D. Patrick Brown Email & Phone Number

Worldwide, Us

• Manage and lead a team of full-time employees and consultants• Provide guidance, coaching, direction, and mentoring to employees• Oversees the completion of data analysis/lineage, operational support requirements such as Service Level Agreements (SLAs) and control reports, and other technical/business support activities for the Approved Provisioning Points (APPs) as appropriate for the effort • Establishes project objectives, budgets, schedules, work plans, and performance requirements, and delegate assignments to subordinate• Establish and ensure consistent, timely and accurate reporting to management including metrics, issues and incidents, and overall project status • Exercises independent judgment and discretion in management • Prioritizes, plans and track progress• Regularly interact with senior management or executives on matters concerning various functional areas, divisions, and/or customers• Manage the day-to-day APPs initiatives/projects, resources allocations, project support, and strategic planning• Work on issues and risks of diverse scope where analysis of the situation, data as well as internal policies and systems require evaluation of a variety of complex factors• Partner and manage relationships and interaction with business and technical teams to ensure all parties understand requests, requirements, and process steps to ensure alignment and successful outcome• Manages the coordination of activities within team and across teams as appropriate• Demonstrates ownership of problems, issues, or requests from start to finish• Ensures compliance with Enterprise and SF Data Governance & Management risk and controls requirements Support testing and audit activities, as needed• Ensures adherence to documentation and controls requirements including upcoming artifacts, creating new assets as required and ensuring the documentation coincide with operational support practices• Provide after-hours support as needed for project deployments

Springfield, Va, Us

• Performed the day-to-day management of the overall Cyber Security Program for the Chief Information Officer (CIO) of the US Mint which included both the Operations and Compliance branches • Organized, directed, and coordinated the planning and production of all Cyber Security support activities for US Mint; by utilizing strong written and oral communication skills • Established and adjusted (as necessary) the structure to align with US Mint Business Units support activities with the Department of Treasury• Participated as a lead and as a member of the Federal Government-led team • Acted independently in an advisory capacity as the cyber security Subject Matter Expert (SME) with regards to program management • Prepared requisite review documentation and presentations as well as conducted briefings on behalf of the cyber security team to the US Mint • Organized all cyber security activities as they related to CIO projects, change requests, services, and release management • Provided cyber security SME liaison to clarify and promote identification and implementation of all the Federal law• Participated as directed in formal and ad hoc meetings and working groups representing the Cybersecurity team and/or coordinate specialized expertise within the Office of Cyber Security • Organized the administrative functions necessary to serve and support the Office of Cyber Security, primarily the CISO and Cybersecurity Branch Chiefs • Tracked and facilitated the review and approval of all significant policy/process/procedure documents maintained by the Office of Cyber Security • Organized and provided personnel tracking for on-boarding all employees, including, but not limited to, participating in on-boarding Human Capital activities, ensuring equipment is available of the day of employment and arranging for badging • Served in an administrative support capacity for the Office of Cyber Security using a wide variety of technologies and platforms

Reston, Va, Us

• Trusted cyber advisor to both Federal and Commercial customers, including large complex enterprise organizations, across the country • Strong project management skills and experience in creating and managing project plans, including budgeting and resource allocation• Security Liaison to the application teams for the implementation of the Open Web Application Security Project (OWASP) standards into the Software Development Life Cycle (SDLC) process • Familiarity with applicable legal and regulatory requirements, including, the U.S. Sarbanes-Oxley Act, the U.S. Health Insurance, Portability and Accountability Act (HIPAA), and the European Union Privacy Directive • Experience working with legal, audit, human resource (HR), and compliance staff • Providing risk management, governance, operations, and compliance services, utilizing our Risk Management Framework (RMF) methodology • Collaborate with key stakeholders, CISOs, Information System Security Managers (ISSM), and Information System Security Officers (ISSO) to develop an information security framework based on organizational risk and business requirements• Foster partnerships with business units, management, and peers to help promote security across organizations ensuring business objectives execution in a risk-controlled manner to address Information security risk-based frameworks, standards, and policies • Identify, prioritize, communicate, gain acceptances, and obtain funding for critical security projects and processes required for a successful RMF implementation • Develop budget projections based on short/long term goals and objectives of the CISO and key stakeholders • Monitor and report on compliance of regulatory requirements and policies, as well as the enforcement of security policies across the organization • Develop a standard set of security and risk management indicators to effectively communicate to upper management and track value to the organization

International Finance Corporation (IFC) is responsible for managing security strategy, operations and compliance activities for the company’s member institutions and protecting assets that total more than $628 billion of annual investments in poor and developing countries. In addition, IFC manages security across remote sites in over 180 countries across the globe. Develop, document, maintain and support the company's information security risk management program in line with the company's information security policy, practices and leading industry standards. Assist in defining IFC’s information security risks pertinent to its business goals and technology infrastructure and design an enterprise information security risk program to identify, assess and respond to risks. Maintain an up-to-date understanding of emerging trends in information security risks; apply new techniques and trends, in-line with overall information security objectives and risk tolerance of the company's, to the company's information security enterprise on appropriate fixes based on reviews and diagnostic tests performed. architecture. Document risk management policies, practices and procedures. Assess, evaluate, and recommend appropriate security controls to be integrated into the life cycle of software and IT infrastructure development and enhancement projects. Test for code vulnerabilities and advise developers. Recommend and devise solutions to ensure application and infrastructure development processes are secure and advise on potential vulnerabilities in the SDLC or of specific code vulnerabilities. Ensure adherence to the Enterprise Security Architecture, Internal Controls over Financial Reporting, and other risk and control requirements as necessary. Resolve challenging problems in collaboration with other infrastructure teams such as server team, network team, database team, and development teams on installation, troubleshooting, and problem resolution.

Assisted USDA Agency IT security personnel in the security certification and accreditation process, on an on-going basis, to ensure mission requirements are satisfied while meeting the security requirements and employing the security controls defined in the system security plan. Represented the operational interests of the USDA, OCIO and serve as C&A subject matter experts with regard to current NIST, FISMA, OMB and USDA IT security related initiatives, policies, procedures and guidance. Verified with agencies if any new systems are being developed or if older systems are planned for retirement. Served as personal liaisons for each USDA agency throughout the system development life cycle of each individual information system for each Agency. Maintained status of upcoming systems with expiring ATO’s to ensure timelines are met for Phase 1 and Phase 2 C&A processes. Conveyed USDA-level guidance and assistance in complying with current NIST, FISMA, OMB, and USDA IT security-related C&A guidance. Provided guidance to individual agencies with regard to existing, new or changing USDA IT Security C&A initiatives. Assisted and mentor Agency-level C&A personnel, including Agency ISSPM’s during all phases of the C&A process. Served as C&A subject matter experts to agencies. Validated Phase 1 and Phase 2 C&A status for each individual system based on the ATO expiration date. Kept up-to-date regarding each agency’s mission and purpose, as well as in-depth knowledge of their overall network and system-specific infrastructure for each system, for each agency. Reviewed all Cyber Security Assessment Management (CSAM) documentation for each information system listed within the agency to ensure compliance, completeness and validity. Trained agency field personnel on NIST 800-53 Revision 3 control conversion as trained by CSAM Administrator.

Fairfax, Va, Us

Evaluated the security posture of the Integrated Acquisition System (IAS), and makes recommendations to the System Owner, Certifying Authority and the Approving Authority. Provided technical vulnerability assessment of System, for USDA Office of the Chief Information Officer using FISMA, DIACAP, and other approved processes to include: using both automated vulnerability assessment tools (Gold Disk, eEye Retina, AppDetective, WebInspect) as well as manual testing scripts. Uploaded all C&A Phase I documentation into CSAM for both review and concurrency by the Phase II vendor and Cyber Security for PSD IAS MA. Performed security assessments, reviewed documentation, and support security analysts in a team of technically diverse personnel. Conducted and documented risk and threat assessments. Made recommendations for implementing countermeasures, prepared required documentation for and coordinated with senior engineer. Conducted engineering analysis and evaluation for security-related hardware, software, and system component evaluations. Developed and provided test plans and vulnerability reports to a team of Security Analysts according to, DoD, Federal, DISA and other Information Assurance (IA) related requirements. Kept abreast of emerging security technologies and made appropriate recommendations regarding their implementation. Provided direction, technical experience, and work assignments to direct other Consultants; reviewed work products for correctness and adherence to DoD, NIST, FISMA, and other IA Standards, and tracked progress against work schedules. Prepared deliverables and delivered presentations in all areas of expertise to colleagues, subordinates, and end-user representatives. Made coordination with the Task Manager to ensure problem resolution and user satisfaction. Interfaced with external customers to provide IA subject matter expertise throughout the system development lifecycle.

Us

Oversight of the daily Information Assurance (IA) activities. Performs schedule, risk, quality, security and administrative duties relative to IA to include supporting additions to current task. Provide senior level consulting to the PM Biometrics on IA subjects including program development, best industry practices, and enhancements of the Biometric Automated Toolset – Army (BAT – A). Implemented and managed all C&A documentation into eMASS for review by PEO EIS for PM Biometrics. Act as primary customer contact for IA activities, leading IA review session with the government to discuss schedule and technical performance. Task management – Assign duties to team members – ensuring adequate priorities of the tasks are appropriately staffed for coverage. Report all pertinent matters involving the security of programs, mission support systems, application to the Information Assurance Manager (IAM). Ensure all staff members receive annual IT Security Awareness Training and Security Responsibility Training. Provide management of Certification and Accreditation (C&A) activities serving in an advisory role to ensure all phases of the C&A lifecycle are performed. Conduct reviews of security related policies, audits of security programs, major application systems and associated information assets. Establish and maintain a remediation program associated with deficiencies in Plan of Action and Milestones (POA&M).

Mclean, Va, Us

Provide professional Information Assurance (IA) engineering specific to Certification and Accreditation (C&A), Department of Defense (DoD) IA policy & procedures, security threat/vulnerability assessments in support of Defense Information Systems Agency (DISA) at the Program Management Office (PMO) level. Knowledge of Federal Regulations such as the DoD Information Assurance Certification and Accreditation Process (DIACAP), Office of Management and Budget (OMB) Circular A-130, DoD Directive 8500.01, DoD Instruction 8500.02, and Department of Central Intelligence Directive 6/3. Independently develop and assess required documentation, such as System Security Authorization Agreements (SSAAs), System Security Plans (SSPs), Security Test Plans (STPs), Security Test and Evaluations (ST&Es) Results, Vulnerability Matrix’s (VMs), Plan of Actions & Milestones (POA&Ms), and Security Design Documents (SDDs). Advise the Program Executive Office Information Assurance Network Operations (PEO-IAN) of the C&A development capabilities and the lifecycle impact on current technology infrastructure. Implemented and managed all C&A documentation into eMASS for review by PEO-IAN DAA for PMO. Plan, manage, and lead the C&A programs for PEO-IAN. Change, update or develop C&A packages for Authority to Operate (ATO), Interim Authority to Operate (IATO), and Interim Authority to Test (IATT). Coordinate, interface, and provide tasking to Field Security Office (FSO), Configuration Management (CM), Program Management Office (PMO), and the Chief Information Office (CIO) on C&A processes and compliance. Present C&A process charts, briefing and training to the division. Liaison internal and external user community access to C&A information and identify areas of improvement. Collaborate across all lines of responsibilities and communicate at all project and program levels for the government leadership.

Reston, Virginia, Us

Provide application and network vulnerability assessment for Health Systems, for DoD Health Affairs and Services (Army, Navy, and AF) using DITSCAP/DIACAP process to include:oCertification Testing and Evaluation (CT&E)oSecurity Testing and Evaluation (ST&E)oUsing both automated vulnerability assessment tools (Gold Disk, eyeRetina, AppDetective, WebInspect) as well as manual testing scripts. Evaluate and assesses compliance with established information assurance policies and regulations. Conduct technical design reviews on products and designs. Perform security assessments, review documentation, and support security analysts in a team of technically diverse personnel. Conduct and document risk and threat assessments. Make recommendations implementing countermeasures, prepare required documentation for and coordinate with senior management. Develop certification evaluation and findings reports. Conduct engineering analysis and evaluation for security-related hardware, software, and network component evaluations. Evaluate security risk assessments and engineering change proposals. Develop and provide test plans and vulnerability reports to a team of Security Analysts according to Air Force, DoD, Federal, DISA and other Information Assurance (IA) related requirements. Keep abreast of emerging security technologies and make appropriate recommendations regarding their implementation.

Pocatello, Idaho, Us

Function as the technical authority for Information Technology (IT) security management. Areas include: ensuring the confidentiality, integrity and availability of systems, networks, and data through the planning, analysis, development, implementation maintenance, and enhancement of systems, programs, policies, procedures, and tools. Provide training, system documentation and troubleshooting guidance for on-site Intelligence personnel. Brief PM Intel project officers semiannually on C&A process. Implemented and managed all C&A documentation into eMASS for review by PEO EIS for PM Biometrics. Manage two certification and accreditation information assurance specialists. Provide mentoring to junior and mid-level engineers regarding IA best practices and solving complex problems. Manage Certification Test & Evaluation (CT&E) and Residual Risk Assessment (RRA) and determine technical recommendations for closing open vulnerabilities. Perform network vulnerability scans and analysis to produce CT&E and RRA reports. Create Federal Information Security Management Act (FISMA) scorecards for 41 programs [Program Management Intelligence (PMIntel)] to insure federal compliance. Managed all C&A documentation via Xacta for briefing for both the Certifying Authority (CA) and the Designated Approving Authority (DAA) for all 41 programs. Maintain in-depth familiarity with current exploits and vulnerabilities that are pertinent to the Windows, Solaris and Linux operating systems. Evaluate and recommend IA solutions that support the customer’s military based mission while maintaining functionality of the products and services in specific environments. Analyze and recommend solutions for IA based problems based on knowledge of IA products, an understanding of their limitations, and a working knowledge of the disciplines of IA (Common Body of Knowledge).

Computer helpdesk support for Facility Security Officers (FSO) nationwide interfacing with DSS to process clearances for DoD contractors. Desktop and laptop configurations, installation of hardware and software, troubleshooting user, printer, and network problems.

Bethesda, Md, Us

Provide technical analysis in data network planning, engineering, and design. Recommends tools and techniques needed to implement efficient solutions to network problems. Maintain technical expertise in various areas involving network and computer operation. Experience in developing system level requirements, test plans and procedures, concept of operation documents, life cycle cost estimates, and program acquisition schedules within the intelligence community. Create documents for operational and engineering tasks, procedures, and configurations. Configure and deploy servers and/or workstations for classified networks. Provide multi-tier support for systems to include setup and maintenance of user accounts. Perform software installations and upgrades to Windows/UNIX operations systems and layered software packages and maintenance. Evaluate, implement and manage appropriate software and hardware solutions for Windows/UNIX. Ensure recoverability of data/media by implementing a schedule of system backups and database archive operations. Support media management through internal methods, procedures and offsite storage and retrieval services. Conduct routine hardware and software audits of UNIX workstations/servers for compliance with established standards, policies, procedures and configuration guidelines.

Global, Us

Cyber Security Incident Response Center (CSIRC) Assigned within the Office of the Director of Information Systems Security for the Federal Aviation Administration (FAA), actively participated in a variety of information systems security (ISS) activities, to include monitoring of systems status, analysis of ISS reports, use of various antivirus, intrusion detection, forensics and vulnerability assessment tools, techniques and procedures, policy development, program analysis and review hardware/software evaluation and analysis, process improvement, data management, and coordination and reporting of ISS-related incidents. Participated in assembling, evaluating, installing and maintaining various intrusion detection sensors and associated soft ware applications. Submitted daily status reports to executive management personnel, and coordinated with all levels of agency, government and non-government ISS professionals, to ensure situational awareness regarding FAA information systems status, lines of business points of contact threats and vulnerabilities and viable solution to ISS related problems.

Mclean, Virginia, Us

Design and upgraded wide-area and local-area components of large network consisting of nationwide and overseas locations. Perform site surveys, network assessment, architecture design, and implementation. Experience in systems engineering, integration and network architecture design. Manage and conduct engineering site survey teams in support of engineering design functions and recommend appropriate solutions to implement the Transportation Network Component (TNC) and Information Presentation Component (IPC) solutions at Federal Bureau of Investigation (FBI) sites. Assess user environment, computer/network operations, and site requirements to support implementation of TNC and IPC. Analyze, evaluate, and recommend commercially available software and hardware capable of meeting system requirements. Assist with the engineering and development of a distributed, application service provider environment for FBI sites to ensure functionality within a new Trilogy environment. Coordinate and prepare for site survey; and provide advice and assistance to FBI Program Managers and site Trilogy points of contacts. Instructed survey team members, issue guidance, and managed site team during survey. Collect and collate site survey information, published Site Survey Reports and Site Upgrade Plans for FBI approval.

As member of the Army Computer Emergency Response Team (ACERT), serve as liaison with regional (RCERT) locations around the globe to resolve potential intrusion problems. Conducted in-depth analysis of intrusion alarms using various software packages including, Real Secure and Cyber Wolf. Evaluate, and monitor network activities, and provide technical support as the Network/security administrator in all areas involving computer intrusions. Identify network vulnerabilities, safeguards and recommend solutions for Internet Protection involving secure web/network. Experience with Windows NT and Sun OS/Solaris.

Us

Provide primary hardware support to 2600 end-users at the Pentagon for the Joint Chiefs of Staff. Perform server, workstation, and laptop troubleshooting for Win NT; Win 95, 98, and Win ME. Configure, deploy, and install classified and unclassified systems and execute system maintenance by replacing or repairing various internal H/W devices and application installation of Joint Chiefs of Staff approved software suites. Demonstrate knowledge of PC-based Hardware (PCs, Printers, Network Cards, Hard Drives, Memory, etc,) and Software (O/S and Application tools). Develop and implement system using the MS Office 98 for tracking incoming and outgoing CPUs, servers, laptops, printers, scanners, and various internal H/W devices for repairs and rebuilds.

Served as a network security analyst team member for the NISA-P. Single Agency Manager, perform network vulnerability analysis and reporting in UNIX Sun environment. Verify integrity of Pentagon-wide backbone networks through the use of various dispersed monitoring workstations. Aide seniors and co-workers by providing assistance in determining the cause and cure of system related day-to-day problems. Perform incident escalation, assessed probable impact and damages, identified damage control, and assist in developing course of action and recovery procedures. Perform annual benchmark tests on new hardware (CPU, servers, laptops) and software (various suites) for the Joint Chiefs of Staff which resulted in direct purchases.