Cyber Career Clinic (C3) · Session catalogue

Every session, from first skills to leading teams.

Live evening sessions with people who do this work, in three levels: Mason, Builder and Architect. Each one says what you’ll be able to do afterwards. Book the ones running now, or offer to teach one that isn’t yet.

See what’s live this eveningMeet the trainers ↓
60
Sessions in the catalogue
7
Trainers ↓
7
Running in the next 4 weeks
53
Looking for a trainer
Show:
Level:
60 of 60 sessions
  1. M1

    How the internet moves data

    What actually happens between tapping a link and a page appearing: DNS, IP addresses, TCP and the hops in between, traced live.

    After it, you can follow a request from a phone to a server and back.

    1h 15m Live online

    Mason
  2. M2

    Networks you can draw

    Subnets, ports, switches, routers and firewalls, drawn the way a real small office is laid out, so you can reason about where traffic can and can't go.

    After it, you can draw a small office network with its subnets, ports and firewall.

    1h 15m Live online

    Mason
  3. M3

    Linux at the command line

    The Linux commands you'll use every week in security work: moving around, searching files, reading logs, and managing users and permissions.

    After it, you can find files, read logs and manage users on a Linux server.

    1h 15m Live online

    Mason
  4. M4

    Windows and Active Directory basics

    How most companies sign their staff in: domains, users, groups and Group Policy, and the common mistakes attackers go looking for.

    After it, you can explain how a company logs its staff in, and where it goes wrong.

    1h 15m Live online

    Mason
  5. M5

    How the web works

    Requests, responses, headers, cookies and sessions, read straight from the browser's developer tools, so the web stops being a black box.

    After it, you can read an HTTP request and say what cookies and sessions do.

    1h 15m Live online

    Mason
  1. M6

    Reading logs

    Where logs come from, what a normal day looks like in them, and how to filter thousands of lines down to the few that tell the story.

    After it, you can find the one line that matters in a thousand.

    1h 15m Live online

    Mason
  2. M7

    Your first SIEM search

    A guided first search in a SIEM: fields, filters and time ranges, built up step by step into a search that catches repeated failed logins.

    After it, you can write a search that catches a failed-login attack.

    1h 15m Live online

    Mason
  3. M8

    Triage an alert

    The questions an analyst asks of every alert, in order, and how to decide quickly and defensibly whether it's real, benign or needs escalating.

    After it, you can decide in 10 minutes whether an alert is real.

    1h 15m Live online

    Mason
  4. M9

    Phishing, taken apart

    Headers, links, attachments and the social tricks inside phishing emails, taken apart on real-looking examples, and how to report one well.

    After it, you can pull the clues out of a real-looking phishing email.

    1h 15m Live online

    Mason
  5. M10

    First response to an incident

    The first hour of an incident: contain, preserve evidence, tell the right people and write things down, without making it worse.

    After it, you can take the first five right steps when something breaks.

    1h 15m Live online

    Mason
  6. M11

    Investigating with MITRE ATT&CK

    The MITRE ATT&CK framework as an investigator's map: reading tactics and techniques, and placing each step of a real attack on it.

    After it, you can map an attack step by step to ATT&CK.

    2h 30m Live online

    Samuel Hiira Next Thu 29 Oct, 8:00 pm EAT · 7 more15 signed up

    Mason
  1. M12

    Securing applications with OWASP

    The OWASP Top 10 in practice: how injection, broken access control and other common flaws are found, exploited in a lab, and fixed.

    After it, you can find and fix the most common web flaws.

    2h 30m Live online

    Rachael Kivuti Next Wed 28 Oct, 8:00 pm EAT · 7 more5 signed up

    Mason
  2. M13

    Breaking the perimeter: the attacker’s path

    How an attacker gets from the outside to the inside: reconnaissance, a first foothold and moving deeper, done step by step in a safe lab.

    After it, you can walk an attack from outside to in, in a safe lab.

    2h 30m Live online

    Velma Anangwe Next Mon 26 Oct, 8:00 pm EAT · 7 more13 signed up

    Mason
  3. M14

    Red team fundamentals

    What a red team engagement is: scoping, rules of engagement, working towards an objective and writing a report the client can act on.

    After it, you can plan and report a small engagement.

    2h 30m Live online

    Arch Mugi Next Thu 29 Oct, 8:00 pm EAT · 3 more1 signed up

    Mason
  4. M15

    Passwords and how they break

    How passwords are stored, guessed and cracked, and why length, managers and multi-factor sign-in stop most of it.

    After it, you can show why weak passwords fall, and what stops it.

    1h 15m Live online

    Mason
  5. M16

    Scripting your own tools

    Python for security work: reading files, calling APIs and automating one repetitive task you'd otherwise do by hand.

    After it, you can write a short Python script that saves an hour of work.

    1h 15m Live online

    Mason
  1. M17

    Cloud basics: who is responsible for what

    The shared responsibility model: what AWS, Azure or Google secure for you, what stays your job, and where breaches usually happen in between.

    After it, you can say which security jobs the cloud provider does and which you do.

    1h 15m Live online

    Mason
  2. M18

    Identity and access

    Accounts, roles and permissions, least privilege, and how to review who can do what in a system and remove what they don't need.

    After it, you can check who can do what in a system, and cut what they don’t need.

    1h 15m Live online

    Mason
  3. M19

    Securing a cloud account in an afternoon

    A short, practical checklist for a new cloud account: the root account, multi-factor sign-in, logging, billing alerts and safe defaults.

    After it, you can lock down a new cloud account with a short checklist.

    1h 15m Live online

    Mason
  4. M20

    Mobile money and the fraud around it

    How mobile money moves, the fraud schemes built around it such as SIM swaps and social engineering, and how providers detect and stop them.

    After it, you can explain how M-Pesa fraud works and how it is caught.

    1h 15m Live online

    Mason
  1. M21

    Kenya’s cyber laws in one evening

    Kenya's Data Protection Act 2019 and Computer Misuse and Cybercrimes Act 2018 in plain words: who they apply to, what they require, and what happens when they're broken.

    After it, you can say what the Data Protection Act 2019 and the Computer Misuse and Cybercrimes Act 2018 ask of a company.

    1h 15m Live online

    Mason
  2. M22

    Ethics: where the line is

    Permission, scope and responsible disclosure: where security testing becomes an offence, and how to act when you find something you shouldn't have.

    After it, you can tell testing from trespassing, and act on it.

    1h 15m Live online

    Mason
  3. M23

    Writing a clear incident report

    What belongs in an incident report, what doesn't, and how to write one page a manager can read in two minutes and act on.

    After it, you can write a one-page report a manager can act on.

    1h 15m Live online

    Mason
  1. M24

    Learning so it sticks

    How memory actually works, and study methods that hold up for exams and the job: recall, spacing and practice over rereading.

    After it, you can study with recall and practice instead of rereading.

    1h 15m Live online

    Mason
  2. M25

    Protecting your focus

    Why deep work matters in technical careers, and a simple weekly plan to protect two blocks of real focus from notifications and noise.

    After it, you can plan and guard two deep-work blocks a week.

    1h 15m Live online

    Mason
  3. M26

    A home lab on a student budget

    Turning one old laptop into a practice lab with free tools and virtual machines, so you can break and fix things safely at home.

    After it, you can build a practice lab on one old laptop.

    1h 15m Live online

    Mason
  1. B1

    The business-minded defender

    Security as a business decision: what a fix costs, what the risk would cost, and how to recommend the trade-off a business can live with.

    After it, you can weigh a security fix against what it costs the business.

    2h 30m Live online

    Martin M. Kamethu Next Mon 26 Oct, 8:00 pm EAT · 7 more10 signed up

    Builder
  2. B2

    How a business makes money

    Revenue, costs and profit, read from a simple profit and loss statement, and how to spot the systems and processes the money depends on.

    After it, you can read a simple profit and loss statement and find what must not stop.

    1h 15m Live online

    Builder
  3. B3

    Putting risk in shillings

    Turning a vague risk into a number: how often it might happen times how much it would cost, in shillings, so it can be compared and prioritised.

    After it, you can estimate a yearly loss as how often times how much.

    1h 15m Live online

    Builder
  4. B4

    GRC foundations

    Governance, risk and compliance from the ground up: policies, risk registers, controls and audits, and how they fit together in a real company.

    After it, you can explain what governance, risk and compliance ask of a company.

    1h 30m Live online

    Dennis Mensah Next Wed 28 Oct, 9:00 pm EAT · 3 more1 signed up

    Builder
  5. B5

    The board in ten minutes

    How to brief senior people on one risk and one ask: what to say first, what to leave out, and how to answer the question behind the question.

    After it, you can brief executives on one risk and one ask, without jargon.

    1h 15m Live online

    Builder
  6. B6

    Security for SACCOs, banks and fintech

    The threats and regulations that shape security in Kenyan finance, from fraud and mobile channels to what the Central Bank and SASRA expect.

    After it, you can name the risks and rules that matter most in Kenyan finance.

    1h 15m Live online

    Builder
  1. B7

    Friday roundtable: careers in cyber

    A weekly conversation with people working in cyber about how they got there, what the work is really like, and your questions for them.

    After it, you can hear how working people chose their path, and ask them.

    45m Live online

    Christine Wanjiku Next Fri 30 Oct, 4:00 pm EAT · 3 more5 signed up

    Builder
  2. B8

    Choosing where you’re heading

    The main roles in cyber, what each one does day to day, and how to pick one target and work out the skills, proof and steps it takes.

    After it, you can pick one target role and list what it takes.

    1h 15m Live online

    Builder
  3. B9

    A CV and LinkedIn that show proof

    Rewriting your CV and LinkedIn around work someone can verify: projects, write-ups and results, instead of a list of courses.

    After it, you can rewrite your CV around work someone can check.

    1h 15m Live online

    Builder
  4. B10

    A portfolio employers can check

    Choosing, writing up and publishing three pieces of work so an employer can see what you did, how you did it and what it changed.

    After it, you can publish three pieces of work with what you did and what it changed.

    1h 15m Live online

    Builder
  5. B11

    Interviews, technical and the rest

    The questions technical interviews ask, how to think aloud through a scenario, and how to handle the questions about yourself.

    After it, you can answer the common questions and walk through a scenario aloud.

    1h 15m Live online

    Builder
  6. B12

    Writing and speaking so people listen

    Writing short posts and giving five-minute talks that hold attention: one idea, a clear structure, and the habit of doing it regularly.

    After it, you can write a short post and give a five-minute talk at a meetup.

    1h 15m Live online

    Builder
  1. B13

    Running a security project

    Scoping, planning, tracking and closing a security project of four to six weeks, with the updates that keep people informed.

    After it, you can plan, track and close a project of four to six weeks.

    1h 15m Live online

    Builder
  2. B14

    Work that doesn’t need you

    Runbooks and handover notes good enough that someone else can do your job while you're away, and why that makes you more valuable, not less.

    After it, you can write a runbook so someone else can do your job for two weeks.

    1h 15m Live online

    Builder
  3. B15

    Working with vendors and auditors

    What vendors and auditors need from you and what you need from them: questionnaires, evidence, contracts and getting through an audit calmly.

    After it, you can get what you need from a vendor and survive an audit.

    1h 15m Live online

    Builder
  4. B16

    Leading an incident, not just fixing it

    Running an incident as the lead: assigning roles, keeping a timeline, sending updates and making decisions while others do the technical work.

    After it, you can run the call: roles, updates and decisions.

    1h 15m Live online

    Builder
  5. B17

    Freelancing: pricing and selling your skills

    How to price a small security job, find the first clients, and write a one-page proposal that says what you'll deliver and for how much.

    After it, you can price a small job and write a one-page proposal.

    1h 15m Live online

    Builder
  6. B18

    Mentoring your first junior

    How to run a weekly half hour with someone newer than you: setting goals, asking good questions and giving feedback that helps.

    After it, you can run a useful weekly half hour with someone newer than you.

    1h 15m Live online

    Builder
  1. A1

    Drawing the whole system

    Mapping a whole organisation's systems, data flows and trust boundaries on one page, so the weak points become visible.

    After it, you can draw a company’s systems, data and trust lines on one page.

    1h 15m Live online

    Architect
  2. A2

    Threat modelling a real product

    Threat modelling a real product before it ships: what's worth protecting, who might attack it, how, and what to change in the design.

    After it, you can list what could go wrong with a product before it ships.

    1h 15m Live online

    Architect
  3. A3

    Trust nothing by default

    Zero trust in practice: designing access so every request is checked and one stolen password or device can't open everything.

    After it, you can design access so one stolen password can’t open everything.

    1h 15m Live online

    Architect
  4. A4

    Designing to recover

    Resilience by design: backups, failover, recovery targets and rehearsals, planned for the day something important breaks.

    After it, you can plan for the day it breaks: backups, fallbacks, practice runs.

    1h 15m Live online

    Architect
  5. A5

    Reviewing a cloud design

    Reviewing someone else's cloud architecture: what to ask, the common weak points, and how to write findings people will act on.

    After it, you can spot the weak points in someone else’s cloud design.

    1h 15m Live online

    Architect
  6. A6

    A security programme from nothing

    Building security where there is none: what to do in the first ninety days, the first year, and what to leave for later.

    After it, you can lay out the first year of security for a company with none.

    1h 15m Live online

    Architect
  1. A7

    Winning a security budget

    Making the case for a security budget in the owner's terms: the risk in money, the options, and what each one buys.

    After it, you can make the case for money in the owner’s terms.

    1h 15m Live online

    Architect
  2. A8

    Reporting to boards and regulators

    Preparing a quarterly report for a board or a regulator such as the CBK or the ODPC: what they look for and how to present it honestly.

    After it, you can prepare a quarterly report for a board, the CBK or the ODPC.

    1h 15m Live online

    Architect
  3. A9

    Hiring a security team

    Defining a security role, interviewing well, and choosing people who will do the work and grow, not just the ones with the most certificates.

    After it, you can write a role, run an interview and pick well.

    1h 15m Live online

    Architect
  4. A10

    Is our security working?

    Choosing a handful of measures that show whether security is improving, and reporting them so they lead to decisions.

    After it, you can choose five numbers that show whether it is.

    1h 15m Live online

    Architect
  5. A11

    Policy people actually follow

    Writing short policies people can understand, and getting them adopted through owners, training and follow-up.

    After it, you can write a one-page policy and get it used.

    1h 15m Live online

    Architect
  1. A12

    Teaching a clinic session

    Designing and teaching a 75-minute clinic session: one skill, one practice task, and how to keep a live online room engaged.

    After it, you can design and run a 75-minute session of your own.

    1h 15m Live online

    Architect
  2. A13

    Writing what you know

    Turning what you know into an article, a guide or a book chapter: finding the idea, structuring it, and getting it finished and out.

    After it, you can turn your experience into an article, guide or book chapter.

    1h 15m Live online

    Architect
  3. A14

    A team that grows its own leaders

    Building a team where juniors take on more each quarter: delegation, coaching and making room for others to lead.

    After it, you can set up a team so juniors step up without you.

    1h 15m Live online

    Architect
  4. A15

    Starting a security business in Africa

    Testing a security business idea in an African market: finding the problem people will pay to solve, and landing the first paying client.

    After it, you can test a business idea and land a first paying client.

    1h 15m Live online

    Architect
  5. A16

    Bringing up the next mason

    Mentoring, giving back and passing the climb on: how experienced people help the next masons start well.

    After it, you can mentor, give back and pass the climb on.

    1h 15m Live online

    Architect

Meet the trainers

People who do this work, teaching it one evening at a time.

Every clinic session is led by a practitioner. Read about them here, and tap a session to see when it runs.

Martin M. Kamethu

Martin M. Kamethu

Teaches 1 session · Builder

Martin M. Kamethu is the Lead Mentor and Chief Talent Architect at Ongoza Cyber Hub (OCH), where he designs how Africa's next cybersecurity professionals are found, trained and proven: from the Cyber Career Clinic and the OCH Readiness Score to the VIP Framework, which helps learners turn their skills into value, impact and purpose. He is the author of The Invisible Expert, the book behind the clinic's Mason, Builder and Architect levels. Alongside OCH, Martin is a Cybersecurity Consultant at Serianu Limited, specializing in technology, risk, and security operations advisory services, and currently leads Serianu Botswana Operations. He helps organisations design and implement simple, practical, and effective cybersecurity risk management capabilities that strengthen their cyber resilience, through programs tailored to the African context. With over 12 years of experience as a cybersecurity and technology leader, Martin is deeply passionate about innovation and leadership, particularly in exploring Africa's potential to address current and future global cybersecurity challenges. He is a Certified Ethical Hacker and is pursuing his MBA at Hult International Business School.

Full profile →LinkedIn
Velma Anangwe

Velma Anangwe

Teaches 1 session · Mason

Velma Anangwe is a cybersecurity professional with experience in offensive security, security training, purple teaming, and automation-driven problem solving. Velma previously worked at Serianu under the Cyber Shujaa program as a Cybersecurity Trainer, conducting Vulnerability Assessments and Penetration Tests (VAPTs), and was selected for the trainer role after emerging as one of the top-performing female security analysts in the program. Velma currently works with CYBER RANGES, focusing on VAPTs, purple teaming, and quality assurance security testing across simulated and enterprise environments. Beyond corporate roles, Velma has independently delivered cybersecurity consultancy services for major organizations under NDA, helping strengthen security posture, identify critical vulnerabilities, and improve resilience against evolving threats. Velma's technical strengths span visual programming, TypeScript, API integrations, workflow automation, and AI-powered tools that accelerate software development and security operations, combining cybersecurity expertise with modern engineering workflows to build efficient, scalable, and practical solutions.

Full profile →LinkedIn
Rachael Kivuti

Rachael Kivuti

Teaches 1 session · Mason

Rachael Kivuti is an ERP Consultant at Soft Consult and a cybersecurity professional specializing in bridging the gap between core enterprise infrastructure, emerging tech and offensive operations. Rachael's work has spanned application security, digital forensics and securing ERP environments like SAP, touching almost every moving part of an organization, from finance to supply chain to data workflows to operational logic. Rachael's path is proof that you never have to abandon your existing technical interests to break into cybersecurity; instead, you build on top of them. Having navigated intensive training programs, earned certifications across multiple domains (Security+, eJPT, CCNP, ISC2 CC, ASCP, SAP) and stepped into leadership roles for cyber community initiatives, Rachael understands how to turn raw technical curiosity into structured, real-world skills. Rachael's mentoring focus is helping learners align their unique IT, development or business background with their cybersecurity journey.

Full profile →LinkedIn
Arch Mugi

Arch Mugi

Teaches 1 session · Mason

Arch Mugi is the Red Teaming instructor for OCH Cohort Two, with a deep focus on offensive operations using Hack The Box and TryHackMe.

LinkedIn
SH

Samuel Hiira

Teaches 1 session · Mason

Samuel Hiira is a cyber defender with over 3 years of experience across SOC operations, IT support, and training, delivering value to great organisations: Amref Health Africa, Yelbridges, Amica Savings & Credit, and currently HF Bank, each one shaping how Samuel thinks about security and people. In IT support, Samuel found joy not just in solving problems, but in finding smarter ways to solve them, and discovered a genuine love for helping beginners find their footing in the field. What drives Samuel's SOC career is curiosity, about what is happening inside the network and out there in the threat landscape. At HF Bank, Samuel monitors systems, investigates alerts, and researches events to stay one step ahead of attackers. Beyond defending, Samuel is on a mission called "Be Aware": helping everyone understand their security environment, from top management understanding their exposure to employees knowing how to stay safe online. Believing you can only teach what you truly understand, Samuel masters a domain before stepping in front of anyone to share it.

Full profile →LinkedIn
Christine Wanjiku

Christine Wanjiku

Teaches 1 session · Builder

Christine Wanjiku is the Social Media Coordinator at Ongoza Cyber Hub (OCH) and coordinates the OCH Cohort Two roundtable, the Friday conversation where learners from every university hear from people working in cyber about how they chose their path, and put their own questions to them.

LinkedIn
Dennis Mensah

Dennis Mensah

Teaches 1 session · Builder

Dennis Mensah is the GRC Foundations instructor for OCH Cohort Two, teaching governance, risk and compliance.

LinkedIn

Your name could be here.

Most of the catalogue is still looking for a trainer. If you do this work, pick a session and teach it one evening.

TAKE YOUR SEAT

Sign up free to book sessions. Your join link and pre-reads come by email before each one.

Sign up free

TEACH AT THE CLINIC

Do this work already? Pick a session marked “Trainer wanted” and teach it one evening.

The Mason, the Builder and the Architect come from the book The Invisible Expert by Martin M. Kamethu.