msInformation security · SSCP · CISSP Candidate
Maryam Salawudeen secures the network and everything on it_
I hold the SSCP and eJPT and I'm studying for the CISSP. I've spent seven years working hands-on with networks, servers and applications, and now I want to work on the risk and architecture decisions that sit above them.
Open to roles
- Information Security Analyst
- IAM Analyst or Engineer
- GRC / Security Compliance Analyst
- Senior Systems Engineer (security-focused)
01 / Approach
How I think about security.
I organise the work around the six functions of the NIST Cybersecurity Framework. When something goes wrong, what I learn goes back into the policies at the start.
- 01
Govern
Write down the policies, who owns what, and how much risk is acceptable
- 02
Identify
Know what you have, where the data goes and who might want it
- 03
Protect
Give the fewest permissions that work and keep networks segmented
- 04
Detect
Keep logs, and send alerts someone will actually read
- 05
Respond
Contain it, find the root cause and keep people informed
- 06
Recover
Restore from backups you've tested, then update the plan
02 / CISSP domains
Where my work fits the CISSP.
I'm studying for the CISSP. For each of its eight domains, here's something I've already done, either at work or in my own apps.
-
D1
Security & Risk Management
- SSCP certified; postgraduate certificate in cybersecurity
- Written threat model for a multi-tenant e-commerce platform
- Built GRC Workbench: a risk register, control mapping and vendor risk tiering
-
D2
Asset Security
- Three apps that keep all user data on the device
- Uploaded images re-encoded to strip metadata such as GPS location
- Full data export and self-serve account deletion
-
D3
Security Architecture & Engineering
- Each store's data kept apart, with tests that try to reach another store's data
- Strict CSP with per-request nonces, HSTS and frame blocking
- Containers that run as a non-root user
-
D4
Communication & Network Security
- Cisco ASA/Firepower firewalls and multi-VLAN segmentation
- Cisco Layer 2/3 and Meraki switching, VPN and RADIUS
- Diagnosed traffic and connectivity issues with monitoring tools
-
D5
Identity & Access Management
- Account lifecycle and access reviews in Microsoft Entra ID and Active Directory
- Role-based permissions checked on the server; two-step sign-in for admins
- Row-level security locking each user's data to them
-
D6
Security Assessment & Testing
- eJPT certified in penetration testing
- Automated cross-tenant and cross-user access tests that must fail
- Automated test suites on every app I've shipped
-
D7
Security Operations
- Hardened and patched servers at both jobs
- Handled security incidents on a campus network
- Root-cause analysis across apps, systems and networks; tested backup and restore
-
D8
Software Development Security
- GitHub Actions CI and Docker on a shipped e-commerce platform
- Input escaping against XSS; schema validation of API input
- Signature-verified webhooks and server-side price checks
03 / Frameworks
Frameworks I know well.
These are the ones I use when I need auditors and managers working from the same plan as the engineers.
-
NIST
CSF 2.0 · SP 800-53 · RMF
CSF for organising a security programme, 800-53 when choosing controls, and the RMF for taking a system from categorisation to ongoing monitoring.
-
ISO
ISO/IEC 27001 & 27002
How an information security management system is scoped and run, from the risk assessment to the Statement of Applicability and the Annex A controls.
-
CIS
CIS Controls & Benchmarks
A practical starting point for hardening Windows Server, Linux and network devices, with the controls ranked by priority.
-
ATT&CK
MITRE ATT&CK
Checking detections against the techniques attackers really use, so the gaps show up.
-
PCI
PCI DSS
Keeping cardholder data safe, mostly by shrinking the scope, segmenting the network, and controlling and logging access.
-
SOC 2
SOC 2 Trust Services Criteria
What a service provider's auditor checks. GRC Workbench maps its controls to the SOC 2 security criteria alongside NIST and ISO.
-
Privacy
PIPEDA & GDPR
Collect less, ask for consent, and let people see and delete their data. Jobvoyant does this with a full data export and self-serve account deletion.
04 / Web apps
Apps I've built and launched.
I built these seven apps and run them in production. I planned the security for each one before I wrote any code.
05 / Experience
Where I've worked.
-
Jun 2022 to now
Systems Engineer
Process Fusion Inc. · Etobicoke, ON
- Configure, patch and troubleshoot Windows systems, applications and the infrastructure behind them in customer environments.
- Set up and remove user accounts and run access reviews in Microsoft Entra ID.
- Check configurations before a customer goes live, then support them afterwards.
- Track down root causes, whether the problem is in the app, the operating system, the network or the infrastructure.
- Deploy and maintain enterprise applications, and plan releases with the engineering and project teams.
- Write the implementation procedures and support docs, and look for steps we can automate.
-
Jan 2018 to Nov 2020
Network Engineer
Osun State Polytechnic · Iree, Nigeria
- Configured Cisco ASA/Firepower firewalls, Cisco Layer 2/3 switches and Meraki switches on a network split into VLANs.
- Managed Active Directory accounts as people joined, moved or left.
- Ran Group Policy, RADIUS, DHCP, DNS, file and print, SFTP and web services.
- Handled security incidents affecting users and systems on the network.
- Built, hardened, patched and monitored Windows, Linux and macOS servers, both physical and virtual.
- Fixed connectivity and traffic problems using network monitoring and diagnostic tools.
- Kept the documentation and standard procedures for network configurations and changes.
Certifications
- SSCP Systems Security Certified Practitioner
- eJPT eLearnSecurity Junior Penetration Tester
- CISSP Certified Information Systems Security Professional preparing
Education
- PG Cert Cybersecurity, George Brown College, Toronto
- BSc Electrical and Electronics Engineering, Obafemi Awolowo University
Training & competitions
- Jun 2021 Virtual SOC Analyst Prep workshop (12 hours), Cover6 Solutions
- Mar 2021 MetaCTF US Canada Cyber Security Supply Chain Challenge, Coding for Veterans, as part of a team
06 / Toolbelt
The tools I know best.
Identity & access
Microsoft Entra ID, Active Directory and Group Policy. I set up and remove accounts, run access reviews, and give people only the access their role needs.
Network security
Cisco ASA/Firepower firewalls, Cisco and Meraki switches, VLANs, VPN and RADIUS.
Risk & compliance
Risk assessments, risk registers, mapping controls to frameworks, vendor risk and policy reviews.
Security operations
Incident response, hardening and patching. When something breaks, I follow it from the network up to the app until I find the cause.
07 / What I bring
What I bring to a team.
-
Seven years hands-on
I've looked after the firewalls, servers and directories that security policies are written about. When someone proposes a control, I know what it takes to put it in place and keep it working.
-
Access handled carefully
I set up and remove accounts and run access reviews in Microsoft Entra ID, and I managed the Active Directory account lifecycle before that. Giving people only the access their role needs is part of my everyday work.
-
I find the root cause
I trace a problem through the app, the operating system and the network until I know what actually went wrong. Then I write it up, so the next person doesn't have to start from scratch.
-
Controls that map to frameworks
I can tie everyday controls to NIST, ISO 27001 and SOC 2, which helps engineers and auditors work from the same list. I built my GRC Workbench app around this.
08 / Contact