EXPERIENCE SUMMARY

• Confidential is an Information System Security Officer leading in one of the most important federal agencies.
• He has experience supporting government agencies in the discovery of enterprise - wide system vulnerabilities and weaknesses, leading in the development of strategies and action plans to resolve findings or exceptions.
• Confidential is very knowledgeable with the Risk Management Framework process.
• Confidential prides himself on his strong time management, leadership experience, technical and communication skills, in addition to his demonstrated track record in providing exceptional client service.

SKILL:

• Cybersecurity Framework
• IT Security Governance
• Authorization & Accreditation (A&A)
• FISMA/FISCAM
• POAM's Development/Tracking as the result of an assessment or an audit finding
• Developing/Evaluating Secured Baselines
• Critical thinking/Innovation
• Vulnerability Compliance, and Patch Management scanning
• McAfee, Nessus Tenable, Patch Link, Burp Suite
• Active Directory Administration Microsoft Exchange SQL 2005, 2008 Windows Server (03, 08, 12), WIN (7, 10), IIS, SQL 2K8-2K5, ASP.Net, Apache, Tomcat, VMware, Remedy
• Inventory Management

WORK EXPERIENCE:

Confidential, Washington, DC

Information System Security Officer

Responsibilities:

• Proactively manage the creation, monitoring and determining the update status of POA&Ms to ensure weaknesses are resolved in accordance to their scheduled completion dates.
• Lead annual assessments in accordance Confidential Information Security Performance Plans
• Review and updated all security authorization documents as system changes occurred.
• Conduct Contingency Plan tests annually
• Perform system self-assessments as part of Immigration and Customs Enforcement (ICE) Ongoing Authorization program
• Monitor and respond to Confidential Information Security Vulnerability Management (ISVM)/Patch Management
• Maintain knowledge of inventory in accreditation boundary
• Leveraged Confidential mandated enterprise IA Compliance tools to monitor security posture of assigned systems (XACTA, Continuum, CDMT)
• Perform scan analysis based on vulnerability and compliance reports.
• Utilizing tools such as SPLUNK, WebInspect, and Nessus.
• Effectively work with project teams to ensure optimum security posture for respective systems.
• Managing the process of securing cloud-based systems that are hosted in the cloud (Amazon Web Services (AWS), Azure) accordance with the Federal Risk and Authorization Management Program (FedRAMP)
• Efficiently working with outside agencies to develop and document Interconnection Service Agreements (ISAs)
• Specialized knowledge and experience with the implementation of the NIST Special Publication (SP) 800 family of publications, particularly those associated with the Risk Management Framework. ( A )
• Effectively coordinated Authorization & Accreditation activities for assigned systems in conjunction with the Risk Management Framework (RMF) Phase 1-6.
• Develop waivers or risk acceptance memos to assist in the effective management of system risks
• Conduct bi-weekly meetings with project teams and system stakeholders to discuss secure posture of respective systems
• Develop Hardware Life Cycle for classified systems
• Support in the planning of Confidential construction to confirm build out is following Confidential Technical Specifications for construction and management of SCIFs

Confidential, Arlington, VA

Senior Consultant

Responsibilities:

• Conducts risk assessments within in multiple environments, general support systems and major applications discovering weaknesses, leading to creation of Corrective Action Plans (CAPs) or Plan of Action & Milestones (POA&Ms). Upon creation of CAPs, leads efforts in developing strategies/implementation plans to eliminate environment/system weaknesses
• Strong knowledge of Federal Information System Act (FISMA), Federal Information System Controls Audit Manual (FISCAM), and NIST Special Publications (FIPS 199, SP, SP, SP r4/5, SP Ar4)
• Leads development of Agency Security Policies, Standard Operating Procedures (SOPs), System Security Plans (SSPs), POA&Ms, Configuration Management Plans (CMP), Continuous Monitoring Plans, and Contingency Plans (CP) for information systems going through the Authorization and Accreditation (A&A) process (Phases 1-6)
• Consults clients on proper provisioning techniques for user accounts (privileged and non-privileged accounts) focusing on least privilege, and segregation of duties
• Leads teams in the security controls assessment (SCAs) process ranging from assessing security controls, reviewing vulnerability/configuration scans, reviewing evidence artifacts, reviewing agency security policies, system security procedures, security architecture diagrams, and providing recommendations to assist in remediating failed security controls leading to an Authorization to Operate (ATO) designation
• Trains, develops, and leads teams ranging from 3 to10 team members in supporting multiple government client engagements performing risk assessments, security control assessments, and leading in the improvement organization security posture
• Conducts monthly check-ins with team members to deliver feedback on engagement performance and to develop rapport with team members
• Conducts daily briefs with Deputy CIO, CISO, and system stakeholders detailing the current status of the security assessments.
• Prepares Security Assessment Report (SAR), Vulnerability Report (VAR), and ATO Memos to illustrate an accurate picture of the current security posture of systems for clients to assist in determining if the system receives an ATO designation
• Works directly with federal leads in developing and implementing project plans leveraging Integrated Master Schedules (IMS)
• Works with federal clients during the System Development Lifecycle (SDLC) applying security methodologies from cradle to grave
• Analyzes Office of Inspector General ( Confidential ) recommendations for clients leading to developing/implementing Plan of Action’s (POA’s) to successfully address the organizational weaknesses

Confidential, Arlington, VA

Senior Information Assurance Analyst

Responsibilities:

• Provided guidance and established strategies to ensure federal customers functioned in accordance with Federal Information Security Management Act (FISMA) and information assurance requirements, as well as agency and other organizational policies and procedures
• Audited systems to determine if they were meeting, exceeding or below department requirements
• Collaborated with system owners to remediate vulnerabilities
• Communicated findings to systems owners, and consulted them on remedial actions to assist in obtaining maximum ATO (Authorization to Operate)
• Developed Plan of Action and Milestone (POAM) reports to document system findings applying NIST Rev 4 Controls to findings
• Verified POAMS were close by system point of contacts before official closing of POAM
• Scanned systems using checklists and scanning tools, including McAfee, Patch Link, Nessus Tenable
• Participated in SQL Migration Project which involved converting over 100+ servers from SQL, and provided vulnerability scans and remediation
• Monitored the customer’s information technology architecture to ensure an adequate information security infrastructure is in place to meet day-to-day security requirements
• Ensured information systems are accredited and operating within an acceptable level of risk
• Ensured all information systems security related incidents and violations were immediately reported, data was collected, investigations were coordinated and remediated, through the use of impact assessments and on-going support
• Provided on-going physical and administrative security software support
• Responded to system identified deficiencies and defects and provided security program maintenance to various customers development and operations groups
• Created Authorization to Operate Recommendation Reports (ATOR) to be submitted to the CIO for authorization
• Trained Junior Analyst with vulnerability scanning, completing software/hardware checklists, POAM creation, and participating in finding meetings
• Created custom checklists using best practice and vendor specifications

Confidential, Ft. Meade, MD

Desktop Security Engineer

Responsibilities:

• Performed troubleshooting on PKI issues regarding email and identification via CAC Cards
• Completed software/hardware checklists, assisted in POAM creation, and participated in security artifact identification and finding meetings.
• Hardened workstations and Thin Client systems
• Installed Data Armor software on laptops, utilizing Full Disk Encryption
• Provided and support to Tier 1 and Tier 2 team members
• Maintained proficiency in incident management process
• Managed process for provisioning VDI accounts
• Performed troubleshooting on VDI issues, VMware Viewer Console (creating, ending, restarting sessions), creating pools for user virtual session
• Secured government assets in designated secure areas
• Trained users on proper IT Security Awareness

Confidential, Falls Church, VA

Security Specialist/PC Technician

Responsibilities:

• Assessed and tested technology controls throughout the SDLC business cycle.
• Trained users on IT Security objectives during new hire orientation
• Active Directory Administration- provisioned network, office communicator accounts, added and removed user from security groups
• Hardened laptops and desktops according to contract requirements
• Created and managed Outlook accounts through Exchange 2003
• Provided onsite and remote support for Confidential Corporate office and external offices, including more than 350 users
• Configured VDI Images to be implemented across several production environments for testing
• Facilitated the design and implementation of LAN within Confidential ’S
• Worked closely with project managers to coordinate IT support for business related projects
• Configured mobile devices in accordance with company security standards
• Created and troubleshot Blackberry accounts through BEZ Server
• Prevented data leakage and protected company integrity during employee separations via remote network administration