Rothesay

Head of Security Engineering

Bank of England

Deputy CISO

Senior Manager

Head of Threat & Vulnerability Management

DevSecOps

Cigital, Inc

Managing Consultant

Senior Security Consultant

Software Security & Testing (IBM Rational)

Software Developer in IBM

🔴 All posts are my observations of the general landscape meant to engage and educate. NOT problems I'm encountering. All views are my own and not that of my employer. I’m a techie, not an economist.

🔴 Please don't invite me to meals, drinks or round tables. ALL requests will be ignored.

I help CIOs in dynamic organisations reduce cyber risk, by developing pragmatic cybersecurity functions that align with the business needs and have a proven track record of increasing simplicity and promoting accountable visibility. 

I'm a Technical Cyber Security Leader with over 17 years of experience within start-ups, management consulting and top-tier organisations. Extensive hands-on experience with Security Architecture, Engineering, DevSecOps, Security Posture Management, Penetration Testing & Red Teaming.

Engagements, Awards, Articles and Education

🔵 InfoSec Europe, Advisory Board • 2024
🔵 e-Crime & Cybersecurity Congress, Lost in Translation • 2024
🔵 Webcast, Control Effectiveness • https://www.brighttalk.com/webcast/19525/609336
🔵 SASIG, Adapting to the new cyber threat landscape • 2023
🔵 Central Banking African Summit, x4 talks over 2 days • 2022
🔵 CyberCon, Hosted fireside chat: BoE, LSEG, MS • 2022
🔵 Secure Southwest, High-value security testing • 2019

🟢 National Cyber Awards, Winner of the Financial Services Award • 2023
🟢 BCS Awards, Finalist for High Impacting Business Project • 2021
🟢 SC Awards Europe, Finalist for Best Security Team Europe • 2019

📒 Preparing your Organisation for AI Cyber Warfare • https://tinyurl.com/df-ai-war
📒 Finding High-Value Security Initiatives • https://tinyurl.com/df-sec-roi
📒 No Bullsh*t Approach To Simplifying Cyber Supply Chain Risk • https://tinyurl.com/df-supplychain
📒 Critical Vulnerability Management Cheat Sheet • https://tinyurl.com/df-cheat

📕 Master of Business Administration (MBA) • Exeter University, 2021
📕 Bachelor of Science (BSc Hons), Computer Systems & Networking • University of Plymouth, 2007
📕 CISM, Certified Information Security Manager • ISACA, 2016
📕 CISSP, Certified Information Security Professional • (ISC)2, 2011
📕 CSSLP, Certified Secure Software Lifecycle Professional • (ISC)2, 2014

Dave F.

Retired

Cyber Resilience Centre for London

The Cyber Resilience Centre for London is a not-for-profit organisation working in partnership with the Mayor’s Office for Policing and Crime and is part of a network of 9 Regional Centres whose role is to support small and medium-sized businesses (SMEs) and third sector organisations to reduce their vulnerability to cybercrime.

It offers a range of services to London’s small business community to help demystify cyber resilience and provide access to emerging risk information that is relevant to them, free guidance and affordable help to protect organisations and their people online.  

The London Cyber Resilience Centre was established in late October 2022 and is now developing its organisation, offering and focus; my role is to assist in this process.

Cyber Resilience Advisor

Tesco Underwriting

David was recruited to the role to to overhaul and improve the IS stance and arrangements of the company, which he achieved within a 12-24m period, reorganising the approach, processes, strategy and reporting as well as drafting a new IS Policy; this led to a marked improvement in the company's NIST score which has since been maintained.

He also took on management of the Operational Resilience function, successfully delivering against the 2022 regulations to time and budget, developing a new approach, processes and mechanisms to achieve and maintain compliance with the new regulatory framework along with associated testing and assurance activity. 

Regular reporting to Management and Board committees was a feature of both activities.

Head of Information Security

Resting between roles

Managing and running the teams that provide critical security services to the Bank to manage its security posture to support all Bank staff in their duties.

Senior Manager, IT Security

resting between roles and obtaining qualification

Direct Line Group

David managed and had ownership for the Group IS Policy providing advice and guidance to all levels of staff, including Executive, on IS matters; he led the IS Policy team of senior SMEs and actively participated in direct negotiations and discussions with suppliers on IS contract issues. 

Due to his wide risk, audit and incident management background he was asked to, and successfully led, the response to issues raised by the HMRC data loss and other incidents and subsequently led and developed the IS team growing this from 2 to 16 staff; he retained an active leading role in respect of IS incidents.  He was responsible for the implementation, delivery and initial and ongoing management of both the Information Leakage Management (DLP) process and supplier IS review processes for Direct Line Group.  In preparation for the Direct Line Group separation from RBS Group, he analysed the existing IS control framework and developed the IS separation strategy, future Target Operating Model, structure and headcount requirements.

Senior Information Security Manager, Head of IS Policy

Royal Bank of Scotland, Insurance

David took a leading role in the identification, analysis, management and resolution of control gaps in Finance due to his past experience in helping to lead similar activity across the wider RBS Group. He successfully delivering a number of process enhancements and changes to improve the Finance control environment.  This included defining, setting up, embedding and managing a new Finance User Access Control model, process and system across all RBS Insurance sites to meet Role Based Access Control requirements.

Project and Controls Manager

Royal Bank of Scotland

Secondment from Audit due to his risk, control and insurance business experience, David established this role when this role to build and improve contacts and coordination of fraud prevention activity across the wider RBS Group.

Fraud Prevention Manager

David was promoted to lead wholly risk based audits within the bank; these built in scale and complexity and involved the management of large teams across multiple sites and in some case multiple operating divisions, managing the staff and budgets in relation to this work.  This included leading large Group wide audits and projects on, Payments, Money Laundering, a longer term audit of the £325m project to build the RBS World HQ development as well as work in large operational units. The role involved having responsibility for documenting findings and outcomes and preparing clear, concise and easily understandable audit reports which he would then deliver to, and discuss with, business management to agree approaches and actions to address the issues raised; this required pragmatism, negotiation, persuasion and influencing skills.

Senior Auditor

National Westminster Bank

As a result of his knowledge and practical banking experience David was nominated to join the Group Inspection function, participating and assisting in inspections and audits across a variety of bank branches, offices and functions.

Auditor / Senior Auditor

David led teams in several large West End branches to deliver service to customers in a variety of roles including lending (including managing his own customer portfolio) and charged security, acting as line manager to the staff, training, developing and appraising performance.  He also had responsibility for analysis of extensive data to prepare unit contribution and lending returns for these branches.

Assistant Manager

David undertook a range of clerical tasks many in direct customer contact including, cashiering, records, standing orders, commercial foreign, charged security.

Clerical officer

David has now retired from his roles as an Information Security and Risk specialist with over 25 years experience in both first and second line functions in information security, incident management, operational resilience, audit and risk in the financial services sector and leads the IS and Operational Resilience functions having had senior IS management roles in other financial services companies.

Specialities: Information Security direction and management, Operational Resilience, Audit, Assurance and Risk management, Incident Management and Investigations, Stakeholder Management and Contractual negotiation.

taplio

The Battle

Dave F.

David Young BA(hons), ACIB

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?