Best S. E.
Aihebholoria

A production legal operations platform that took Desicon Engineering's in-house legal department off email and into a structured, auditable system — ten modules across sixteen tables, live at legal.desiconapp.com. Any department raises a request (contract draft, legal opinion, document review, advice or compliance check) against an auto-generated REQ reference; it is prioritised, checked hourly for SLA breach, routed to the Drafting Desk or Review & Advice, and the requester is emailed on every status change through Microsoft Graph. ITT qualification auto-classifies tenders into Category A, B or C by contract value and assigns the approving authority accordingly — Board, Executive Director or Department Head — running a checklist to clearance with CSV export of the full register. The digital signature engine stamps PDFs server-side with pdf-lib: officers place a stamp on any page of a multi-page document, drag to fine-tune and resize between 10 and 55 percent of page width, while the signature image bytes never reach the browser. Agreement lifecycle covers NDA, SLA, joint venture, employment and supplier contracts with 90-day expiry alerts; case management tracks intake to resolution with an event timeline and litigation cost per case; the compliance tracker scores regulatory, labour and HSE-permit obligations automatically; and board governance handles meetings, minutes and resolution follow-up. Six scheduled jobs run behind it all, so expiry dates, tender deadlines, court hearings, compliance obligations and board meetings escalate on their own rather than depending on someone remembering.

An enterprise logistics platform coordinating fleet and movement operations across Desicon Engineering's Nigerian sites — Lagos head office, Port Harcourt, Abuja, Site Bonny and field locations. It replaced phone-call driver coordination, WhatsApp vehicle assignments, paper maintenance notebooks, per-site Excel fuel sheets and gate logbooks with one real-time system. At its centre is an automated assignment engine: a staff transport request notifies coordinators, the engine selects a driver and vehicle on availability and workload balance, and completion cascades statuses back across driver, vehicle and request — with an audit row written at every step and manual overrides logged rather than blocked. Delivered in three phases across 19 API modules. Fleet operations cover the vehicle registry, live driver status board, a weekly schedule spanning nine duty types (day and night shift, standby, expatriate, management and project assignment), and driver performance with severity-coded incidents and an accident-free streak. Maintenance tracks service intervals and fault repairs with overdue email reminders, while fuel logs run per location with odometer readings, automatic mileage calculation and cost-centre tagging, consolidated into cross-site reporting. Phase 3 added a digital movement register replacing gate logbooks (time and mileage out and in, gate pass, one-click closure), material transport on a three-level approval chain (Requestor → HOD → GM Logistics → Driver), a project materials register tracking PO numbers, freight forwarders, ETD/ETA, customs and BL/AWB, plus travel and accommodation requests. Every mutation is written to an audit trail carrying user email, IP address and timestamp.

A comprehensive DevSecOps implementation integrating SAST (CodeQL), Software Composition Analysis (Trivy), and IaC scanning (Terraform Compliance + Trivy) — automated through GitHub Actions. Enforces PR blocking on Critical/High vulnerabilities, implements a full Secure SDLC, and deploys to AWS with encrypted Terraform remote state on S3.

A production-grade talent management platform built entirely in-house for a leading engineering company — covering the full performance & talent lifecycle across 213 employees and 37 competency domains. Core workflow: Competency Assessment → Gap Register → Learning Intervention → Post-Training Validation → KPI Appraisal → Deployment Readiness. The system is now extended with a full 9-Box Talent Matrix: Performance axis is fed automatically from KPI Appraisal scores; managers assess Potential (Leadership Rating + Learning Agility); HR selects a period and recalculates. Nine talent categories from Future Leaders to Underperformers, each with recommended development actions. HR calibration override with reason recorded. Any employee in a low-performance box auto-generates a PIP — pre-filled with recommended actions and a 90-day review date. An Executive Dashboard shows live talent distribution with movement arrows vs. the prior period and overdue PIP alerts. One-click Excel + PDF exports for talent-review and succession-planning meetings. A scheduled GitHub Actions workflow emails managers a weekly digest of overdue and upcoming PIP reviews every Monday. All existing staff records, managers, and HODs were migrated intact. Live at ldcms.desiconapp.com.

An enterprise-grade platform built for a leading engineering & oil services company — automating service requests, vehicle & fleet coordination, staff activity tracking, maintenance scheduling, fuel consumption analytics, and operational reporting. Features a token-based ISO-22000 compliant workflow engine, multi-level approval routing, and real-time SLA monitoring. Secured end-to-end with Entra ID SSO, Azure Front Door + WAF, Private VNet, Key Vault, and a full DevSecOps pipeline (SAST · DAST · GitHub Actions CI/CD · Azure Bicep IaC). Power BI embedded dashboards deliver live operational intelligence across all modules.

An enterprise notification and workplace communications platform built for a leading engineering company — delivering real-time announcements to 200+ staff across offices and remote project sites via a Blazor web portal and a Windows desktop agent (MSI/GPO deployed). The full stack is provisioned by a single Terraform module — App Service, PostgreSQL, Key Vault, Entra ID App Registration, and Application Insights — with zero manual Azure portal clicks. The GitHub Actions CI/CD pipeline enforces three mandatory security gates on every commit: Checkov (IaC/Terraform misconfiguration), Trivy (Docker image CVE scan), and dependency scanning on every PR. Images are SHA-pinned, pushed to GHCR, and deployed with az webapp config container set — no drift, no manual deploys. Microsoft 365 SSO via Entra ID gives staff single sign-on; the Windows agent (v1.1.0) polls the API and surfaces a scrollable popup with Acknowledge / Dismiss, deployable via GPO or Intune. Admins can Withdraw live announcements centrally in real time.

A Sprint 0 scaffold that digitises Desicon Engineering's paper financial approval forms (DEL-AC-FRM-002 & DEL-AC-FRM-003) — covering Expense Reimbursement, Cash Advance, and Procurement Requisition — built on a generic workflow engine where new modules are added as JSON definitions, not code. The engine enforces maker–checker separation at the guard, domain, and database levels, and every state transition is written to a hash-chained, insert-only audit table the application cannot alter. The project's primary purpose is to demonstrate enterprise DevSecOps maturity across six dimensions: supply-chain integrity (SHA-pinned Actions, keyless cosign signing, SLSA Build L3 provenance, CycloneDX SBOM, deploy by digest only); policy-as-code via OPA/Rego evaluated over the Terraform plan JSON (not just source files); security exceptions that carry an owner, justification, and expiry date — CRITICAL/HIGH capped at 30 days, build fails when they lapse; and continuous scanning (weekly re-scan of the running image, Terraform drift detection with auto-raised issues, OpenSSF Scorecard). The 11-job PR pipeline covers Gitleaks on full history, Checkov, OPA/Rego policy, Trivy, SCA, SBOM generation, and keyless image signing before any deployment proceeds.

An Android safety application for Desicon Group staff working across Nigerian offices and project sites, where personal security is a genuine operational risk. Employees register with their company email via Entra ID — staff only, and access is removed automatically when someone leaves. The app provides three things: a panic button that raises an immediate duress signal with location in a single tap (no menus, no confirmation dialog to fight when it matters); a security issue report for non-urgent concerns with photo, location and category; and broadcast security alerts pushed to staff about routes, areas and site advisories. A duress alert is persisted before any dispatch is attempted, then fanned out over redundant channels — push, SMS and email fallback — to Corporate Security, the HSE Manager and Head of IT, with acknowledgement tracked so it is always clear who responded and when. Location is treated as duress evidence rather than continuous tracking: it is shared on alert only, encrypted in transit and at rest, and readable only by responders on duty. The whole stack — database, App Service, Key Vault, Entra app registration and Application Insights — is provisioned by a single Terraform module, so every environment is identical and rebuildable from source, with no secrets in code. Every pull request must clear Checkov (Terraform misconfiguration), Trivy (container image CVEs) and dependency scanning before merge is allowed.