Glenn Gibson Email & Phone Number

Washington, Dc, Us

Washington Dc-Baltimore Area

• Providing support to federal government agency: Department of State.• Conducted assessments as team lead according to step 6 in the RMF process for the Department of State, ensuring compliance with NIST 800-53A guidelines. Responsible for tracking and closing POA&M’s for regular and high-class systems.• Experienced with providing RMF expertise on cloud service providers such as AWS and Azure in accordance with FedRamp guidelines.• Conducted interviews with stakeholders based on evidence provided to assess compliance with FISMA guidelines.• Provided an assessment of the severity of weaknesses or deficiencies discovered in the information system and its environment of operational and recommended corrective actions to address identified vulnerabilities.• Conducted High Value Assets (HVA) assessments as team lead to report on system security posture for DHS/CISA reporting.• Review artifacts as proof that security controls are performing effectively. • Developed documents and spreadsheets to assist the organization with POA&M closures and audits. • Analyzed vulnerability scan results from Tenable Nessus and other security tools.• Reviewed various security documents such as SSP’s, SAR’s, ISCP’s, IRP’s, and POA&M’s, for accuracy and updates.• Prepared the final HVA security assessment reports containing the results and findings from assessments to government lead and POC’s.• Assisted in training new SCA members on Dept of State guidelines and preparing RMF training materials for junior SCA team members.• Experienced in using GRC tools such as XACTA and Arch Angel.

Virginia, United States

Providing support to federal government agency: U.S. Coast Guard and Navy• Responsible for assessing security controls using NIST SP 800-53A. Reviewing supporting artifacts/A&A documents such as the SSP, IRP, ISCP, and Config Management plan, special memos that support the US Coast Guard Cyber Division Operations and other military systems.• Responsible for being the first line of support to send expert recommendations to assist the lead Security Control Assessor in making key decisions for multiple government systems. • Experienced with providing RMF expertise on cloud service providers such as AWS and Azure in accordance with FedRamp guidelines to update system documents and maintain agency security posture.• Participated in FedRAMP assessments reviewing cloud documents for compliance such as Nessus Scans, Database Scans, Penetration Test results, Application Security Testing results, Software Composition Analysis, Application Threat Modeling (ATM), and Security Configuration Compliance Data (SCCD) documents.• Experienced with preparing memos, updates, and written justifications on the security posture for military systems.• Prepared assessment guides and spreadsheets for system POC’s to track system progress.• Assisted with creation of Memo’s and system templates. • Assisted with conversion of government systems to Azure Cloud environment and preparation of interim authority to test (IAT) documents.• Conducted and assisted with creation of the Security Assessment Plan (SAP) and led kickoff meetings.• Used applications such as STIG viewer to review STIGS for systems• Reviewed vulnerability scan results from Tenable Nessus, DB Protect and other tools that support security posture.• Experienced with CSAM and EMASS as a repository to track information for government systems.• Assisted in training new SCA members and preparing training materials for junior SCA’s and government ISSO’s.

United States

Providing support to federal government agency: Department of Defense • Reviewed information system security documents and other A&A documents to determine if systems will receive or maintain ATO status.• Assisted in preparing the final security assessment report (SAR) containing the results and findings from the assessment according to step 4 of the risk management framework.• Provided an assessment of the severity of weaknesses or deficiencies discovered in the information system and recommended corrective actions to address identified vulnerabilities.• Monitored and prepared required actions and documents pertaining to the A&A of the system throughout its lifecycle, to include monitoring POA&M’s.• Reviewed and assessed all control families for multiple systems to include continuous monitoring.• Analyzed vulnerability scan results using Nessus and other tools.• Reviewed various system security documents such as (Control Family SOP’s, SSP’s, ISCP’s, IRP’s, etc.)• Reviewed Privacy documents such as the Privacy Threshold Analysis (PTA) and Privacy Impact Assessment (PIA) to determine if system privacy information is safeguarded and documented accurately.• Participated in FedRAMP assessments reviewing cloud documents for compliance such as Nessus Scans, Database Scans, Penetration Test results, Application Security Testing results, Software Composition Analysis, Application Threat Modeling (ATM), and Security Configuration Compliance Data (SCCD) documents.