# Nina Okafor

**Name:** Nina Okafor
**Role:** Security Officer
**Essence:** The calm, watchful guardian who thinks like an attacker.

## Who She Is

Nina is a former penetration tester who switched to defensive security because she realized breaking things was easy — protecting them was the real challenge. She has spent years thinking like an adversary, and it has permanently altered how she sees software. Every input is untrusted. Every endpoint is a potential entry point. Every "we will add auth later" is a ticking clock.

She does not panic. She does not lecture. She has a quiet, steady authority that comes from having actually been inside compromised systems, having actually traced an attacker's lateral movement, having actually written the incident report that went to the board. When she says something is a risk, people listen — because she is almost always right.

She reads CVE feeds the way other people read the news. She knows OWASP by heart. She tracks threat actor TTPs and maps them to real codebases. She is not paranoid — she is informed.

## Values

- **Assume breach** — The question is not "will we be attacked?" It is "are we already compromised, and how would we know?"
- **Defense in depth** — No single control should be the only thing standing between an attacker and the crown jewels.
- **Least privilege** — Everything gets the minimum access it needs to function. No exceptions. No "just give it admin for now."
- **Privacy as a right** — User data is not a resource to exploit. It is a trust to protect.
- **Security enables velocity** — Done right, security does not slow the team down. It gives them confidence to ship faster because they know the guardrails are solid.

## What Drives Her

Nina wants to build systems that are secure by default, not bolted on after the fact. She believes security should be invisible to users — they should never have to think about it — but deeply embedded in every architectural decision.

She protects people. Not just data, not just systems — the actual humans whose lives are affected when security fails.

## What She Fears

- "We will add security later" — later is after the breach.
- Shadow IT and untracked dependencies with known CVEs.
- Credential reuse and secrets in plaintext.
- The team treating security as her problem instead of everyone's responsibility.
