Benjamin Acquaye Email & Phone Number

Frederick, Md, Us

Cybersecurity Maturity Model Certification (CMMC/CUI) Supports all activities outlined in the 800-171 (NIST SP 800-171) and Controlled Unclassified Information (CUI).Risk Management Framework (RMF) Activities: Support all activities outlined in the NIST SP 800-37, Risk Management Framework for Information Systems and Organizations. This includes the process for managing security and privacy risk, which includes information security categorization, control selection, implementation, and assessment, system and common control authorizations, and continuous monitoring.• Security Authorization Documentation: Initial development and, at least, annual reviews/updates of the FIPS 199, e-authentication, Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA), Security Plan (SP), Contingency Plan (CP), and Contingency Plan Test (CPT), and any other FedRAMP related security documentation.Security Control Assessment Response: Support all assessment activities by responding to interview questions and working with the system teams to gather appropriate evidence as directed by the client.Change Management: Review all change requests for potential impact on the system security posture.Continuous Monitoring: Review audit log and account management review artifacts.Software development: Gathering and analyzing the needs and constraints of the stakeholders. Updating and fixing issues post-deployment.• Vulnerability management: Intake Tableau vulnerability data and run daily compliance scans on Nessus Pro to check for new vulnerabilities/findings on Linux and Windows servers, for control failures. Check the Veracode platform for any new vulnerabilities and open tickets for any new ones. Open/Close tickets, update the Vulnerability tracker, and notate tickets on actions performed. Cross-check new findings on CMS Tableau, including CVE and KEV (Known Exploitable Vulnerabilities) with an internal scan. Create Corrective Action Plans for issue remediation.

Nebraska, United States

Develop Security Assessment Plans (SAPs) and Control Allocation Tables (CAT) to facilitate security assessment or continuous monitoring.Design, develop, and implement IT corrective action plans (CAPs) for self-identified deficiencies • Perform CAP validation testing for completed remediation activities.• Perform baseline review assessments to assess system readiness and remediate identified deficiencies.Develop risk-based approaches for prioritization of IT findings.Perform advisory services for risk management framework (RMF) activities to support system team IT control implementations by financial management overlay.• Review all findings with system owners, ISSO, and key stakeholders to confirm their understanding of security weaknesses for POA&M or Risk Based Decision (RBD) development.Examine, interview, and test procedures by NIST SP 800 Special Practices, and FIPS 199/200 specifications.• Perform vulnerability assessment of information systems to detect deficiencies and validate compliance using a management tracking tool.Schedule kick-off meetings with system owners to help identify the assessment scope, system boundary, and the information system's category and attain any artifacts needed in conducting the assessment.

Ohio, United States

Schedule and conduct working sessions/interviews with stakeholders to gather and analyze Security Controls implementation and the Information System Security posture.Develop Security Assessment Reports (SAR).• Perform security risk assessments on applications. • Provide technical risk assessments that inform the customer and provide a path for a secure environment. Track and update Plans of Action and Milestones (POAM) regarding the mitigation and remediation status.• Support the Security Assessment and Authorization (SA&A), FISMA compliance, NIST requirements and continuous monitoring for Security Controls.Track authorization expirations for different systems including General Support Systems (GSS) and Major Applications (MA).Participate in kick-off meetings and client interviews to complete the Risk Assessment, Security Control Assessment, and Plan Remediation Actions and Security Continuous Monitoring Plan.Update existing authorization packages throughout the life cycle of the Major Applications and General Support Systems according to NIST SP 800-37.Review systems information (information type, boundary, inventory, etc.) and categorize systems based on NIST SP 800-60.• Conduct security control assessments to assess the adequacy of management, operational, and technical controls security implemented. Security Assessment Reports (SAR) are developed detailing the results of the assessment along with a Plan of Action and Milestones (POA&M).

Schedule and conduct working sessions/interviews with stakeholders to gather and analyze Security Controls implementation and the Information System Security posture.Develop Security Assessment Reports (SAR).Track and update Plans of Action and Milestones (POAM) regarding the mitigation and remediation status.Support the Security Assessment and Authorization (SA&A), FISMA compliance, NIST requirements and continuous monitoring for Security Controls.Track authorization expirations for different system including General Support Systems (GSS) and Major Applications (MA).Participate in kick-off meeting and client interviews to complete the Risk Assessment, Security Control Assessment, and Plan for Remediation Actions and Security Continuous Monitoring Plan.Update existing authorization packages throughout the life cycle of the Major Applications and General Support Systems according to NIST SP 800-37.Review systems information (information type, boundary, inventory, etc.) and categorize systems based on NIST SP 800-60.Conduct security control assessments to assess the adequacy of management, operational, and technical controls security implemented. Security Assessment Reports (SAR) are developed detailing the results of the assessment along with Plan of Action and Milestones (POA&M).Create and update the following: Security Assessment and Authorization (SA&A) artifacts, Risk Assessments (RAs), Privacy Threshold Analysis (PTA), Privacy Impact Analysis (PIA), E-Authentication, Contingency Plan, Plan of Action, and Milestones (POAMs).Prepare Security Assessment and Authorization (SA&A) packages to ascertain that management, operational and technical Security controls adhere to NIST SP 800-53 standards.Conduct risk assessments including reviewing organizational policies, standards and procedures and providing advice on their adequacy, accuracy, and compliance with industry standards.

Develop, implement, and maintain the company's information security policies and procedures.Ensure that the company's information security program complies with applicable laws, regulations, and contractual requirements.Manage the company's information security risk assessment process, including the reporting and oversight of treatment efforts to address negative findings.Develops and implements assessments of business impact analyses (BIA's)Collects, reviews, interprets, correlates, and analyzes employee-related data to identify behaviors indicative of an insider threat utilizing a variety of classified and unclassified databases.Making sure the organization complies with security frameworks (eg FedRAMP, ISO 27001, CMMC, ISO 9001, NIST 800-171 CUI).Assist in maintaining ISO 27001 certification for the company, providing guidance and recommendations.Oversee the governance of IT-related projects and initiatives, ensuring alignment with security policies, best practices, and IT Risk Management principles.Provide our clients with advice and guidance to successfully achieve ISO 27001 compliance.Prepare and complete documentation packages to include SOPs, policies, plans, templates, and manuals which address all ISO 27001 requirements.Ability to produce customer documents like Statement of ApplicabilityLead ISO 27001audits engagement.

Implemented simple snapshots to replicate data among production databases.Participated in monthly health checks using tools we developed and frequently fixed production and non-production dashboard issues on OEM.Proactively managed standby replication methodologies.Responsible Managing User’s, groups, security, Audit, Schemas Object, such as tables, indexes and views, Making Database Backups and Performing Recovery When necessary, managing Various Logical and Physical backups Proactively monitoring the databases health and taking Preventive or Corrective action as required.Performed log-shipping mirroring replication and clustering.Managed end-to-end complex data migration.Migrated and refreshed data for numerous database environments using the Data Pump Utility table level, schema level, tablespace level, or entire DB) and RMAN in efforts for TSA Exits within HPE.Managed MySQL database, migrations, and upgrade.

Bachelor Of Science, Information Technology

Bachelor'S Degree, Computer Science