$ Hi, my name is
Chibuikem Okonkwo
I build secure software, end to end.
Full-Stack Software Engineer with a focus on Application Security (AppSec) and the Secure SDLC. I ship enterprise identity and access software from the data model to the screen — React & TypeScript interfaces on Python (FastAPI) services — and break things on CTF platforms for fun.
01. whoami
I'm a software engineer who treats security as a critical foundation of the build, not an afterthought. I work across the whole stack — the data model, the API, and the interface people actually touch — and my nights are spent on Hack The Box and TryHackMe learning how attackers think.
At Emutare (Perth, Western Australia, remote) I build enterprise identity and access software end to end: the services that decide who may do what, and the web, mobile and browser-extension surfaces our customers use to run it. In practice that means passkeys and multi-factor sign-in, self-service access governance, tamper-evident audit trails — and shipping all of it in 10 languages.
Technologies I reach for most often:
- TypeScript
- React
- Python (FastAPI)
- Node.js (Express)
- PostgreSQL
- Kafka / RabbitMQ
- Docker
- Linux (Kali/Ubuntu)
02. arsenal
Frontend Engineering
Backend Engineering
Security Tools
Infrastructure & DevOps
Networking
Offensive Security
03. experience
Junior Security Software Engineer @ Emutare
Feb 2026 — Present- Own features end to end — data model, API, and the React & TypeScript interface — across a web portal, a cross-platform mobile app and a browser extension, so customers get one consistent experience wherever they work.
- Built the customer-facing sign-in experience — passkeys, authenticator apps, one-time codes and biometrics, with step-up re-authentication in front of sensitive actions — giving clients phishing-resistant login without slowing down everyday work.
- Shipped self-service access governance so client administrators can grant, review and time-box employee access themselves, replacing ticket queues and producing the evidence trail auditors ask for.
- Scaled the platform architecture by 400%, designing and deploying distributed Python (FastAPI) services over a Zero-Trust, event-driven backbone with a PKI layer securing service-to-service communication; moved secrets into cloud-native KMS vaults with enforced encryption-at-rest.
- Localised the product into 10 languages with a build pipeline that ships only the visitor's language, and lazy-loaded every screen — so international customers get a fast first load.
- Built and maintain a shared component library and app shell — command palette, notifications, guided role-based onboarding — reused across several products, cutting the time to launch a new customer-facing surface.
Security Software Developer Intern @ Emutare
Feb 2025 — Jan 2026- Contributed to the foundational architecture of an enterprise microservices platform, implementing scalable messaging with Node.js and NoSQL/AMQP.
- Provisioned secure cloud-native environments for staging and integration testing with strict network access controls.
- Authored technical API documentation and implemented initial RBAC logic to secure service-to-service communication.
Cybersecurity Intern @ Prodigy InfoTech
Nov 2024 — Dec 2024- Developed custom Python utilities for AES-256 encryption and secure hashing (data-at-rest protection).
- Analyzed PCAP captures in Wireshark, flagging insecure protocols (Telnet, HTTP) and recommending TLS upgrades.
- Built an entropy-based password strength analyzer simulating dictionary and brute-force resistance.
- Researched keylogging mechanics to develop signature-based detection patterns.
Penetration Tester · CTF Competitor
2023 — Present- Actively exploiting machines on Hack The Box and TryHackMe, focused on privilege escalation and web exploitation.
- Executed OSINT to map attack surfaces during simulated red-team engagements.
04. selected work
A few things I've built or broken — distilled from production work and hands-on security research. Client work is described in general terms; the interesting details stay behind the NDA.
Production
Enterprise Identity Console
A large React & TypeScript application where client administrators run identity for their whole organisation — joiners, movers and leavers, access requests, approvals and reviews. Role- and plan-aware routing means each person only ever sees the surface they're entitled to.
- React
- TypeScript
- TanStack Query
- Zustand
Production
Passwordless Sign-In
The whole login experience, front to back: passkeys, authenticator apps, one-time codes and biometrics, with step-up re-authentication before sensitive actions. Phishing-resistant by default, and one identity across web, mobile and the browser extension.
- WebAuthn
- OAuth2 / OIDC
- TOTP
- Biometrics
Production
Cross-Platform Client Suite
One product delivered three ways — a web portal, a native iOS/Android app that generates one-time codes offline, and a browser extension that fills credentials in place — sharing a single design system so customers never have to relearn the product.
- React
- Capacitor
- MV3 Extension
- Web Crypto
Production
Zero-Trust Service Backbone
An asynchronous, event-driven backbone linking distributed FastAPI services, with a PKI layer issuing and verifying certificates so no service implicitly trusts another — and clients keep working even when one part of the platform doesn't.
- FastAPI
- Async messaging
- PKI
- PostgreSQL
Production
Secrets Vault & Audit Trail
Moved sensitive credentials out of config and into cloud-native KMS vaults with enforced encryption-at-rest, paired with tamper-evident audit logging so clients can prove who did what, and when, without taking anyone's word for it.
- Cloud KMS
- GCP
- Encryption-at-rest
- Audit logging
Research
AES-256 Crypto Toolkit
Custom Python utilities for AES-256 encryption and secure hashing — a practical study in correct key handling, IVs, and authenticated encryption for data-at-rest.
- Python
- AES-256
- Hashing
Research
Entropy Password Analyzer
A strength analyzer that scores passwords by entropy and simulates dictionary and brute-force resistance — turning "is this strong?" into a measurable answer.
- Python
- Entropy
- Threat modeling
Research
PCAP Traffic Analysis
Captured and dissected network traffic in Wireshark to surface cleartext protocols (Telnet, HTTP), document the exposure, and recommend TLS-based remediation.
- Wireshark
- TCP/IP
- TLS
05. credentials
Certifications & Training
CiscoCCNA — Introduction to Networks
CiscoCCNA — Switching, Routing & Wireless Essentials
CiscoCCNA — Enterprise Networking, Security & Automation
The SecOps GroupCNSP — Certified Network Security Practitioner
CiscoCyberOps Associate
CiscoDevNet Associate
CiscoPython Essentials 1
Digital RegenesysCybersecurity Defence Toolbox
Lagos, NigeriaAfrica CyberFest CTF Competition (2024)
Education
University of Lagos
2019 — 2024B.Sc. (Ed.) Mathematics · Second Class Upper
University of the People
2018 — 2024B.Sc. Computer Science · Cum Laude
06. get in touch
Let's build something secure.
I'm open to full-stack and application-security roles, collaborations, and CTF teams. Whether you have a question, an opportunity, or a vulnerability to discuss responsibly — my inbox is open.
Say hello