Looking for a job

charles ngatia

@charlesngatia

Message

Cybersecurity engineer specializing in penetration testing, incident response, and threat intelligence.

Kenya

Message

What I'm looking for

I seek hands-on roles where I can lead threat detection and response, perform advanced offensive testing, and help embed DevSecOps practices while mentoring junior engineers.

I am a hands-on cybersecurity engineer with experience in penetration testing, threat modeling, incident response, and SIEM-driven monitoring. I leverage a Bachelor's in Information Technology and practical certifications (Ethical Hacking, Cyber Threat Management, DevSecOps) to identify and remediate critical vulnerabilities across web, mobile, API, and cloud environments.

My work includes offensive security testing for JourneyMentor and AfricaHackon, SOC analysis using Splunk and MITRE ATT&CK, and deploying defensive tooling such as pfSense and Suricata. I build playbooks, reduce incident dwell time, train junior engineers, and create repeatable secure-design processes that measurably improve security posture.

Experience

Work history, roles, and key accomplishments

Current

Cybersecurity Engineer

Current

Deloitte

Jun 2025 - Present (7 months)

Participated in breach response simulations and log analysis to identify suspicious user activity and support client remediation efforts during a cybersecurity engagement.

Log Analysis Incident Response Threat Hunting SIEM Forensics client support Risk Assessment

Current

Cybersecurity Engineer

Current

JourneyMentor

Jun 2025 - Present (7 months)

Performed threat modeling and security assessments for microservices, APIs, and cloud architectures, reducing post-deployment vulnerabilities by 40%+ and producing reusable threat modeling artifacts. Supported incident response activities and developed playbooks for ransomware, lateral movement, and data exfiltration.

Threat Modeling OWASP API Security Cloud Security Incident Response SIEM Playbook Development Linux

Current

Cybersecurity Engineer

Current

AfricaHackon

Jan 2024 - Present (2 years)

Conducted penetration tests finding 15+ critical vulnerabilities and deployed Splunk SIEM and pfSense/Suricata to reduce incident response time by 30% and block 70% of brute-force attacks. Trained junior engineers and automated security hardening for web infrastructure.

Penetration Testing Splunk PFsense Suricata Linux Nginx Bash Scripting Web Security WordPress

SOC Analyst

Forage

Nov 2024 - Dec 2024 (1 month)

Analyzed APT incidents using Splunk and MITRE ATT&CK, detected stealthy malware via CrowdStrike and PCAPs, and contained a ransomware simulation while scoring 95% on risk assessments.

Splunk Crowdstrike PCAP Ransomware Threat Intelligence

IT Support Specialist

Marge Communication Bureau

Nov 2017 - Aug 2024 (6 years 9 months)

Managed user accounts, endpoint protection, patching and firewall/VPN configurations for 100+ users, supported IT audits, and maintained continuity through monitoring, backups, and incident documentation.

Endpoint Protection Patch Management VPN Backup IT Support