Samantha Lewthwaite is believed to have entered Kenya on a fraudulent South African passport under the name Natalie Faye Webb.
At least 72 people were killed and dozens more injured when a group of al-Shabaab militants attacked the upscale mall on Saturday, in a siege that lasted four days.
While there have been multiple reports that Lewthwaite may have led the Nairobi terrorist operation, there has been no official confirmation from Kenyan authorities that she was involved.
Eyewitness News has established Lewthwaite worked as an IT specialist at a halaal pie factory in Lenasia.
The company's owner, who did not want to be identified, said the Briton was a quiet woman who kept to herself.
Lewthwaite reportedly lived in a flat in Mayfair with her three children.
The owner said the last time she saw Lewthwaite was when she told her that she wanted to resign.
A string of bad debt accrued by her has since brought debt collectors knocking at her door.
The former employer said she was shocked to learn Webb’s true identity.
Meanwhile, Eyewitness News searched Webb's consumer records using the ID number on her passport and found that she owes as much as R60,000 for unpaid credit cards, loans and clothing accounts.
Consumer records show that she was active in the country as recently as May last year.
Lewthwaite was listed under two residential addresses, one in Mayfair and another in Randburg.
The terror suspect had three different cellphone numbers which were changed over the period of a year.
Lewthwaite is the widow of Germaine Lindsay, one of the 2005 London suicide bombers.
She has been on the Central Intelligence Agency (CIA)'s radar since the beginning of last year, when the United States Intelligence Agency started helping Kenyan authorities track her down for allegedly supplying arms to terrorists in the region.
She is also wanted in connection with alleged plots to attack hotels and restaurants in Kenya.
Al-SHABAAB IN SA
Meanwhile, the Hawks say they can’t confirm whether or not they're looking at Lewthwaite as a person of interest in their investigation into al-Shabaab in South Africa.
The Hawks confirmed on Tuesday that South African authorities have been monitoring al-Shabaab's activities in the country for over a year.
Hawks spokesperson Paul Ramaloko said while he can confirm that authorities have been investigating al-Shabaab’s activity in South Africa, the investigation has no links to the terror attack in Nairobi.
“There haven’t been any arrests made, but we received information which we are currently working on.”
Earlier this week, it emerged the al-Qaeda linked group allegedly used South Africa to plan attacks.
A series of unconfirmed tweets from al-Shabaab suggested that Pretoria would have been the next rendezvous point for the group.
The validity of the Twitter account has not yet been established.
(Edited by Refilwe Pitjeng)