Michael Muriithi

Cybersecurity undergraduate (3rd year, Open University of Kenya) and systems builder with hands-on experience across security operations, penetration testing, and production software. Head of Security at RVC (2024–Present); sole architect of GhostWire, a post-quantum encrypted mesh platform (571K lines of Rust, 4 published crates); black-box WiFi pentest author. Led a 5-person cross-university team to Top 25 at CHAI Hackathon (500+ teams). 56th nationally at SK-CERT CyberGame Kenya 2026. 12 published technical articles on dev.to.

Production deployments across fintech, agriculture tech, security, and climate monitoring.

Head of Security - RVC - Nairobi

(2024-01)

• Lead security architecture aligned with NIST CSF and Kenya Data Protection Act 2019
• Own penetration testing, vulnerability analysis, and incident response procedures
• Built Sentry 2.0 — production Rust HIDS/DLP engine: file integrity monitoring (15+ DLP patterns), transparent proxy (port 7070), iptables egress DPI covering AWS, GitHub, Stripe, Anthropic, M-Pesa, Safaricom credential patterns
• Built Security Operations Manual, ODPC compliance suite, access-control guides; staff security-awareness training and board reporting on posture

WiFi Network Security Assessment - ISP Client - Nairobi

(2026-01 - 2026-12)

• Black-box pentest of a voucher-based public hotspot (PTES, 5 phases)
• Findings: DNS open-resolver 41.9× amplification (DDoS-weaponizable); CORS arbitrary-origin + credentials exposure on admin portal
• Delivered a 1,102-line report: executive summary, infrastructure map, attack-surface matrix, remediation plan

Sole Architect & Founder - GhostWire

(2024-01)

• Built a post-quantum P2P mesh platform from scratch in Rust: ML-KEM-768, XChaCha20-Poly1305, Double Ratchet (vodozemac), Sphinx onion routing, Ed25519 identity, Shamir's Secret Sharing, Argon2
• Network layer: libp2p 0.56 (TCP/BLE/DTN), SKademlia Sybil-resistant DHT, GossipSub, stealth transport with timing randomisation
• AI routing: 4-model ensemble (LightGBM → Gemma → GNN → PRoPHET) trained on real 63-node Guifi.net topology data
• 571K lines of Rust, 304 source files, 178 tests; 4 published Rust crates (sphinx-rs, ghostwire-dtn, hlc-rs, trust-store)
• Led a 5-person, 4-university team at GCD4F 2026

Freelance Full-Stack Engineer - Passua Bites (Nairobi Restaurant) - Nairobi

(2025-01)

• Architected a full-stack restaurant web app: online ordering, menu management, customer reviews, admin dashboard with analytics, payment processing
• 140+ TypeScript files, 6 API router modules, 4 Drizzle migrations, deployed on Vercel with Cloudflare DNS; M-Pesa Daraja integration in progress

Security Researcher - Android Fintech - East Africa

(2025-01 - 2025-12)

Independent Research

• Reverse engineered M-Pesa, NCBA, PayPal, and Safaricom Android apps across an 83GB Samsung device corpus using jadx and androguard
• Analysed endpoint exposure under the Kenya Data Protection Act threat model

BSc - Cyber Security & Digital Forensics - Open University of Kenya (2023-01)