SUMMARY:

• Seeking Security Control Assessment Engineer, Cyber Security Analyst, Incident Response Analyst and Information Assurance position in growth and work on FISMA, system security monitoring and auditing; risk assessments; audit engagements, testing information technology controls and developing security policies, procedures and guidelines.

TECHNICAL SKILL:

• Windows, SQL Server, PeopleSoft, LAN/WAN, LDAP, Wireless Network, TCP/IP, ACL tools, Remedy, DMZ, IPS/IDS, Checkpoint, Cisco Routers/Switches, Arc sight, Sybase, Oracle Enterprise Manager, HTML, Microsoft, Windows, ISO 27001, SAN 20 critical security controls, PCI compliances, FIPS, STIG Tenable, Nessus, splunk, Linux, Qualys Guard, Web Inspect, McAfee IPS/IDS, websense, Fed - RAMP, Clouds and Sourcefire.

PROFESSIONAL EXPERIENCE:

Security Control Assessment Engineer

Confidential - Washington D.C

Responsibilities:

• Lead security control assessments based on a Risk Management Framework approach.
• Manage the overall security control assessment schedule as well as resource allocations to support assessment activities.
• Performed security assessments for multiple Cloud Service Providers (CSPs) and Federal Agencies, including DOE in accordance with Fed-RAMP and/or FISMA standards.
• Tested security control implementations for customers in accordance with control guidance documented in NIST SP 800-53 rev. 4. Testing included observing and analyzing firewall rules, verifying scan findings, testing multifactor authentication, analyzing logs, and other various technical tests to determine the state of each control.
• Identified major risks to the project and presented possible solutions to senior leadership for mitigation efforts. Examples of risks included the implementation of FISMA containers in the dashboard and the implementation of Role-Based Access Control within each Agency.
• Developed test case write-ups in Security Requirements Traceability Matrix workbooks to determine the implementation status of security controls and their enhancements and write findings for failed security controls.
• Identified major risks to the project and presented possible solutions to senior leadership for mitigation efforts. Examples of risks included the implementation of FISMA containers in the dashboard and the implementation of Role-Based Access Control within each Agency.
• Interface with the clients related to the overall security control assessment program and all security control assessment activities.
• Performed on-site and remote testing and interviewing with project leads, security engineers, and other relevant organizational personnel, such as Information System Security Officers (ISSOs), in regard to security control implementation at each organization.
• Examined and analyzed System Security Plans (SSP), Information Security Policies and Procedures, configuration settings, Plan of Actions and Milestones (POA&MS), and other official documentation to determine security control implementation statuses for customers.
• Provided compliance oversight in the preparation of obtaining Fed-RAMP certification for various national Data Centers
• Build Security Assessment Plans (SAPs) and Business Continuity and Disaster Recovery Planning and Testing
• Create Security Assessment Reports, Plan of Action and Milestone (POA&M) Reports.
• Conduct Security Testing based on NIST-800 53, NIST 800-53A and NIST 800-30.
• Generate Risk Scores on all Assessment Findings based upon NIST 800-30.
• Analyze results from vulnerability scanning tools such as Nessus, McAfee Vulnerability Manager (MVM), HP Web Inspect, QualysGuard, Redseal, AppDetective, Burp Suite, and Wireshark.
• Development and maintenance of security program documentation (security policies, procedures, standards, etc.)
• Analysis of security assessment findings, control implementations, and resultant security documentation updates (Plan of Action and Milestones, System Security Plans, etc.)

IT Security Analyst

Confidential - Gaithersburg, MD

Responsibilities:

• Conducted a kick off meeting in order to categorize agency's systems according to NIST requirements of Low, Moderate or High system.
• Risk Management Framework (RMF) assessments and Continuous Monitoring: Performed RMF assessment on several different environments using both scanning tools and manual assessment. Assessment included initiating meetings with various System Owners and Information System Security Officers (ISSO), providing guidance of evidence needed for security controls, and documenting findings of assessment.
• Member of the Governance, Risk, and Compliance (GRC) team, which provided high-level advisory cybersecurity advisory and auditing services, and the Cyber Strategy and Engineering (CS&E) team, which analyzed the state of security of clients and provided services to improve their security posture.
• Conducted IT controls risk assessments that included reviewing organizational policies, standards, procedures and guidelines.
• Performed evaluation of policies, procedures, security scan results, and system settings in order to address controls that were deemed insufficient during Certification and Accreditation (C&A), RMF, and continuous monitoring.
• Document and Review security plans (SP), contingency plans (CP), contingency plan tests (CPT), privacy impact assessments (PIA), and risk assessment (RA) documents per NIST 800 guidelines for various government agencies.
• Performed daily ongoing (A&A) Assessment and Authorization projects in support of client security system
• Review and update of the System Security Plan (SSP) using NIST SP 800-18 guidelines.
• Developed the audit plan and Performed the General Computer Controls testing of Information Security, Business Continuity planning and Relationship with outsourced Vendors.
• Identified existing governance structures, policies, and procedures at each Agency to weave the integration of new cybersecurity functions into their day-to-day operations.
• Assist in the development of Privacy Threshold Analysis (PTA), and Privacy Impact Analysis (PIA) by working closely with the Information System Security Officers (ISSOs), the System Owners, the Information Owners and the Privacy Act Officers.
• Specialized in the entire FISMA Risk Management Framework (RMF), SA&A/C&A and system control assessment processes using FIPS 199/NIST SP 800-60, NIST SP 800-53r4/53A, preparing and reporting SSP, SAP, ST&E, SAR, PII, PTA, PIA, IR, MOU, POA&M, as well as the Fed RAMP and COSO, COBIT, HIPAA Frameworks.
• Manage vulnerabilities with the aid of Nessus and Microsoft Baseline Security Analyzer (MBSA 2.3) Vulnerability Scanners to detect potential risks on a single or multiple asset across the enterprise network.

Cyber Security Analyst

Confidential - Houston TX

Responsibilities:

• Experienced in system classification and categorization using the RMF processes to ensure system CIA. This ensures compliant security control selections and implementation for continuous system protection.
• Coordinated with the Department's PII manager and investigated incidents where PII was lost and/or exposed and taking actions to mitigate potential losses, such as issuing remote wipe commands to lost mobile devices.
• Developed solutions to replace legacy Incident Response software and processes. This included reaching out to software vendors and developing business cases for change and conducting pilot tests of various software applications.
• Developed the audit plan and Performed the General Computer Controls testing of Information Security, Business Continuity planning and Relationship with outsourced Vendors
• Regulatory Compliance, Physical and Environmental Security, Project Management, Incident Response, and Disaster Recovery.
• Develop and conduct ST&E (Security Test and Evaluation) according to NIST SP 800-53A and perform on-site security testing using vulnerability scanning tools such as Nessus. Plans, System Security Checklists, Privacy Impact Assessments (PIA), Privacy Threshold Analysis (PTA), and System of Record Notice (SORN).
• Assisted in the development of an Information Security Continuous Monitoring Strategy to help companies in maintaining an ongoing awareness of information security (Ensure effectiveness of all security controls), vulnerabilities, and threats to support organizational risk management decisions
• FISMA Reports, Standard Operating Procedures (SOP) in accordance with Federal, Agency and Organizational policy, to include FISMA, NIST, OMB, FIPS instructions
• Developed an E-Authentication report to provide technical guidance in the implementation of electronic authentication (e-authentication)