David Ngunjiri

Temporary Secondment from parent company KCB. Same rank as KCB covering the following vacant roles in order of responsibility focus:
Privileged Access Management (PAM) Solution Administrator.
Application Security Testing Specialist, Core Banking Solution Deployment Security reviews and hardening.
Cybersecurity Monitoring Specialist: Solutions Architect and Deployment of temporary SIEM.
Data analysis and management reporting specialist: Power BI reporting and integrations.
Network Security Specialist, Cloudflare WAF and Forcepoint Proxy Administration.
Cloud Security Specialist - Azure.
Endpoint Security: Migration from Kaspersky to Microsoft Defender EDR.

Security Testing Specialist (Penetration Testing and DevSecOps)
I'm a security lead for internal Penetration Testing and security reviews contributor for our internal scrum teams that are part of our change and development process and traditional waterfall projects.
I’m a current lead designer and implementer for our DevSecOps solutions and automated integration. I co-authored the initial implemention of our automated CI/CD security reviews and integration in Azure Devops for all scrum teams.
Collaborate with compliance and risk management teams to remediate audit findings, and perform annual internal PCI DSS and SWIFT CSP assessments.
Vulnerability Management Program Manager:
I setup and maintain automated scans for the entire environment on a regular schedule to ensure maximum coverage and an up-to-date view of the bank's exposure. In addition to this I’m the co-domain lead for internal VAPTs.
I perform both basic VAs for low-risk changes and in-depth Penetration Tests, this also includes risk reviews and audit issues closure assistance due to my previous role as an IS Auditor.
This also included creating and running the cybersecurity social awareness program by creating annual custom eLearning for the entire organization covering emerging risks and quarterly phishing campaigns to test our employee’s knowledge and build resilience through real world scenarios.
Other significant roles not in my formal Job Description:
I'm the lead for Business Process Optimization and Automation for my unit. I assist in optimizing and automating reports and dashboards for my team relying on my self-taught Power BI and RPA skills.
Act as a backup L3 SOC Analyst for Incident Response, Network and Cloud Security Specialist.

Senior Cybersecurity Business Analyst - October 2018 - June 2020
Cybersecurity Business Analyst - December 2017 - October 2018
IT Risk Advisory Business Analyst - May 2015-December 2017
Responsibilities:
Provide IT Security services (mainly Red team) to EY clients as per the project deliverables.
Provide IT Advisory services to EY clients as per the project deliverables.
Provide IT Risk Advisory services to EY clients as per the project deliverables.
Provide IT Audit support to external and internal financial audits performed by EY’s Assurance Service Line.
Provide Subject Matter Expertise support to other EY Service Lines or EY Global offices.
Achievements:
Delivered comprehensive IT Security services, focusing on Red team activities, to clients in alignment with project deliverables.
Provided expert IT Advisory and Risk Advisory services to clients, ensuring adherence to project objectives and client expectations.
Supported external and internal financial audits, maintaining compliance with industry standards.
Provided Subject Matter Expertise (SME) support to other EY Service Lines or Global offices, facilitating knowledge sharing. I was the Information Security Subject Matter Expert for Treasury and Trade Finance operations and systems in EY Kenya IT Advisory.
I contributed in the global overhaul and modernization of the automated EY audit scripts and report generators notably Windows, Unix and Linux scripts.