TOKEN  LLC

Security engineering · Governance, risk & compliance

Olanrewaju David Kehinde

Thirteen years spent walking toward the same question. Not whether the system is up, but who touched this record, when, from where, and whether you can prove it. I build the controls that produce the proof, and the evidence that survives the assessor.

Read the ledger Get in touch
SUBJECT TOKEN active
subject

Olanrewaju David Kehinde

entity

Token LLC

clearance

Tier 3 (T3), active. Eligible for VA Public Trust.

posture

CMMC · RMF · detection engineering · cloud security

head

Career ledger

Five records.
Each one hashed into the next.

A tamper-evident log is a chain. Every entry carries the digest of the entry before it, so you cannot quietly rewrite history without breaking every link that follows. My career reads the same way: each role is the input to the next one.

The digests below are recomputed in your browser with SHA-256 over the text you can actually see. Open devtools, change a word, run it again.

idle
RECORD 0001 2012 – 2019 pending
role

Database engineer

action

Oracle, MySQL and SQL Server estates, including the FDA program in Rockville, Maryland.

evidence

Data Guard standbys and Always On availability groups for availability. Backup validation and documented restore tests for integrity. Least-privilege grants, encryption at rest, and masking of sensitive fields before any production clone reached a lower environment. The CIA triad, lived daily from inside the data layer.

prev
sha256
RECORD 0002 2019 – 2020 pending
role

DevOps engineer

action

Automating the path from commit to production.

evidence

Infrastructure as code, pipeline build-out, and configuration management across Linux estates. This is where I learned what a control costs a delivery team when it arrives as a review meeting instead of a step in the workflow. Security that cannot keep pace with provisioning is security that gets routed around.

prev
sha256
RECORD 0003 2020 – 2023 pending
role

SIEM engineer

action

Splunk at federal scale, run as a security instrument rather than a monitoring product.

evidence

Enterprise Security with risk-based alerting and correlation searches. Asset and identity frameworks, CIM normalization, encryption across the full ingestion pipeline, PII and PCI masked at index time, and RBAC enforced through LDAP scripted authentication. It started with streaming database audit telemetry through DB Connect, so security and operations could finally see the data layer in the same pane as everything else.

prev
sha256
RECORD 0004 2023 – 2025 pending
role

DevSecOps engineer

action

Hardening cloud and container estates with the logs already in hand.

evidence

AWS across EC2, IAM, VPC, S3, ECR and OpenSearch. Azure across resource provisioning, Key Vault, storage accounts and Databricks. Kubernetes hardening to CKS standard, secure workspace provisioning, cluster policies and data lake access controls. Vulnerability identification, analysis and remediation across RHEL, Ubuntu, UNIX, VMware and containerized workloads.

prev
sha256
RECORD 0005 2025 – present pending
role

Security engineer, governance risk and compliance

action

Carrying federal systems through RMF assessment cycles with the ATO intact.

evidence

Security Impact Analysis against a real authorization boundary. CMMC readiness and assessment preparation. Control evidence that holds up in front of an assessor, and security checkpoints built into the automated workflow rather than bolted on afterward, so a one to two day checkpoint SLA is something the pipeline meets rather than something the team apologizes for.

prev
sha256

Verifiable claims

Credentials, with the receipts.

A token is only worth what its issuer will vouch for, and only for as long as the issuer says. Every credential below carries its own dates and links to Credly, including the ones that have run out. An expired credential is still a real one. It just does not validate today.

Current

CMMC CCP Certified CMMC Professional Issued 2026-07-30 ISACAVerify → CISSP Certified Information Systems Security Professional Valid to 2029-02-28 ISC2Verify → PMP Project Management Professional Valid to 2029-02-18 Project Management InstituteVerify → OCP Oracle Database 11g Administrator Certified Professional Issued 2018-12-08 OracleVerify → OCA Oracle Database 11g Administrator Certified Associate Issued 2016-01-08 OracleVerify → AZ-900 Microsoft Certified: Azure Fundamentals Issued 2020-02-07 MicrosoftVerify →

Lapsed, listed because hiding them would defeat the point

CKA Certified Kubernetes Administrator Lapsed 2024-03-08 The Linux FoundationVerify → CKS Certified Kubernetes Security Specialist Lapsed 2023-05-27 The Linux FoundationVerify → SPLUNK ES Splunk Enterprise Security Certified Admin Lapsed 2023-09-02 SplunkVerify → SPLUNK Splunk Enterprise Certified Admin Lapsed 2023-09-04 SplunkVerify → AWS SAP Solutions Architect – Professional Lapsed 2021-11-15 Amazon Web ServicesVerify → AWS SAA Solutions Architect – Associate Lapsed 2021-11-15 Amazon Web ServicesVerify →

Where this goes next

The rest of it, in governance risk and compliance.

CMMC readiness

Taking a contractor from a scoping conversation to an assessment they can pass, without pretending the gap analysis is the hard part. The evidence trail is the hard part.

  • CMMC Level 2
  • NIST SP 800-171
  • SSP
  • POA&M
  • C3PAO prep

Authorization and RMF

Moving federal systems through the assessment cycle without losing the ATO. Control selection, Security Impact Analysis, and continuous monitoring that actually monitors something.

  • NIST RMF
  • SP 800-53
  • SIA
  • ConMon
  • ATO sustainment

Detection that survives contact

Detections analysts keep, because I have owned the platform underneath them and know what a bad one costs the queue on a Monday morning.

  • Splunk ES
  • Risk-based alerting
  • CIM
  • Index-time masking

Dispatch

Notes from inside the boundary.

Occasional writing on CMMC scoping, detection engineering, and getting federal systems authorized without grinding delivery to a halt.

Attestation

ODK
T3active

Let's talk about where the bottleneck sits.

I am open to security engineering and GRC work, federal or defense industrial base, on staff or through Token LLC. If you have a provisioning pipeline that security keeps getting routed around, that is the conversation I want to have.