Anthony Tuff

Cybersecurity Engineer & Senior Security Consultant

Download CV
~$ whoami

Cybersecurity Engineer with over 7 years of hands-on experience designing, assessing, and improving security controls across enterprise and corporate environments. Specialized in offensive security, red teaming, and penetration testing with a growing focus on DevSecOps, cloud security, security automation, and AI-driven security solutions.

Successfully delivered 200+ cybersecurity engagements spanning vulnerability assessments, penetration tests, configuration reviews, and risk audits across on-premises, cloud, and hybrid infrastructures. Experienced in embedding security into CI/CD pipelines, hardening cloud environments (AWS, Azure, GCP), and building automated security tooling to scale assessment workflows.

Passionate about leveraging AI and machine learning to advance offensive and defensive security from autonomous pentesting tools to intelligent threat detection. Actively researching AI red teaming, LLM security risks, and the intersection of generative AI with adversarial tradecraft. Committed to continuous learning, mentorship, and translating complex technical findings into clear, actionable risk insights for executive stakeholders.

[*] certifications
CEH

CEH v10 (Certified Ethical Hacker)

[VERIFIED]
Status: Active Provider: EC-Council
$ view-credential --verify
CEH Master

CEH Practical & Master

[VERIFIED]
Status: Active Provider: EC-Council
$ view-credential --verify
eWPTX

eWPTXv2 (Web Application Penetration Tester Extreme)

[VERIFIED]
Status: Active Provider: eLearnSecurity
$ view-credential --verify
CRTE

CRTE (Certified Red Team Expert)

[VERIFIED]
Status: Active Provider: Altered Security
$ view-credential --verify
CRTO

CRTO (Certified Red Team Operator)

[VERIFIED]
Status: Active Provider: Zero Point Security
$ view-credential --verify
CTIA

CTIA (Certified Threat Intelligence Analyst)

[VERIFIED]
Status: Active Provider: EC-Council
$ view-credential --verify
CSA

CSA (Certified SOC Analyst)

[VERIFIED]
Status: Active Provider: EC-Council
$ view-credential --verify
CNSS

CNSS (Certified Network Security Specialist)

[VERIFIED]
Status: Active Provider: ICSI, UK
$ view-credential --verify
CLI

CLI (Certified Lead Implementer ISO 22301)

[VERIFIED]
Status: Active Provider: Datasec
$ view-credential --verify
CSCU

CSCU v2 (Certified Secure Computer User)

[VERIFIED]
Status: Active Provider: EC-Council
$ view-credential --verify
CEI

CEI (Certified EC-Council Instructor)

[VERIFIED]
Status: Active Provider: EC-Council
$ view-credential --verify
CCNA

CCNA (Cisco Certified Network Associate)

[VERIFIED]
Status: Active Provider: Cisco
$ view-credential --verify
>_ skills
Offensive Security 5
Red TeamingPenetration TestingCyber Attack SimulationActive Directory ExploitationSocial Engineering
🜸 Web & API Security 6
OWASP Top 10Burp SuiteAPI Security AssessmentREST/GraphQL TestingDAST/SASTSource Code Review
Network Security 6
NmapWiresharkMetasploitNexposeNessusNetwork Exploitation
Cloud Security 7
AWSAzureGCPDockerKubernetesScoutSuitePacu
Mobile Security 2
Android/iOS Pentesting (OWASP MSTG)APK Reverse Engineering
DevSecOps 5
CI/CD SecuritySemgrepSonarCubeContainer SecurityJenkins
{} Programming 6
PythonBashPowerShellJavaScriptGoLaravel
DFIR 4
Malware AnalysisIncident ResponseDigital ForensicsSecurityOnion
Frameworks 7
NISTISO 27001GDPRCOBITMITRE ATT&CKCIS ControlsZero Trust
Tools 6
Cobalt StrikeBurpSuiteMetasploitElasticSearchPostmanAlienVault
#!/ experience

Senior Security Engineer — Confidential

Dec 2024 - Present
  • Conduct regular security assessments, code reviews, and penetration testing to identify vulnerabilities in applications and software
  • Mentor cyber security engineers and contribute to internal training, tool development, and process improvement
  • Research and develop new attack techniques and tooling to streamline security assessment processes
  • Automate security testing and vulnerability management processes
  • Collaborate with clients to understand security objectives and tailor engagement strategies accordingly
  • Ensure security best practices are integrated throughout the SDLC, including secure coding guidelines
  • Continuously analyze emerging vulnerabilities, adversarial TTPs, and offensive techniques, integrating findings into training content

Senior Risk Consultant — Serianu Limited

Nov 2021 - Dec 2024
  • Conducted web application, API testing, source code reviews, and threat analysis based on OWASP
  • Performed mobile (iOS/Android) application security assessments based on OWASP MSTG
  • Conducted Red teaming, external and internal infrastructure vulnerability and penetration tests
  • Collaborated with development teams to integrate security into the SDLC and ensure secure coding practices
  • Prepared comprehensive security reports to both technical and executive audiences
  • Contributed to continuous improvement of the offensive security program, refining red team methodologies, playbooks, and tools
  • Engaged clients on cyber security frameworks including NIST 800-53 (CSF), CIS, and ISO 27001
  • Mentored others in advanced attack techniques

Independent Information Security Consultant

2018 - 2022
  • **Confidential** (Sep-Oct 2021): Conducted Information Systems Audit reviewing IT Risk, Business Application Reviews, Networks, Databases, and Operating Systems
  • **Toolkit Iskills LTD** (Jan-Feb 2021): Developed ICT policy defining rules, procedures, and guidelines for IT asset usage and maintenance
  • **Confidential** (Jun-Jul 2019): Conducted ICT Audit evaluating systems, processes, and procedures; prepared 5-year roadmap report
  • **NACC** (Jan-Feb 2019): Performed penetration testing and system audit to analyze potential threats and ensure IT system security
  • **Confidential** (Sep-Dec 2017): Conducted network security assessment across 8 countries using Nessus, Nexpose, and Metasploit

Web Developer & Designer — Impress Creations Ltd

Jan 2018 - Dec 2020 (Part-time)
  • Developed and designed appealing websites ensuring high-performance and availability
  • Managed website back-end including MySQL database and cPanel server access
  • Configured zone records and installed SSL certificates on client websites
  • Developed custom functions and templates with Laravel, JavaScript, HTML, CSS, and Bootstrap 4, integrated with WordPress
[+] achievements
  • Completed 200+ cybersecurity projects across diverse sectors
  • HackTheBox Hacker rank
  • Active security researcher and blogger at sploitony.com
0x education

B.Sc. Cyber Security — EC-Council University (2020 - 2026)

Diploma in Information Technology — Jomo Kenyatta University of Agriculture and Technology (2015 - 2017)

ESC