Hello, I'm

David Penfold

Cyber Security Professional & Developer

I build secure software and break insecure systems.

View My Work Get in Touch

01. About

David Penfold

I hold a First-Class BSc (Hons) in Cyber Security from the University of Plymouth (2025), built on top of six years of self-employed IT support experience providing hardware, software, networking and security services to small businesses and individuals.

Most recently, in September 2026 I completed a two-week cyber security placement with Nationwide Building Society's Threat Intelligence team, delivering an independent OSINT research project on nation-state exploitation of recruitment processes and briefing the findings to senior intelligence and fraud leads.

In January 2026 I conducted a voluntary digital forensics investigation alongside an FBCS-certified mentor at a cybersecurity consultancy, following fraudulent activity linked to a malicious LinkedIn advertisement — implementing containment actions and producing a formal incident report with root-cause analysis and remediation recommendations. I receive ongoing one-to-one mentorship from a cybersecurity professional, and I have written an academic paper critiquing UK cybersecurity recruitment practices.

My interests span ethical hacking, digital forensics, governance frameworks and full-stack secure development — I like understanding systems well enough to both build them properly and break them convincingly.

Currently shipping PawPrints to:
  • Apple App Store
  • Google Play

02. Skills

Languages

  • Python
  • C#
  • JavaScript / TypeScript
  • SQL

Frameworks

  • .NET MAUI
  • ASP.NET Core
  • React
  • Vite

Security

  • Penetration Testing
  • Digital Forensics
  • OSINT
  • SIEM
  • Incident Response
  • Vulnerability Assessment

Tools

  • Wireshark
  • Metasploit
  • Nmap
  • Git
  • Docker

Cloud & Infrastructure

  • Azure
  • MongoDB Atlas
  • Railway
  • Cloudflare
  • Firebase

Governance

  • NCSC Guidelines
  • ISO 27001 Awareness
  • GDPR Compliance

03. Projects

Commercial Project — Pre-Launch

PawPrints

Pet social media mobile app — built end-to-end as sole developer. Live at thepawprints.co.uk

Features

  • Social feed, pet profiles and explore / discovery
  • Daily Dog feature with streaks
  • Activity notifications
  • Three-tier subscription model (Free / Pro / Premium)
  • Admin moderation dashboard

Security highlights

  • JWT refresh token rotation
  • BCrypt password hashing
  • Rate limiting & account lockout
  • Full security audit
  • .NET MAUI (iOS / Android)
  • ASP.NET Core REST API
  • MongoDB Atlas
  • Cloudinary
  • Firebase Analytics / Crashlytics
  • RevenueCat
  • SendGrid
  • Railway
  • Cloudflare
First-Class Dissertation

GuardPoint

Security awareness platform with a phishing simulation engine, built to address human-factor vulnerabilities in organisations. Awarded a First-Class mark as my BSc dissertation.

A full-stack web application demonstrating applied knowledge of social engineering, phishing mechanics and security awareness training.

View on GitHub →
Private

Kickoff — World Cup 2026 Predictor

Private predictions website built for friends ahead of the 2026 FIFA World Cup: match predictions, a leaderboard, automated email notifications and live score integration via the football-data.org API.

  • React / Vite
  • Node.js / Express
  • MongoDB
  • SendGrid
  • Netlify + Railway
Case Study

Voluntary Forensic Investigation

Conducted a digital forensic investigation in January 2026, following fraudulent activity linked to a malicious LinkedIn advertisement, working alongside an FBCS-certified cybersecurity professional.

Applied OSINT techniques, evidence preservation and forensic analysis methodology, producing a structured findings report.

  • OSINT
  • Evidence Preservation
  • Forensic Analysis

04. Experience

  1. 14 — 25 Sept 2026

    Cyber Security Work Experience — Nationwide Building Society

    Threat Intelligence, Security & Resilience · London (1 Threadneedle Street) and Swindon

    Two-week placement with Nationwide's Threat Intelligence team, researching nation-state exploitation of recruitment processes and briefing the findings to senior intelligence and fraud leads.

    • Commissioned by the Head of Threat Intelligence to carry out an independent OSINT research project into nation-state (including North Korean) exploitation of recruitment processes to target organisations.
    • Delivered a one-hour intelligence briefing to the Head of Threat Intelligence, the Strategic Intelligence Lead and the Cyber Fraud Fusion Lead, raising significant findings about publicly available data that the team had not previously considered.
    • The briefing was shared the same day with the Internal Fraud Strategy manager, followed by a call to discuss the fraud implications directly.
    • Worked on site with the Threat Intelligence, Cyber Fraud Fusion and GSOC teams, and held one-to-ones with stakeholders across Security & Resilience to understand how intelligence feeds into fraud prevention and security operations.

    “We were very impressed by the sophistication of the briefing David created… His interpersonal skills were impressive.”

    — Nationwide Threat Intelligence, placement feedback
    • Threat Intelligence
    • OSINT
    • Threat Actor Analysis
    • Intelligence Briefing
    • Fraud Intelligence
    • Stakeholder Communication
  2. January 2026

    Voluntary Forensic Investigator

    Digital forensics investigation conducted alongside an FBCS-certified mentor at a cybersecurity consultancy — implemented containment actions and produced a formal incident report with findings, root-cause analysis and remediation recommendations.

  3. 2020 — Present

    Self-Employed IT Support Technician & PC Builder

    Hardware and software support, custom PC builds, router and switch configuration, and security troubleshooting for SMEs and individuals — diagnosing issues incident-style and communicating risks and fixes clearly to clients of all experience levels.

05. Contact

Looking for someone who can build secure systems and think like an attacker? My inbox is always open — drop me an email and I'll get back to you.

9874@duck.com