Backend software engineer with a cybersecurity foundation. I specialize in building resilient, transaction-heavy distributed systems, automated defense tooling, and cryptographically sound backend architectures.
- Backend Engineering: Async Python (
FastAPI,Starlette), RESTful API architecture, pessimistic concurrency locking, double-entry financial ledger invariants, task queues (Celery), distributed caching (Redis). - Application & Network Security: OWASP Top 10 mitigation, RFC 6238 TOTP MFA, RBAC route guards, sliding-window rate limiting, intrusion detection systems (IDS), OS-level firewall automation (
iptables,ufw,netsh). - DevSecOps & Cloud: Docker containerization, Docker Compose orchestration, automated CI/CD pipelines (
GitHub Actions), Linux system administration, structured audit logging.
| Domain | Technologies & Frameworks |
|---|---|
| Languages | Python 3.10+, SQL, Bash / Shell |
| Frameworks & Libs | FastAPI, Pydantic v2, SQLAlchemy 2.0 (Async), Celery, ReportLab, Paramiko |
| Databases & Caches | PostgreSQL, Redis, SQLite (aiosqlite), Alembic |
| Security & Auth | PyJWT (Token Rotation), PyOTP (MFA/TOTP), Bcrypt, SlowAPI, MITRE ATT&CK |
| DevOps & Testing | Docker, Docker Compose, GitHub Actions (CI/CD), pytest, pytest-asyncio, Git |
1. LogSentinel — Autonomous Real-Time Log IDS & Active Firewall Daemon
Autonomous host-based intrusion prevention daemon with zero third-party dependencies.
- Real-Time Log Stream Analysis: Tails Nginx and Apache HTTP access logs using high-performance regex signatures to detect SQLi, XSS, Path Traversal, and RCE attacks on the fly.
- Sliding-Window Rate Limiting: Tracks per-IP infraction velocity using stateful memory buffers and isolates brute-force/recon sweeps.
- Active Firewall Enforcement: Triggers automated OS-level IP bans via
iptables,ufw, and Windowsnetshwith automated whitelisting and dry-run safety modes. - Cross-Platform CI: Automated cross-platform test matrix across Ubuntu, Windows, and macOS with 100% test pass rates.
Python (stdlib)·iptables·ufw·netsh·GitHub Actions CI·MIT License
2. FinTech Multi-Currency Ledger — Production-Grade Double-Entry System
High-throughput financial ledger handling multi-currency wallets with strict mathematical invariants.
-
Double-Entry Accounting Engine: Implements balanced immutable journal entries with FX clearing accounts (
$\sum \text{Debits} = \sum \text{Credits}$ ). -
Concurrency & Double-Spend Defense: Row-level pessimistic locking (
with_for_update) prevents race conditions, negative balances, and duplicate withdrawals. - Real-Time FX Caching: Live currency conversion engine (GHS / USD / GBP) backed by Redis caching and 60-second rate lock guarantees.
- Asynchronous Statement Worker: Celery task queue compiling branded, bank-grade PDF transaction statements via ReportLab.
-
FastAPI·PostgreSQL·Redis·Celery·ReportLab·Docker Compose·pytest
3. HoneyGuard — Multi-Service Honeypot & SOC Telemetry Sentinel
Deliberate low-interaction SSH and HTTP decoy sensors feeding real-time threat intelligence.
- Multi-Vector Decoy Services: Simulates vulnerable OpenSSH services and decoy HTTP endpoints (
.env,wp-login.php,admin). - Threat Intelligence & MITRE ATT&CK: Extracts IoCs (default credential probing, malware drop commands, Log4j/Spring4Shell payloads) and maps them directly to MITRE tactics.
- Real-Time SOC Dashboard: FastAPI WebSocket dashboard streaming live attack feeds with GeoIP location mapping and Discord/Slack webhook alerts.
Python·FastAPI·Paramiko·GeoIP·WebSockets·pytest
4. SecureAuth Backend API — Enterprise Auth & Authorization Engine
Reusable, hardened authentication and authorization microservice following NIST and OWASP standards.
- Multi-Factor Authentication (MFA): RFC 6238 TOTP authenticator integration with SVG/PNG QR code generation and single-use emergency recovery codes.
- Granular RBAC: Declarative route guards (
RequirePermission,RequireRole) enforcing the Principle of Least Privilege and hierarchical escalation protection. - Token Security: Short-lived JWT access tokens with single-use refresh token rotation and automatic family revocation upon replay attack detection.
- Rate-Limiting: Sliding-window rate limiters defending against credential stuffing and brute-force attacks.
FastAPI·SQLAlchemy Async·PyJWT·PyOTP·Bcrypt·SlowAPI·pytest
- Email: kelvinamarteywinston@gmail.com
- LinkedIn: Kelvin Amartey Winston
- Location: Accra, Ghana (Available for remote roles worldwide)