholder communication
Tools & stack
5 tools
JiraExpertConfluenceAdvancedSmartsheetAdvancedQuicksightProficientTableauProficient
08
Threat ModelingGuardrailsPrompt Injection

AI / LLM Security

Building guardrails for AI-driven and LLM-integrated systems.

Secure AI-driven and LLM-integrated platforms by design — threat modeling model interactions, enforcing guardrails, and controlling how applications and APIs access AI services.

Design-stage
AI risks caught early
Guardrails
Across LLM integrations
Explore this skill
Capabilities
5 areas
  • AI threat modeling — prompt injection and data leakage
  • LLM guardrails and model-interaction controls
  • Secure AI/LLM and third-party integration patterns
  • Identity validation and least-privilege model access
  • AI governance and data-protection controls
Tools & stack
5 tools
OWASP LLM Top 10AdvancedPrompt-Injection TestingAdvancedAmazon BedrockProficientAzure OpenAIProficientAPI GatewaysAdvanced