Information System Security Officer

• Oct 2022 - Present

Aquila Technology, Lincoln Laboratory 10/2023-Present Major Duties and Accomplishments • Provide cybersecurity support to Special Programs and validate the organization against cybersecurity policies/guidelines/procedures/regulations/laws • Develop input into the development and maintenance of System Security Plans (SSP) Plan of Actions and Milestones, Risk Assessment Report, and Continuous Monitoring strategy • Generate technical documents, incident reports, findings from computer examinations, summaries, and other situational awareness information to key stake holders • Ensure that plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections • Perform periodic cybersecurity reviews of network, system, and application vulnerability scanning, configuration assessment, and remediation • Interpret patterns of to determine their impact on levels of risk and/or overall effectiveness of the s cybersecurity program Show less

Senior Cyber Security Engineer

• Jun 2019 - Sep 2022

• ISSM for a large AF/Joint program Develop Program Protection Plan (PPP), collaborate on Software Assurance, Cyber Security Strategy • Identify requirements for Cyber Resiliency, and Cyber Survivability • Formulate an approach for the Risk Management Framework for an aircraft and C2 mission system • Lead the Cross Domain Solutions effort for Access, Transfer, and Multi-Level Security CDS • Develop System Requirements Document, and Capability Design Document Cyber section • ACAT I program include Aircraft, Mission Systems, Radar Communication, networking Show less

Senior Cyber Security Engineer

• May 2018 - Jun 2019

• Provide Cyber Security engineering services and consulting for Fast Moving R&D organization • Support Cyber Security effort for numerous programs involving proof of concept, experimental, pilot type programs, involving Ground Systems, Jet fighters, reconnaissance, and satellite communications • Develop strategic Cyber approach toward Moving Target Indicator Data Analytics project • Identify Cyber activities related to a Cloud Computing environment. • Support several Unmanned Aerial System (UAS) and counter UAS programs • Perform Technical Evaluation of a variety of proposals/SOO/SOW • Support IATT/ATO and Cross Domain Solutions projects Show less

Senior Cyber Security Engineer

• Nov 2015 - May 2018

• Information System Security Manager (ISSM) for various environments to include a Cross Domain Solution (CDS) • Achieve/Acquire ATO and DSAWG approval for a Cross Domain Solution • Achieve/Acquire ATO for a FVEY coalition network • Achieve first known Air Force Authorization To Operate (ATO) for a software application under RMF • Develop Distributed Common Ground Surface/System (DCGS) road map and plan on how to achieve an Authorization To Operate (ATO) under Risk Management Framework • Execute Risk Management Framework process for DCGS software only platform • Author of Security Plan, Security Requirements Trace-ability Matrix, Vulnerability Management Plan, and Continuous Monitoring Plan • Initiate Security Categorization for all data types, and analyze associated risks • Select security controls appropriate for a software platform and select various overlays for National Security Systems, Classified systems, and Intelligence Community for ISR systems and applications • Perform security control gap analysis and initiate developer work flows to close gaps • Review security artifact sufficiency, identify missing documents, or gaps in existing artifacts • Track security control implementation and develop metrics to trend status and improvement • Generate HP Fortify reports and create JIRA Tickets to fix vulnerabilities • Sustain Continuous Monitoring effort through scheduled and iterative security control review Show less

Cyber Security Engineer

• Jul 2013 - Nov 2015

• ISSO for ACAT 1 Major Automated Information System (MAIS) • Cyber Security team member performing DIACAP implementation • Authored the No Security Impact process for the AOC WS program • Reviewed Architecture, security boundary and overall topology • Audited and Validated Security Technical Implementation Guide (STIGs) implementation • Evaluated ACAS and STIG vulnerability output audited SCAP scanning effort • Reviewed and provided feedback on Cyber Contract Deliverable Requirements List (CDRL) • Developed strategy for IATT extension including incorporating a temporary large test suite • Reviewed HP Fortify findings and recommended prioritization of vulnerability mitigations • Perform DIACAP activities for a financial payroll and personnel ACAT 1 MAIS program • Perform Annual Security Review per FISMA requirement • Authored the payroll system Database security policy • Executed SCAP scan and STIG implementation effort including road map and schedule • Consulted on developing the baseline STIGed VM image Show less

Cyber Security Project Leader

• Nov 2011 - Jul 2013

• Author Risk Management and Threat Modeling procedures for the Industry Business Unit (BU) • Wrote BU Technical requirements based on for ISA/IEC 62443 standard for SDLA • Lead the Secure Coding initiative for the Industry BU • Lead the Industry BU Incident Response process; respond to ICS-CERT and Researchers • Interface with Legal and PR departments on Incident notifications • Author Cyber training and trained groups on various Cyber Security topics • Author Risk Management and Threat Modeling procedures for the Industry Business Unit (BU) • Wrote BU Technical requirements based on for ISA/IEC 62443 standard for SDLA • Lead the Secure Coding initiative for the Industry BU • Lead the Industry BU Incident Response process; respond to ICS-CERT and Researchers • Interface with Legal and PR departments on Incident notifications • Author Cyber training and trained groups on various Cyber Security topics

Security Officer

• 2005 - Jan 2011

• Member of Security Leadership Council, which sets global strategic initiatives in security and privacy • Collaborated, developed, implemented and maintained information security policies, procedures, standards and guidelines at both the global level and at the Business Unit (BU) level. • Developed and reported on metrics and key performance indicators relating to compliance and effectiveness of policies and procedures • Participated in global emergency and incident response for security and privacy breaches, including interfacing with high visibility customers, internal management, and legal counsel • Promoted and presented security and privacy education, training and awareness sessions • Cultivated effective partnerships with stakeholders to ensure security and privacy considerations in product development consistent with risk based security mitigations. • Authored risk assessment process/procedure for the BU • Built, led and motivated cross-functional teams in the risk management program, identified and recommended mitigation controls and tracked remediation to plan • Drove engineering and organizational changes through leadership, communication, and technical means. Monitored security landscape, researched industry trends, and recommended best practices. • Provided occasional wired and wireless penetration testing capability • Identified HIPAA/Meaningful Use compliance gaps and provided plan to mitigate • Leader in Philips global core DIACAP team working on Department of Defense Certification and Accreditation of medical products. • Lead BU effort to integrate static code analysis into various development teams Show less

Security Analyst

• 1998 - 2005

• Planned, designed, implemented and managed security architecture and strategy for corporate infrastructure to ensure confidentiality, integrity, and availability of data and systems. • Developed security policies, procedures, best practices and standards in an IT environment. • Conducted scheduled and unscheduled security audits • Ensured IT projects met security objectives and were consistent with business objectives. • Developed Disaster Recovery strategies. • Developed and led Incident Response effort, breach investigation, and hands-on response. • Installed, configured and maintained various perimeter and internal security protection • Troubleshot security, network, infrastructure, and application problems using protocol analysis • Correlated various security events from disparate systems to resolve security problems. • Deployed various infrastructure servers for example IIS, DNS, legacy WINS, AD servers. • Implemented redundancy e.g. clustering, load balancing, high availability, failover, RAID, etc • Planned, designed and implemented a series of wireless access projects • Designed role based access control matrix for protection of Oracle database instances. • Condensed server population through installation of SAN, NAS and ISCSI SAN array • Managed layer 2 LAN switching architecture, as well as routing • Upgraded domain from a Windows NT to Windows 2003 AD including Exchange upgrade. Show less

Security/Network Consultant

• 2002 - 2002

Consultant

• 1998 - 1998