John Oyetunji

Senior Offensive Security Engineer with over 8 years of experience across offensive security, application security, cloud security, DevSecOps, vulnerability management, threat detection, security automation, and compliance. Experienced in securing cloud-native and enterprise environments, conducting penetration testing and red-team operations, implementing security controls across SDLC and CI/CD pipelines, and developing AI/ML-driven security solutions. Strong expertise across AWS, Azure, SIEM, SOAR, EDR/XDR, API security, vulnerability management, threat modeling, and security automation.

Demonstrated ability to use Python, machine learning, real-time analytics, and security orchestration to automate security processes, improve vulnerability prioritization, detect anomalous activity, and accelerate remediation.

Systems Development Engineer at FINRA (2025-08 – Present)

• Support cross-functional teams with network engineering requirements, including ACL configuration, VLAN creation, network diagrams, and connectivity optimization.
• Conduct secure code reviews to ensure adherence to secure coding practices and architectural guidelines.
• Collaborate with software development teams during planning sessions to align technical objectives with business requirements and Agile practices.
• Reduce security-tool false positives through rule tuning and contextual suppression, while providing actionable findings and pull-request feedback to accelerate remediation.
• Develop security dashboards and reports for tracking risk, vulnerabilities, and compliance.
• Manage and deploy software development packages while supporting secure integration into production environments.
• Design, implement, and maintain network infrastructure supporting scalable robotics systems with emphasis on low latency and high reliability.
• Fine-tune transformer models using internal vulnerability data to triage CI/CD security scan results, reducing manual review time by 75% and increasing developer adoption to 70%.
• Integrate AI-based anomaly detection into robotics network monitoring to identify irregular traffic patterns and support availability improvements.
• Collaborate with DevSecOps teams to integrate security controls into the software development lifecycle without unnecessarily influencing development velocity.
• Apply machine-learning models to identify potential system bottlenecks and support proactive performance optimization.
• Configure and tune security scans and develop custom query sets for automated security analysis.
• Integrate Checkmarx into CI/CD pipelines for automated pre-merge security scanning.
• Combine EPSS risk scores with LightGBM models to reprioritize CVE backlogs, accelerating high-risk patching by 40%.
• Mentor junior engineers on network configuration, secure coding, and software development practices.
• Develop technical documentation, including network diagrams, API integration guides, and operational runbooks.
• Lead post-implementation reviews to identify opportunities for security and system-efficiency improvements.

Lead Offensive Security Engineer at Trusight (2021-06 – 2024-07)

• Led red-team operations and adversary simulations to identify weaknesses and improve enterprise security defenses.
• Developed and implemented an offensive security program that reduced critical vulnerabilities by 90%.
• Conducted advanced penetration testing across web applications, mobile applications, APIs, and cloud environments.
• Performed threat modeling to identify potential API attack vectors and security weaknesses.
• Automated API security testing to continuously identify vulnerabilities throughout the development lifecycle.
• Applied machine-learning-driven fuzzing techniques to uncover previously unidentified API vulnerabilities.
• Implemented automated security testing within CI/CD pipelines, reducing vulnerability detection time by 60%.
• Used Varonis Data Classification to identify and categorize sensitive information and support appropriate security controls.
• Implemented Varonis Access Governance to monitor and manage access to sensitive data and support least-privilege principles.
• Performed software composition analysis to identify open-source vulnerabilities and license risks.
• Generated SBOMs and implemented policy-based blocking for high-risk software components.
• Conducted vulnerability assessments, risk analysis, penetration testing, and web application security assessments.
• Designed and implemented next-generation firewall solutions to strengthen network security.
• Configured and managed IDS/IPS technologies to improve threat detection and response.
• Implemented SIEM capabilities and developed security use cases and detection rules.
• Applied AI-driven behavioral analytics within SIEM environments to identify potential insider threats and sophisticated attack patterns.
• Researched and applied adversarial machine-learning concepts to evaluate the resilience of AI-powered security tools.
• Supported compliance assessments and collaborated with external auditors.
• Helped ensure alignment with GDPR and CCPA requirements.
• Developed incident response plans and security policies in collaboration with clients and stakeholders.
• Documented API security best practices, standards, and policies.

Senior Cybersecurity Engineer at Florida Blue (2020-01 – 2021-05)

• Collaborated with incident response teams to contain and remediate security incidents while minimizing operational disruption and potential data loss.
• Monitored security events, analyzed threats, and supported incident response activities.
• Participated in simulated attacks to identify vulnerabilities and strengthen defensive controls.
• Supported security engineering activities including secure code reviews and configuration hardening.
• Rotated across Blue Team, Red Team, GRC, and Security Engineering functions, gaining broad exposure to enterprise cybersecurity operations.
• Conducted penetration testing and vulnerability assessments to identify and remediate security weaknesses.
• Developed and delivered security awareness guidance to developers and stakeholders covering API security best practices.
• Created an AI-based threat-hunting assistant capable of processing streaming telemetry and generating indicators of compromise for emerging threats.
• Documented API security standards, practices, and policies.
• Designed and implemented cloud security solutions across AWS and Azure.
• Implemented cloud security monitoring and logging to strengthen threat detection and incident response.
• Supported compliance requirements aligned with CIS and PCI-DSS.

Application Security Consultant at VMware (2018-05 – 2019-12)

• Provided cybersecurity consulting services to clients across healthcare, finance, retail, and other industries.
• Conducted security assessments and risk analyses to identify, prioritize, and remediate security vulnerabilities.
• Developed cybersecurity strategies and incident response plans aligned with client requirements.
• Provided offensive security consulting services across multiple industries.
• Conducted penetration testing and vulnerability assessments.
• Developed and maintained vulnerability management programs focused on timely remediation.
• Performed web application security testing and identified application-level vulnerabilities.
• Developed penetration-testing plans aligned with OWASP practices.
• Supported application development and security improvements through React development and application enhancements.
• Developed new React components and enhanced existing components to improve application usability and presentation.
• Implemented application features designed to improve user engagement and retention.
• Integrated Google Maps functionality to support real-time location tracking.
• Optimized application performance using Redux for state management.

Bachelor's Degree – Federal University of Technology (2010)