John supports the evaluation of information systems security controls and procedures and the translation of technical concepts and descriptions to create documentation in support of risk analysis. He develops risk assessment methodologies and implementation strategies leading to near real-time risk assessments. He determines risk/mitigation factors and is responsible for communicating systems’ security status to senior management. He plans, initiates, coordinates, and completes Certification and Accreditation (C&A) packages for IT and communications systems. John serves as a liaison between key organization components and across Federal agency boundaries on systems security documentation and concerns, and provides expertise on intelligence community security policies.

John was responsible for delivering corporate IT services to over 1500 geographically dispersed employees. He was responsible for the overall corporate security program including developing and implementing security policy, procedures, and standards. He conducted internal IT system audits, and created and maintained Plan of Actions and Milestones (POA&Ms) for corporate information systems. John assessed intrusion risks for systems and networks including risk analysis, solutions to risk factors, and mitigation strategies. As a member of the company’s engineering process group he advocated, coordinated, integrated, and supported process improvement activates across the organization. John established 21 distinct Policy and Procedure documents covering all major activities within the IT Department and he led the Department’s CMMI compliance. He also led development of the company’s continuity of operation and disaster recovery plans. John established standards based IT infrastructure architecture and greatly improved the quality of IT user support.

John led cross-site teams in the planning, design, and implementation of enterprise-wide information assurance (IA) and information security standards, Internet and Intranet services, email, directory services, desktop services, and communications infrastructure for the Army Test and Evaluation Command (ATEC). John was responsible for Department of Defense IT security policy compliance and monitoring network activity to determine if suspicious network security events required reaction and escalation. He performed routine reporting of events over time including trend analysis. John ensured the promulgation of enterprise standards throughout the organization in coordination with local site administrators. He also provided planning and directed installation and operations of enterprise management tools.

John managed outsourcing engagements for several government and commercial clients providing information assurance, information security, provision of on-site IT personnel, and enterprise management system implementations. He managed an IT group providing top-level administration and support of enterprise-wide mission critical systems for the nationwide 3500 seat, 12 site network of the U.S. General Accounting Office (GAO). John interacted with clients and recommended IA solutions based on an understanding of how products and services interrelated and supported the IA mission. Based on a review of the current IA policy, doctrine, and regulations he provided recommendations mitigating IA vulnerabilities.

John worked for three successive contractors at the Federal Aviation Administration including Digicon Corporation, Open Technology Group, Inc., and Advanced Management Technology, Inc. John provided technical management for LAN/WAN information security and help desk services for administrative departments within the Department of Transportation. He demonstrated analytic capability in working with monitoring tools and data correlation tools to detect and respond to network events. John supported incident escalation and assessed probable impact and damages, identified damage control, and assisted in developing courses of action and recovery procedures. He designed Intranet systems to deliver applications and information through structured authentication policies and file and directory permissions while maintaining appropriate levels of information security and data integrity. John led a team in support of an 800 node LAN including implementation of approved levels of security, configuration and execution of system backups, installation and maintenance of LAN based applications, and training and support of end users.