Application Security

Application Security Analyst — wHTa Networks

Current, paid role focused on identifying, mitigating, and preventing vulnerabilities across web applications and CI/CD pipelines, applying a frontend development background to bridge engineering and security. Work spans SAST/DAST assessment (XSS, CSRF, injection flaws) early in the SDLC; enforcing secure coding practices aligned to OWASP Top 10 and CWE/SANS with developers, including remediation guidance and fix verification; secure authentication/authorization flow design (least privilege, session hardening, token management); reviewing API endpoints and client-server data transmission (HTTPS/TLS, input validation, output encoding); embedding security controls and automated vulnerability detection into CI/CD with DevOps/engineering teams; implementing CSPs and secure headers against client-side and browser-based attacks; and delivering internal security training and reviews.

Outcome: Ongoing role since Mar 2025.

Penetration Testing — wHTa Networks

Supporting role on wHTa Networks' penetration testing function: assisting in conducting security assessments and penetration testing activities, collaborating with the cybersecurity team to identify and address potential vulnerabilities, participating in the development of security best practices and guidelines, and assisting in documenting findings and recommendations.

Verification Specialist — Bill Gosling Outsourcing

Operational fraud, identity, privacy and compliance exposure: reviewed and validated customer applications, identity documents, and supporting records for compliance with financial-institution and privacy requirements; identified and escalated suspected fraud (forged identification, altered financial documents, impersonation attempts, account takeover indicators); supported identity and access-related checks for customer-facing systems; handled sensitive customer information against established procedural controls; and collaborated with fraud, compliance, and operations teams on suspicious-activity investigations, while maintaining record accuracy across high-volume, regulated case queues.

Outcome: 18,000+ customer applications, identity documents, and records reviewed and validated; 750+ suspected fraud attempts identified and escalated.

Information Security & System Analyst — Zionshine ICT Hub (IAM • Application Security • GRC)

Bridged identity and access management into application security and governance work across healthcare and business environments. Administered Microsoft 365 and Azure AD / Microsoft Entra ID for 4,000+ user accounts under role-based access control and least-privilege principles: provisioning, access modification, deprovisioning, and onboarding/offboarding; investigating and resolving authentication troubleshooting and permission/access conflicts; and account-lifecycle governance across that population. Extended into application and integration security: assisted with deployment and integration of web applications, REST APIs, and authentication/session workflows, collaborating on secure integrations and application hardening (secure coding and input handling) alongside hospital technology projects involving account-management systems and secure access controls. Produced security documentation, implemented controls, and documented incidents and remediation/corrective actions as part of compliance-minded security reviews. Security-operations exposure included day-to-day log/security monitoring and participation in identity-related incident investigation, alongside reducing duplicate-data-entry processes through website/backend integration work.

Outcome: 4,000+ user accounts provisioned, modified, or deactivated under least-privilege, role-based access controls.

Early-Career IT & Security Operations (Nigeria, 2015–2020)

Security Analyst, ZionShine ICT (Sep 2017 – Dec 2020): day-to-day security monitoring and alert response; identified setup weaknesses and implemented stronger controls before issues escalated; reviewed system configurations and applied hardening measures; collaborated across departments, vendors, and external partners on incident investigation and response; promoted security awareness practices org-wide. Compliance & IT Support Analyst, Mediasoft Technologies (Dec 2015 – Aug 2017): evaluated and installed secure hardware, networking software, and OS components against compliance standards; performed routine maintenance/health checks; configured and monitored critical systems, escalating and documenting incidents; conducted asset-tracking reviews for audits and licensing compliance; supported Windows/PC/scanner/printer environments and provided Tier 2 Microsoft Office support; applied foundational network administration (routing, switching, wireless troubleshooting); helped develop IT documentation and security checklists.

Outcome: Mediasoft Technologies: 99% uptime maintained, 90% of incidents resolved on first contact, and a 20% reduction in configuration drift from improved documentation practices.

LLM Data Leakage Lab

A deliberately vulnerable LLM-enabled Flask application, built to demonstrate a real cross-user data leakage vulnerability class and then measure three progressively stronger defenses against it: identity trust, context isolation, input risk inspection, output redaction, and structured security logging. The vulnerable baseline is preserved unmodified so the 'before' stays real and reproducible; the defended modes are implemented alongside it, not in place of it, so the same attack set can be replayed against all three and compared directly. Independent, self-built personal project against a real vulnerable application -- distinct from the separate CIS*6510 MSc course project, which evaluates a controlled, synthetic-data mock-LLM app and reports its own, different results.

Outcome: Unauthorized cross-user disclosure measured at 25% under the original vulnerable baseline, dropping to 0% once context isolation is added (Partial Defense) -- the full Defense-in-Depth mode adds pre-model risk-based blocking, output redaction, and resolves identity from a server-side session token rather than a client-declared field, which is what stops a separate identity-spoofing (IDOR) vector the first two modes both leave open.

Unauthorized disclosure rate -- Vulnerable Baseline:

25% (3/12 adversarial cases)

Unauthorized disclosure rate -- Partial Defense (context isolation only):

0% (0/12 adversarial cases)

Unauthorized disclosure rate -- Defense in Depth:

0% (0/12 adversarial cases)

Identity-spoofing (IDOR) case blocked:

Only Defense in Depth (1/1); Baseline and Partial Defense both allow it

Adversarial requests blocked before reaching the model -- Defense in Depth:

33% (4/12)

Machine Learning-Based Malware Classification & APT Attribution

A threat intelligence project classifying malware samples by their associated Advanced Persistent Threat (APT) groups using opcode-based analysis. Workflow: Dataset Creation (extracted and cleaned opcode text from malware samples, mapped each to its corresponding APT group, building a structured dataset of file hashes, APT labels, and opcode text features); Feature Engineering (converted opcode sequences into numerical features using unigram and bigram representations); Model Training (trained and compared multiple classifiers -- Support Vector Machine, K-Nearest Neighbours, and Decision Tree); Evaluation (assessed performance using accuracy, precision, recall, F1-score, and confusion matrices); and a Threat Intelligence Focus exploring how malware behaviour patterns can support attribution and help analysts connect samples to known adversary groups.

Outcome: Reinforced the applied value of machine learning in cyber threat intelligence -- malware triage, pattern recognition, and early-stage attribution support.

Penetration Testing and Exploit Development Lab Series

A hands-on lab series covering exploit development, reconnaissance, vulnerability assessment, exploitation, post-exploitation, authentication attacks, man-in-the-middle simulation, and web application security testing in a controlled VM lab. Exploit Development Basics: used GDB to inspect vulnerable programs, analyze memory behavior, and understand buffer overflow/logic-bypass outcomes. Reconnaissance and Enumeration: Maltego, Nmap, and Wireshark for DNS enumeration, host discovery, OS detection, and packet capture analysis. Vulnerability Assessment: OpenVAS/GVM and Nessus scans against Windows targets, with before/after comparison across system and firewall changes. Exploitation and Post-Exploitation: privilege escalation, process migration, persistence testing, hash dumping, and event log analysis in Windows lab environments. Authentication Attacks: Metasploit/Meterpreter, Kiwi, Cain & Abel, John the Ripper, Hashcat, and Hydra. Network Attack Simulation: Ettercap for ARP poisoning, DNS spoofing, and traffic redirection. Web Application Security Testing: SQL injection, authentication bypass, UNION-based extraction, XSS, CSRF, and IDOR-style access-control weaknesses against vulnerable web applications.

Lighthouse Labs Cybersecurity Program — Applied Projects

Applied projects from a Cyber Security diploma program: role-played incident-response scenarios; a digital forensics project using EnCase and Autopsy; a security architecture project for a simulated mid-sized e-commerce company intending to accept card payments (PCI DSS compliance scope); an application security project using DAST, IAST, SAST, and SCA; and work with cryptanalysis tools (Crypto SMT, ARX Toolkit, ISEA). Final program project: investigating a simulated ransomware attack at a fictional company ('Premium Lighthouse') and producing prevention recommendations.

Full-Stack Development Projects

My Developer Portfolio (Feb–Dec 2025, personal project): the previous version of this portfolio site (github.com/Azubikeamala/My-Portfolio) -- a React + Tailwind CSS site with animated backgrounds and smooth scrolling, deployed via Vercel. Osita.pro – Wonder World for Kids (Jul–Dec 2025, personal project): an interactive children's learning/play site (React + Tailwind CSS, hosted on Vercel) with categories including Math Missions, Craft Lab, Story Time, and Brain Boosters. Car Tracker App (Apr 2025, Conestoga group project): a Framework7 + Firebase web app for tracking car purchase plans in real time, with Email/Password and Google OAuth 2.0 authentication and Firebase Realtime Database sync. Live demo: car-tracker-3aeb5.web.app. Healthy Eating App (Jan–Apr 2025, Conestoga group project): a full-stack meal-planning app (React/Tailwind frontend, Django/PostgreSQL backend) with categorized recipes, downloadable CSV meal plans/shopping lists, and an AI-powered support chatbot. Hosted at healthyeating.help. Password Hashing and Secure Credential Storage Demonstration (Jan–Apr 2026, University of Guelph coursework): a presentation and demo covering password hashing, hash function properties, login verification, and data-breach protection in real-world authentication systems. ClinicApp (Conestoga College coursework): an ASP.NET Core MVC / C# clinical-workflow application with role-based access control (RBAC) protecting access-sensitive clinical workflows, controller/backend logic, and unit-tested, secure-coding-oriented implementation. Shuleni (Conestoga College coursework): an Angular multi-tenant school-management application with frontend/backend API integrations across tenant-scoped workflows, including hands-on API/integration troubleshooting. JuiceShop Ordering System (Conestoga College coursework): a MEAN-stack (MongoDB, Express-style REST APIs, Angular, Node.js) ordering application with data modelling over MongoDB and Git-based, CI/CD-oriented development practice.

Independent Client Development & Pre-Deployment Security Reviews

Independent client and community security/development work, outside of any employer or academic program -- a distinct category from her professional (wHTa Networks, Zionshine) and academic/research (University of Guelph, Conestoga, Lighthouse Labs) evidence. Real Estate Client Platform (independent client website/application development, client name not publicly established, described descriptively rather than named): independent build and delivery of a client-facing real estate web platform. Pre-deployment application security reviews for friends and people in her professional network, ahead of release: manual review across areas such as authentication, authorization and access control, session handling, API design, input validation, sensitive-data exposure, secrets and configuration handling, and logging/auditability, informed by OWASP-oriented testing practice, with remediation guidance provided before release. Not every engagement used every technique or tool listed -- scope varied by the specific application and client. Practical risk and GRC assistance, applying the same compliance-minded review habits developed professionally (see Zionshine ICT Hub and Bill Gosling Outsourcing) to smaller, independent engagements. This is also the identity under which she independently builds and owns commercial products -- QuickHalo, IgboNest, and Osita.pro each have their own dedicated evidence and, where applicable, case-study pages.

QuickHalo

Independent, commercial SaaS product for service businesses, automating customer retention and recurring-service engagement: automated service reminders, customer follow-up, appointment/booking flows, recurring-customer engagement, and AI-assisted customer interactions. Amalachukwu is the primary product builder and owner. The product spans multiple application surfaces in a single monorepo/workspace architecture: a marketing/onboarding site, a customer application/dashboard, an admin surface, a booking flow, an embeddable widget, and an API. Currently at production-readiness / pre-launch stage -- built and hardened as a real product, not yet claiming an established customer base. Product-security work, approached from both the builder and AppSec sides: replacing demo/fake auth with real authentication (Supabase Authentication) including email verification and a secure sign-in/session flow; tenant/membership boundaries and role-based access control built on the principle of least privilege, enforced at the database layer with row-level/data-access controls rather than only in application code; removal of insecure client-side/admin shortcuts left over from earlier prototyping; secure environment-variable and secret handling, including application encryption-key handling; Stripe webhook signature verification; audit logging and structured, redacted application logging; permission-gated administrative actions; authentication regression testing; canonical production-domain/session consistency; onboarding entitlement and billing/trial-state validation; health/readiness endpoints; and a production-readiness security review before launch.

Outcome: A production-readiness security review covering authentication, tenant/access boundaries, secrets handling, webhook verification, and logging was completed ahead of launch -- treated as a pre-launch gate, not a post-incident fix.

IgboNest

Independent, mobile-first Igbo-language learning application in development, built with Expo, React Native, and TypeScript (Expo Router). Amalachukwu is the primary product owner and builder. Functionality includes authentication and onboarding, child/user profile separation where relevant, structured lesson flows, progression (XP, hearts, coins, streaks), learning worlds/missions, and a settings/profile area, all designed mobile-first. Security design: secure authentication with email verification, profile/user separation, controlled data access, and secure-by-design account flows, built on a Supabase authentication/database/storage architecture with PostgreSQL migrations where applicable and backend/database access considerations designed in from the start rather than retrofitted.