Hello, I'm

David Penfold

Cyber Security Professional & Developer

I build secure software and break insecure systems.

View My Work Get in Touch

01. About

David Penfold

I hold a First-Class BSc (Hons) in Cyber Security from the University of Plymouth (2025), built on top of six years of self-employed IT support experience providing hardware, software, networking and security services to small businesses and individuals.

In January 2026 I conducted a voluntary digital forensics investigation alongside an FBCS-certified mentor at a cybersecurity consultancy, following fraudulent activity linked to a malicious LinkedIn advertisement — implementing containment actions and producing a formal incident report with root-cause analysis and remediation recommendations. I receive ongoing one-to-one mentorship from a cybersecurity professional, and I have written an academic paper critiquing UK cybersecurity recruitment practices.

My interests span ethical hacking, digital forensics, governance frameworks and full-stack secure development — I like understanding systems well enough to both build them properly and break them convincingly.

Currently shipping PawPrints to:
  • Apple App Store
  • Google Play

02. Skills

Languages

  • Python
  • C#
  • JavaScript / TypeScript
  • SQL

Frameworks

  • .NET MAUI
  • ASP.NET Core
  • React
  • Vite

Security

  • Penetration Testing
  • Digital Forensics
  • OSINT
  • SIEM
  • Incident Response
  • Vulnerability Assessment

Tools

  • Wireshark
  • Metasploit
  • Nmap
  • Git
  • Docker

Cloud & Infrastructure

  • Azure
  • MongoDB Atlas
  • Railway
  • Cloudflare
  • Firebase

Governance

  • NCSC Guidelines
  • ISO 27001 Awareness
  • GDPR Compliance

03. Projects

Commercial Project — Pre-Launch

PawPrints

Pet social media mobile app — built end-to-end as sole developer. Live at thepawprints.co.uk

Features

  • Social feed, pet profiles and explore / discovery
  • Daily Dog feature with streaks
  • Activity notifications
  • Three-tier subscription model (Free / Pro / Premium)
  • Admin moderation dashboard

Security highlights

  • JWT refresh token rotation
  • BCrypt password hashing
  • Rate limiting & account lockout
  • Full security audit
  • .NET MAUI (iOS / Android)
  • ASP.NET Core REST API
  • MongoDB Atlas
  • Cloudinary
  • Firebase Analytics / Crashlytics
  • RevenueCat
  • SendGrid
  • Railway
  • Cloudflare
First-Class Dissertation

GuardPoint

Security awareness platform with a phishing simulation engine, built to address human-factor vulnerabilities in organisations. Awarded a First-Class mark as my BSc dissertation.

A full-stack web application demonstrating applied knowledge of social engineering, phishing mechanics and security awareness training.

View on GitHub →
Private

Kickoff — World Cup 2026 Predictor

Private predictions website built for friends ahead of the 2026 FIFA World Cup: match predictions, a leaderboard, automated email notifications and live score integration via the football-data.org API.

  • React / Vite
  • Node.js / Express
  • MongoDB
  • SendGrid
  • Netlify + Railway
Case Study

Voluntary Forensic Investigation

Conducted a digital forensic investigation in January 2026, following fraudulent activity linked to a malicious LinkedIn advertisement, working alongside an FBCS-certified cybersecurity professional.

Applied OSINT techniques, evidence preservation and forensic analysis methodology, producing a structured findings report.

  • OSINT
  • Evidence Preservation
  • Forensic Analysis

04. Experience

  1. January 2026

    Voluntary Forensic Investigator

    Digital forensics investigation conducted alongside an FBCS-certified mentor at a cybersecurity consultancy — implemented containment actions and produced a formal incident report with findings, root-cause analysis and remediation recommendations.

  2. 2020 — Present

    Self-Employed IT Support Technician & PC Builder

    Hardware and software support, custom PC builds, router and switch configuration, and security troubleshooting for SMEs and individuals — diagnosing issues incident-style and communicating risks and fixes clearly to clients of all experience levels.

05. Contact

Looking for someone who can build secure systems and think like an attacker? My inbox is always open — drop me an email and I'll get back to you.

9874@duck.com