Looking for a job

BRANDON ORANGA

@brandonoranga

Application Security Engineer at Cynot Kenya who built APInspect, an OWASP API Security Top 10 scanner designed for CI/CD.

Kenya

Message

What I'm looking for

I’m seeking to embed security by design across Safaricom’s products before go-live.

At Savannah Informatics, I designed and ran security assurance for the live Slade360 healthtech platform, testing its application, infrastructure and APIs. I built APInspect, an API security scanner mapped to the OWASP API Security Top 10, and designed it as a CI/CD pipeline stage.

At Cynot Kenya, I test production systems and build Flutter mobile clients, bringing direct development experience to security fixes. At Safaricom PLC, I carried out penetration testing on live enterprise and customer-facing systems and turned findings into remediation recommendations for system owners.

Experience

Work history, roles, and key accomplishments

Current

Application Security Engineer and Flutter Developer

Current

Cynot Kenya

Oct 2025 - Present (1 year)

Conducted black-box and grey-box VAPT on production systems, assessed mobile apps and APIs, and applied security-by-design across Flutter and Node.js services.

Kali Linux Burp suite Postman Penetration Testing Vulnerability Assessment Flutter NodeJS REST APIs Threat Modeling CVSS OWASP Top 10

Cybersecurity Engineer

Savannah Informatics

Jun 2026 - Oct 2026 (4 months)

Delivered security assurance for a live healthtech EDI platform, including penetration testing, threat modelling, and security-gated CI/CD. Built an API security scanner and embedded security practices into development workflows.

Kali Linux Burp suite Postman OWASP Top 10 OWASP API Security Top 10 STRIDE Model ISO 27001 CIS Benchmarks Kenya Data Protection Act Kubernetes Kyverno CI CD Wazuh CrowdStrike Falcon Cloud Security Teleport EDR Container Security Threat Modeling

Security Consultant

Smect Consultants

Jan 2025 - Dec 2025 (11 months)

Delivered vulnerability assessments, penetration testing, and advisory work across industries, translating technical risk into actionable recommendations for non-technical stakeholders.

Vulnerability Assessment Penetration Testing Risk Communication Advisory

Cyber Security Engineer, Cyber Assurance

Safaricom PLC

May 2025 - Oct 2025 (5 months)

Performed penetration testing on live production systems, identified exploitable vulnerability chains, and provided remediation recommendations across application, network, and infrastructure layers.