John Musyoki

Cyber Security Consultant

I assess and harden systems, run vulnerability assessments and penetration tests, and turn findings into fixes teams can actually ship.

See my experience Get in touch
John Musyoki, Cyber Security Consultant

What I do

Vulnerability assessment

Black-box and white-box testing across web, API, network and mobile targets, with findings ranked by business risk rather than scanner severity.

Security advisory

IT audit, control reviews and governance work, including ISO 27001, PCI DSS and data protection compliance.

Incident response

Containment, evidence preservation, root-cause analysis and post-incident hardening.

Experience

Cyber Security Consultant

2023 — present

Advisory · Vulnerability assessment · Incident response

  • Deliver vulnerability assessment and penetration testing engagements across web applications, APIs, infrastructure and mobile platforms.
  • Run IT audit and control assessments covering information security governance, risk and compliance.
  • Advise stakeholders on remediation, prioritising findings by business risk rather than scanner severity alone.
  • Support incident response: scoping, containment, evidence preservation and post-incident review.
  • Prepare and support technical proposals for external audit and penetration testing engagements.

Security Community Lead & Mentor

Ongoing

Students · Community · Hands-on mentoring

  • Lead a student security community, running hands-on sessions and practical workshops for early-career practitioners.
  • Mentor more than 100 students from introductory through intermediate security topics, including vulnerability assessment.
  • Build structured learning material and lab exercises so students practise on real systems rather than slides.

Skills

Offensive security

  • Vulnerability assessment & penetration testing
  • Web, API, network and mobile testing
  • OWASP Top 10 and ASVS
  • Burp Suite, Nmap, Metasploit, sqlmap

Defensive & advisory

  • IT audit and control assessment
  • ISO 27001, PCI DSS, data protection
  • Risk and compliance advisory
  • Incident response and security governance

Practice

  • Technical report writing
  • Client and stakeholder communication
  • Mentoring and teaching
  • Team leadership and problem solving

Common questions

What does a vulnerability assessment cover?

Testing across web applications, APIs, network infrastructure and mobile platforms, using both black-box and white-box methods. Findings are ranked by business risk rather than raw scanner severity, so the report leads with what actually matters to the system owner.

Do you provide penetration testing services in Kenya?

Yes. The service covers web, API, network and mobile targets, mapped to OWASP Top 10 and OWASP ASVS, and delivered with a remediation-focused report and stakeholder walkthrough.

Can you help with ISO 27001 or PCI DSS compliance?

Yes. That work sits under security advisory: IT audit and control assessment, information security governance, and risk and compliance advisory across ISO 27001, PCI DSS and data protection obligations.

What happens during an incident response engagement?

Four stages: scoping and containment, evidence preservation, root-cause analysis, and post-incident hardening so the same path is harder to walk a second time.

Where are you based and what work do you take on?

Based in Nairobi, Kenya. The focus is security advisory, vulnerability assessment and penetration testing work.

Get in touch

Available for security advisory, vulnerability assessment and penetration testing work. If something needs assessing, I’m happy to talk.

Email jhnmusyoki@gmail.com LinkedIn /in/john-musyoki GitHub @Johnie-Musyoki X @johnie_musyoki
Location Nairobi, Kenya