IDENTITY INVENTORY
Build a trustworthy view of users, guests, privileged roles and workload identities.
CLOUD SECURITY • IAM ENGINEERING • FOUNDER • AUTHOR
I secure cloud identities.
I build what I believe security needs.
I’m Kafayat “Kaffy” Faniran. I work across cloud security and IAM engineering, build practical security products, publish what I learn, and turn technical security into evidence people can understand and trust.
Entra ID & IAMThe Cloud Forge • LiveAuthorHUMAN FIREWALL • Live
IAM ENGINEERINGEntra ID • PIM • GraphIdentity governance in practice
FOUNDERThe Cloud ForgeLive hands-on security platform
10,500+LinkedIn followers
2,500+Newsletter subscribers
7Flagship security projects
FounderThe Cloud Forge
AuthorCybersecurity book
WHAT I’M DOING NOW
My work is moving from ideas to things you can use.
I’m building in public through products, technical projects, education and writing. These are three of the clearest examples of what I’ve shipped recently.
IAM ENGINEERING
Identity is where I go deep.
I approach IAM as an engineering problem, not a checklist. Who has access? Why? For how long? Through which path? What happens when access changes? And what evidence proves the decision was enforced?
identity-governance / evidence
$ scope: Microsoft Entra ID✓ identity inventory✓ stale-user analysis✓ guest governance✓ privileged-role review✓ direct Azure RBAC analysis✓ workload identity inventory→ Conditional Access • PIM • Access ReviewsPRIVILEGED ACCESS
Design around least privilege, PIM, eligibility, activation controls and auditable administrative access.
CONDITIONAL ACCESS
Translate identity risk into enforceable access conditions, rollout logic and validation evidence.
ACCESS REVIEWS
Turn access governance into repeatable decisions with ownership, evidence and remediation.
AZURE RBAC
Identify direct assignments, review scope and reduce unnecessary standing access.
GRAPH AUTOMATION
Use Microsoft Graph PowerShell to collect identity evidence and surface governance risks at scale.
FLAGSHIP SECURITY ENGINEERING
Evidence before claims.
Seven technical projects spanning IAM governance, detection engineering, infrastructure as code, secure product architecture and multi-cloud security. Each case study separates what I built from what I have validated.
IDENTITY
RBAC
CA
PIM
REVIEWS
Azure IAM Governance Lab
Enterprise identity governance with Microsoft Graph PowerShell evidence collectors, stale access analysis, guest governance, Azure RBAC, Conditional Access, PIM, access reviews and workload identities.
Entra IDGraph PowerShellRBACPIMAccess Reviews
Explore my IAM engineering case study ↗SigninLogs
| where ResultType == "50126"
| summarize FailedAttempts=count()SENTINEL • KQL
Microsoft Sentinel SOC & Threat Detection
Detection engineering, evidence standards and incident investigation built around Microsoft Sentinel and Entra ID telemetry.
Microsoft SentinelEntra IDKQLIncident Response
Read technical case study ↗terraform validate
cloudtrail = enabled
flow_logs = enabled
access_analyzer = enabledAWS • TERRAFORM
AWS Cloud Security Engineering
Cost-conscious AWS reference architecture with segmented networking, audit logging, KMS protection, IAM assurance and a control-validation programme.
AWSTerraformCloudTrailKMS
View AWS case study ↗terraform validate
vpc_flow_logs = enabled
service_account_keys = none
audit_archive = KMS protectedGCP • KEYLESS IAM
Google Cloud Security Engineering
Google Cloud reference environment combining keyless IAM, segmented networking, Cloud Audit Logs, VPC Flow Logs and KMS-protected evidence storage.
Google CloudTerraformCloud LoggingWorkload Identity
View Google Cloud case study ↗detections/azure/AZ-001
detections/aws/AWS-001
detections/gcp/GCP-001
status: implementedMITRE • SIGMA
Cloud Security Detection as Code
Reusable Azure, AWS and Google Cloud detections with a common metadata contract, ATT&CK mapping, CI quality gates and explicit validation states.
AzureAWSGCPMITRE ATT&CK
Explore Detection as Code ↗AI BOUNDARYPAYMENTSEVIDENCERLS + SECURITY
CF
Cloud Forge Security Architecture
Public, sanitised SaaS security architecture for my live product, covering RLS, evidence ownership, AI boundaries, secrets, payments, logging, CI/CD and recovery.
Next.jsSupabasePostgreSQLAI Security
View founder security case study ↗Content-Security-Policy
Strict-Transport-Security
X-Frame-Options: DENY
Permissions-PolicyNEXT.JS • VERCEL
Secure Portfolio Engineering
The engineering behind this live portfolio, including CSP, HSTS, browser-security headers, privacy-conscious evidence presentation and automated deployment.
Next.jsTypeScriptCSPVercel
Inspect the portfolio case study ↗HOW I WORK
I connect identity, cloud controls, detection and evidence.
IAM Engineering
Microsoft Entra ID, Azure RBAC, PIM, Conditional Access, access reviews, guest governance, workload identities and Microsoft Graph PowerShell automation.
Detection & Response
Microsoft Sentinel, KQL, centralised logging, threat detection, incident triage, investigation and evidence-led response.
Cloud Security Engineering
AWS, Microsoft Azure and Google Cloud hardening, segmentation, encryption, Terraform, secure architecture and attack-surface reduction.
Governance & Assurance
NIST CSF, CIS Benchmarks, ISO 27001, SOC 2, PCI DSS, risk assessment, audit readiness and defensible evidence collection.
MY HANDS-ON FOUNDER STARTUP
The Cloud Forge is live.
I built The Cloud Forge around a problem I care about deeply: cloud security learners need more than content. They need realistic work, guided practice, assessment, evidence and a clearer route from learning to demonstrating capability.
LEARN→BUILD→DOCUMENT→DEMONSTRATE
LIVE PRODUCT
THE
CLOUD
FORGE
CLOUD
FORGE
AI-guided missionsAssessment enginePortfolio evidenceIAM & cloud security learning
ANOTHER PRODUCT I JUST LAUNCHED
HUMAN FIREWALL
A scenario-based Employee Cybersecurity Awareness Simulation Game designed to make people practise the judgement attackers try to exploit.
URGENCYAUTHORITYTRUSTIMPERSONATIONCURIOSITY
Play the game ↗PROFESSIONAL CREDENTIALS
Structured learning, applied through real projects.
Credentials strengthen my foundation. My portfolio shows how I turn that learning into IAM engineering, cloud controls, detections, products and evidence.
Cybersecurity Architecture Specialist
IBM
Professional CertificateDiploma in Cybersecurity
AltSchool Africa
12-month programmeCybersecurity Programme
ALX
CompletedGoogle Cloud Cybersecurity Professional Certificate
Google Skills Boost
Professional CertificateGoogle Cybersecurity Professional Certificate
AWS Certified Cloud Practitioner
Amazon Web Services
Cloud certificationMicrosoft Certified: Azure Fundamentals
Microsoft
AZ-900Cybersecurity Bootcamp
Zero To Mastery
CompletedWRITING & PUBLIC EDUCATION
I build, write and teach around the work I want to move forward.
My public work lets me turn technical practice into useful resources for engineers, learners, founders and business leaders.
BOOK • PUBLISHED
Think Like a Cloud Security Engineer
My first cybersecurity book, focused on practical cloud security judgement and problem-solving.
Get the book ↗NEWSLETTER
CEO Cloud Security Memo
Cloud security, resilience, IAM and cyber risk translated into practical guidance for business leaders.
2,500+ subscribersTECHNICAL EDUCATION
Cloud Beginners
Practical cloud and cybersecurity education focused on clarity, employability and real-world application.
www.cloudbeginners.info ↗CYBERSECURITY AWARENESS COMPANY
The Kaffy Cyber Consulting
My cybersecurity awareness company, focused on practical employee security behaviour, phishing defence, privacy and secure-work habits.
thekaffycyberconsulting.com ↗SIMULATION GAME
HUMAN FIREWALL
A scenario-based Employee Cybersecurity Awareness Simulation Game built to turn awareness into active decision-making practice.
Play HUMAN FIREWALL ↗WORK WITH ME
If you need cloud security depth, IAM thinking and someone who actually builds, I’d like to talk.
I’m open to cloud security and IAM engineering opportunities, technical collaborations, speaking, cybersecurity education and product partnerships.
Start a conversation ↗