Godfrey Kutumela

Engaged on an ad hoc basis to provide independent cybersecurity and technology risk advisory. Conducted attacker-informed risk assessments across digital platforms and cloud environments and advised on governance, control design, and risk mitigation.

Provided ad hoc support to West Monroe on cybersecurity and compliance due diligence engagements. Assessed cybersecurity maturity and risk exposure, advised on risk prioritisation and remediation strategies, and contributed senior-level technical insight for investment committees.

Built an enterprise-wide cybersecurity governance program for a global SaaS supply chain transparency platform. Established structured risk management and reporting for executive and board visibility and aligned security posture and controls with customer security expectations and regulatory obligations.

Established and led cybersecurity governance, DevSecOps, and software assurance initiatives for the open-source fintech ecosystem. Strengthened secure software delivery practices, code security assurance, cloud security governance, and risk management for community-led engineering teams.

Founded and leads Nucleus Systems as an independent cybersecurity consulting practice delivering cybersecurity governance, digital trust, and technology risk advisory globally. Industrialises cybersecurity maturity assessment, code trust assurance, and AI governance into repeatable, evidence-driven delivery programmes.

Leads Nucleus Systems as a cybersecurity advisory firm focused on governance, risk, compliance, and digital trust. Provides enterprise program design and implementation, maturity assessments and transformation roadmaps, DevSecOps/secure SDLC advisory, and board-level risk reporting using proprietary delivery frameworks.

Built and established an enterprise-wide cybersecurity and risk management program aligned to ISO 27001. Designed an electrical grid security program aligned to NIST CSF and NIST industrial control system guidance, including technical security implementation blueprints for OT and related infrastructure environments.

Designed and implemented business continuity planning (BCP) and disaster recovery (DR) frameworks to improve service resilience and recovery capability. Led re-architecture of business-critical application environments to strengthen resilience, recoverability, and operational trust across an interconnected ecosystem.

Delivered cybersecurity governance for a global cloud-based SaaS learning management platform across financial services and professional services sectors. Implemented a data privacy and protection program for student PII and guided the organization through supplier security and assurance certification processes.

Led cybersecurity and technology risk assessments supporting investment transactions. Performed technical assessments of software architecture, cloud environments, DevOps maturity, engineering practices, and operational resilience, translating findings into investment-committee-ready risk insights and remediation priorities.

Strengthened cyber risk management and governance structures for a highly regulated digital banking and fintech SaaS environment. Improved cloud security posture and control frameworks to support secure scaling and regulatory readiness across US banking jurisdictions.

Established global cybersecurity governance for a distributed open-source payments platform operating across multiple countries and jurisdictions. Integrated security, compliance, and privacy into DevOps delivery pipelines and defined risk frameworks covering platform architecture, API security, and cryptographic controls.

Led regional security consulting and technical pre-sales activities across the MEA market. Focused on application security, API security, and enterprise identity management, including IBM AppScan implementations and API security solutions.

Designed secure payment architectures for regulated financial environments. Integrated HSM (Hardware Security Module) capabilities and implemented compliance frameworks aligned to PCI DSS and ISO 8583.

Delivered complex enterprise architecture and security transformation programs across banking, telecommunications, and government sectors. Led mission-critical architecture and delivery programs, defined security architecture frameworks and standards, and mentored technical teams.

Developed enterprise applications and infrastructure systems as a software and systems engineer. Supported large-scale system upgrades including the Y2K transition and contributed to software design, systems integration, and engineering operations.

Served as an EU CyberNet expert and advisor assigned to the LAC4 initiative. Advised the EU Hungarian Presidency on cybersecurity policy, including submarine cable infrastructure security.

Provided high-level cybersecurity and digital transformation advisory to Brazil's G20 Presidency to shape digital inclusion and cybersecurity policy. Worked with the Secretary of Information and Innovation Ministry on global policy advisory.

Advised DPGA on privacy requirements of the DPGA Standard as part of the Privacy Expert Group. Developed a privacy compliance evaluation framework for prospective digital public goods.

Performed confidential advisory roles supporting digital payment innovation roadmaps and security frameworks for PCH. Provided cybersecurity advisory aligned to payment platform security needs.

Provided in-source cybersecurity advisory for the OpenG2P and GovStack payment and security building blocks initiative. Supported digital payment innovation roadmaps and security framework advisory work.

Served on the Security Identity Alliance (SIA) advisory committee team under African NICC leadership. Contributed to international standards for secure, interoperable digital identity exchange.

Advised MOSIP leadership on digital identity trust assurance, cybersecurity, privacy, DevSecOps, and data protection. Led MOSIP's DevSecOps team and evaluated the Alan Turing Digital Identity Trustworthiness System.

Co-founded and leads Paxley Software, an enterprise application security SaaS platform providing integrated code security capabilities. Includes SAST, SCA, SBOM, IaC scanning, and remediation.

Conducted a comprehensive compliance assessment of the COMESA digital retail payment platform. Delivered findings to the COMESA Central Bank Governors' Meeting Technical Team.

Completed a Management Development Programme (MDP) for executive leadership and business management.

Studied Computer Science and Artificial Intelligence as part of a BSc program; studies were interrupted before final examinations due to prolonged illness.