Ngugi Moses

• Conduct comprehensive information security risk assessments across applications,
networks, and supporting infrastructure.
• Monitor, assess, and report on cybersecurity threats, vulnerabilities, and control
weaknesses affecting organizational systems.
• Support development, review, and implementation of information security controls
aligned with institutional policies and regulatory requirements.
• Perform vulnerability assessments and controlled security testing to identify risks to
confidentiality, integrity, and availability of systems.
• Support incident response activities by assisting in investigation, containment, and
documentation of security incidents.
• Maintain security assessment records, risk registers, and remediation tracking
documentation.
• Provide advisory support on access control management, secure configurations,
encryption, and system hardening.
• Participate in compliance support activities aligned with ISO 2700 1, NIST, data
protection, and internal audit requirements.
• Prepare clear technical and management reports to support informed decision-making by
senior stakeholders.
• Support cybersecurity awareness initiatives and promote security best practices across
user teams.

• Execute web application and API penetration tests using both automated and manual
techniques to identify critical vulnerabilities.
• Perform vulnerability assessments, attack surface analysis, and risk prioritization for
client environments.
• Test for common and advanced vulnerabilities including SQL Injection, XSS, CSRF,
IDOR, authentication flaws, file upload issues, and security misconfigurations.
• Analyze findings and map them to industry frameworks such as OWASP Top 10 and
CVSS for severity scoring.
• Develop clear, actionable security assessment reports with proof-of-concept evidence and
remediation steps.
• Engage with clients to explain findings, attack paths, and risk implications in both
technical and non-technical terms.
• Support post-assessment remediation by validating fixes and providing security best
practice guidance.
• Conduct cybersecurity awareness and hands-on technical training sessions to improve
client security awareness and defensive capabilities.

• Provided ICT and cybersecurity support across enterprise systems and networks.
• Implemented secure email and collaboration systems and trained users on safe usage.
• Configured and secured network infrastructure including routers and switches.
• Supported endpoint protection through antivirus installation, monitoring, and updates.
• Implemented information protection and governance controls using Microsoft 365.
• Supported secure remote access solutions to enable operational continuity.

• Participated in a structured apprenticeship program focused on strengthening hands-on
technical and cybersecurity skills through real-world scenarios.
• Conducted penetration tests and vulnerability assessments on web applications and
systems.
• Performed data recovery from flash drives and mobile devices, as well as disk imaging
for forensic analysis.
• Executed password recovery exercises to understand authentication weaknesses.
• Prepared detailed assessment and recovery reports to document findings and
processes.