OpeningLet’s talk
Johnson Nuviadenu on the beach at Woe at dusk, the lighthouse lit behind him
Johnson working late at his desk in Calgary, the skyline in the snow behind him
A phone showing an identity check beside a laptop dashboard on a desk at night
A research paper with handwritten notes and a laptop showing charts on a library desk at night

Security engineer. Founder. Researcher.

I make the cloudsafe to build on.

Senior Security Consultant and DevSecOps Engineer with over 10 years of combined experience securing cloud-native platforms, web applications, and critical digital infrastructure across Canada, the United States, the United Kingdom, and Ghana. Raised in Woe, a fishing town on Ghana’s Anlo coast. Working from Calgary and Accra.

Work with meSee the work

Cape St. Paul Lighthouse, Woe · 1901

01 / Selected work

Work you can measure.And trust.

IoT infrastructure, identity verification, web archiving and fintech. Four platforms, and the numbers that moved while I was on the team.

See the full record
01 / 04
W01DEC 2023 – AUG 2026

45→9 min

Deploy time

Identity verification · Proctoring · AWS

Integrity Advocate

Read the case study
W02NOV 2022 – MAY 2024

55→7 min

Pipeline run time

Web archiving · EKS · 50,000+ daily users

Pagefreezer

In the record
W03JAN 2021 – OCT 2022

10K→60K users

Concurrent users on Kubernetes

Fintech · Kubernetes · AWS

Neo Financial

In the record
W04NOV 2025 – NOW

IoT security

Pipelines, code review and cloud hardening

Oil and gas · IoT infrastructure · AWS

Mobiltex

In the record

02 / Where it starts

A lighthouse towntaught me the job.

I grew up in Woe, a fishing town on the strip of land between the Keta Lagoon and the Atlantic. On its shore stands the Cape St. Paul lighthouse, an open iron frame that has kept a light over the water since 1901. I try to build infrastructure the same way: well braced, and always on.

Fishing canoes and nets on the beach at Woe at first light, the lighthouse on the point
Woe, Anlo coast · first light5°49′ N · 0°58′ E

Security in the pipeline

Scans, policy checks and secret detection run on every change, so safety moves at the speed of the team.

See the pipeline

Evidence an auditor can use

Controls are monitored all the time, so SOC 2, ISO 27001 and GDPR reviews start from a record you already have.

See Afranta

Teams that can carry it

I document, train and hand over. More than 2,000 professionals have trained with me through JOMACS.

See the academy

03 / The pipeline

Commit, scan, ship.

Skip to ventures

From a committo a safe release.

Every change passes the same gates before it reaches production. This is the path I build, and the tools I use at each step.

01 / 03

Commit and review

Code lands with tests and a SonarQube quality gate. Reviewers focus on the logic while the checks cover the basics.

GitHub ActionsSonarQubeNode.jsTypeScript
See it in a case study
pipeline · mainRUNNING · COMMIT
  1. CheckoutGITHUB ACTIONS
  2. Build and unit testsNODE.JS
  3. Quality gateSONARQUBE
  4. Dependency scanSNYK
  5. Container image scanTRIVY
  6. Cloud findings checkAWS INSPECTOR
  7. Release gatePOLICY
  8. Plan and applyTERRAFORM
  9. DeployEKS · ECS
  10. Smoke testsSTAGING
  11. Dashboards and alertsGRAFANA
4 environmentsSandbox → production

Real results from pipelines I built: 55 to 7 minutes at Pagefreezer, and deploys from 45 to 9 minutes at Integrity Advocate.

04 / Ventures

Products I built,end to end.

Afranta, IDClear and ExamLense. I designed, built and run each one myself, from the architecture and the code to the cloud, the security and the go-to-market.

PRODUCT FILM · 0:24

01 / 03

Afranta · Compliance automation · 2026

Evidence meetsevery control.

SOC 2 · ISO 27001 · GDPR · HIPAA · Ghana Data Protection Act

Visit afranta.com

What I built

Continuous control monitoring, evidence collection, policy and risk modules, and an Audit Hub that gives auditors and regulators scoped access. Serverless on AWS, provisioned with Terraform and shipped through GitHub Actions, with security gates and penetration testing built into delivery.

A woman at a shop counter in Accra scanning her ID card on her phone● VERIFIED

REST API · SDK

document verified
face matched
risk clear

02 / 03

IDClear · Identity verification · 2025

Identity meetstrust.

Ghana · National ID · Face match · Fraud checks

Verification for onboarding and KYC in the Ghanaian market. It ships as a REST API, a React Native app, a Vue.js dashboard and a developer SDK, on AWS Lambda, DynamoDB, Rekognition, Textract and Bedrock.

Visit idclearapp.com

03 / 03

ExamLense · Online proctoring · 2024

Exams meetintegrity.

Universities · Exam bodies · Certification providers

Candidate identity checks, AI session monitoring and flagging, exam scheduling and reviewer dashboards, on a secure multi-tenant cloud built for busy exam days. Made for Africa, starting with Ghana.

Visit examlense.com
A student taking an online exam on a laptop at night, the webcam on● LIVE SESSION
Session timeline1 flag to review

Reviewer queue

Second person detected in frame. Clip saved for a reviewer.

Behind all three

JOMACS IT Solutions · Software company

Founder andManaging Director.

At JOMACS we build custom software for clients, and we stick around after launch to keep it updated, hosted and monitored. Afranta, IDClear and ExamLense are our own products.

Visit jomacsit.com

What JOMACS does

  • Product Engineering

    New web and mobile builds, with a working demo every two weeks.

  • Managed Services

    Updates, fixes, hosting and monitoring on a retainer.

  • Data and AI

    Data engineering, analytics and machine learning.

Offices · Calgary · Accra · Abuja

05 / What I do

Security that fits.Speed you keep.

Most engagements start with one of two needs: a faster, safer pipeline, or proof for an auditor. Everything else follows from there.

Security gates at every stage

Service / 01AWS · Kubernetes · CI/CD

DevSecOps and cloud security

Fast pipelines on hardened platforms.

Secure AWS foundations, CI/CD with security gates, Terraform for every environment, and observability that shortens incidents.

  • Pipeline security
  • Cloud hardening
  • Infrastructure as code
  • Observability
A field of dark blocks, each one a control, with one failing and one about to expire
Service / 02SOC 2 · ISO 27001 · GDPR

Compliance you can prove

Evidence before the auditor asks.

Gap assessments, control monitoring and audit support for SOC 2, ISO 27001, GDPR, HIPAA and Ghana’s Data Protection Act, using Drata, Carbide or Afranta.

  • Gap assessment
  • Control monitoring
  • Audit support

Both start with a short review of where you are today. Findings come ranked, with the fix for each one.

03

Application security

Penetration testing, secure code review and API testing against the OWASP Top 10, with each finding tracked until it is fixed.

04

Training and workshops

Hands-on DevSecOps, cloud security and full stack programmes for engineering teams, run through JOMACS.

05

Advisory and policy

Technical input on cybersecurity, data protection and AI policy for leadership teams and public institutions.

Certified · Security and compliance

COMPTIA SECURITYXCISA · ISACAAWS SECURITY · SPECIALTYCYBERSECURITY PROFESSIONAL · CSA GHANANVIDIA · BUILDING LLM APPLICATIONS

Certified · Cloud and infrastructure

AWS DEVOPS ENGINEER · PROFESSIONALAWS SOLUTIONS ARCHITECT · PROFESSIONALAWS SOLUTIONS ARCHITECT · ASSOCIATEAWS DEVELOPER · ASSOCIATEAWS SYSOPS ADMINISTRATOR · ASSOCIATEAWS DATA ENGINEER · ASSOCIATECKA · CNCF

06 / Research

Research thatreaches production.

PhD candidate in Computer Science at the University of South Africa, due in 2027. I study how machine learning and large language models can make deployments and cloud security more reliable, especially for public sector systems in Africa.

11 manuscripts · 3 published · 8 in progress

Scientific Reports

Nature Portfolio · 2026

SYNTHETIC, ANONYMISED LOGS

Journal article01

Overcoming the data desert

Generative AI techniques for synthesising anonymised deployment logs in regulated public sectors. With T. Masombuka, E. Mnkandla and M. Sibiya.

Read on ResearchGate
IN REVIEW

Framework04

The AutoDeploy framework

Machine learning that validates a deployment before it reaches production.

Manuscript in review
IN PREPARATION

Benchmark05

Quantised LLMs for DevOps

Local, quantised model inference compared with cloud GPUs for government DevOps workloads.

Manuscript in preparation

07 / The record

Ten years.Four countries.

From a bank in Accra to teams in Calgary, Vancouver, Toronto, New York and London. Every role, contract and classroom in one place.

Consulting / Advisory

Advisory work.Same standards.

Engagements that run alongside my own products, from IoT security to a government regulator.

Explore the record

01–04 / 08
C012025 – NOW

IoT infrastructure security

Mobiltex

Senior DevSecOps Consultant

C022024 – NOW

Technology and privacy law

Oaks Legal

Technology Security Consultant

C032025 – 2026

Gaming technology

RealmForge Games

Lead of DevSecOps

C042025

Government of Ghana

Traditional Medicine Practice Council

Senior Technology Consultant

C052022 – 2024

International money transfer

Taptap Send

Senior Fraud and Compliance Consultant

C06VIA JOMACS

Public sector

Government of Alberta

DevSecOps improvements

C07VIA JOMACS

Media

Canadian Broadcasting Corporation

Cloud infrastructure consulting

C08VIA JOMACS

Banking technology

SAS Ghana

Legacy systems migration and security

Community / Teaching

Teaching, policyand home.

Training engineers, shaping technology policy and giving back to the town that raised me.

Johnson teaching a small class of professionals
A01SINCE 2022

Teaching

JOMACS IT Academy

More than 2,000 professionals trained in DevSecOps, cloud security, full stack development and data.

learn.jomacsit.com
Johnson speaking on a technology policy panel
A022026 – NOW

Policy

ACTPOL

Vice President for Technology and Innovation at the Africa Centre for Technology Policy and Law.

actpol.org
A community meeting under a shade tree in Woe at sunset
A03WOE, VOLTA REGION

Home

Woe Duanenyo

Bringing people from Woe, at home and abroad, together to invest in the town’s development.

Education

PhD, Computer ScienceUniversity of South Africa
2027
MSc, Applied EconomicsUniversity of Strathclyde, Glasgow
BA, Mathematics and EconomicsUniversity of Ghana, Legon
Secondary schoolSt. Martin’s Secondary School, Adoagyiri-Nsawam

Earlier roles

Cloud Infrastructure EngineerFreshly, New York, remote · 20+ microservices moved to Kubernetes, 25% lower cloud spend
2018–2020
Linux Systems AdministratorGN Bank, Accra · 200+ servers secured, 80% virtualised
2015–2018
National ServiceDriver and Vehicle Licensing Authority, Ho
2015–2016

08 / Working together

What your platform needs.What I deliver.

01

Listen

Your stack, your risks, your deadlines, and what an auditor or customer is asking for.

02

Review

Architecture, pipelines and cloud accounts checked against real threats and the frameworks you need.

03

Build

Security gates, hardened infrastructure, monitoring and evidence, delivered in agreed stages.

04

Hand over

Runbooks, documentation and training, so your team can run it without me.

Selected teams

Trust, builtrelease after release.

Teams I have worked with as an engineer, a lead or a consultant.

Integrity AdvocatePagefreezerNeo FinancialFreshlyGN BankMobiltexOaks LegalRealmForge GamesTaptap SendGovernment of AlbertaCBCSAS Ghana

Canada · United States · United Kingdom · Ghana · Remote and on site

09 / Before we begin

Clarityto decide.

Where are you based?

Calgary, Alberta and Accra, Ghana. I work with teams across Canada, the United States, the United Kingdom and Africa, mostly remotely.

What kind of work do you take on?

Cloud security on AWS, DevSecOps pipelines, compliance programmes for SOC 2, ISO 27001, GDPR and Ghana’s Data Protection Act, and application security testing.

Can you train my team?

Yes. Through JOMACS I run hands-on programmes in DevSecOps, cloud security and full stack development. More than 2,000 professionals have trained with us.

What is the first step?

Send a short note about your platform and what you need. We start with a call to understand where things stand, then agree on scope and stages.

10 / Let’s talk

Your next releasestarts with a review.

Tell me where your platform stands and what you need to prove. I will come back with a suggested scope and next steps.

  • Security built into delivery from the first commit
  • Scope and stages agreed before work begins
  • Documentation and training your team keeps
Johnson Nuviadenu

Prefer email? It comes straight to me.

johnson@jomacsit.com

Johnson Nuviadenu · Calgary and Accra

New engagement / jnuviadenu.com

Tell me what you’re building.

Platform, stage and timing. Start with what you already know.

Your details are only used to reply to you. Privacy