John Dewar Email & Phone Number

Washington, District Of Columbia, Us

Chief, Security Staff and Information Security Officer for AO Technology OfficeManages multiple programs to ensure IT security measures to protect all AOTO IT assets and Judiciary sensitive information by directing the implementation of AOTO's enterprise IT security program-portfolio.Principal cybersecurity advisor to the AOTO Chief and responsible for developing and managing the IT Security Governance, Risk Management, Security Operations and Compliance programs at AOTO, to support the strengthening of Judiciary cybersecurity posture. Recognized IT security expert with a strong background in cyber security, and a proven record of successfully leading "hands on" security program activities such as Providing Government oversight and program direction, leading security teams that include Subject Matter Experts (SME), developing and implementing security policies, procedures and guidelines, leading security risk assessments, establishing Vulnerability Management Program for Local Area Networks and National Systems, developing Information Security Continuous Monitoring (ISCM) Programs, and managing Incident Response teams that respond to organizational network and data breaches.

Washington, District Of Columbia, Us

Branch Chief, Judiciary System Security Testing TeamConducting IT security assessments and testing of national and court-developed pre and postproduction systems and applications to identify vulnerabilities, provide recommendations for their remediation, and assist system owners in implementing effective safeguards.Adapting current testing processes to align with rapid development, security, and operations (DevSecOps) processes. Developing security requirements that can be added to functional requirements so that security is built into products from the beginning. Providing resources and tools that will make it easier for development teams to adopt security requirements from the start.Managing the internal and external vulnerability scanning programs conducted by internal and external teams throughout the year to find and report on potential areas of weakness and validates reported remediations. Interprets and provides routine scan result reports and trends analysis.Serving as subject matter expert for the development, management, and execution of JSST services and work products.Performing research to identify potential vulnerabilities in and threats to new and existing technologies, and providing timely, clear, technically accurate notification to management of the risk potential and options for remediation.Responding to inquiries from System Owners, IT Directors, Court Unit Executives and other judicial employees on information security related issues.Creating and making recommendations for improvements to IT security resources, such as security guidelines, hardening standards, and best practices. Providing input on enterprise security tools in their configurations and implementations.

Washington, District Of Columbia, Us

Team Lead for Cybersecurity Operations in the Administrative Office Technology Office (AOTO). AOTO is a solutions provider for local endpoint solutions for four Administrative Office locations, and provides national cybersecurity services to all Federal Court Units.Manages a team of contractors responsible for Information Security Continuous Monitoring (ISCM), Incident Response, Patch and Asset Management, Vulnerability Scanning and Log and Event Management.Provides cybersecurity architecture guidance and operational oversight for technology projects within AOTO system boundaries. Major initiatives include implementation of network segmentation, network access control, and secure integration of three previously independent office locations into the AOTO system boundary.Liases with the Judiciary IT Security Office and Security Operations Center as necessary. Voting member of local and national change management boards. Owner of local and national vulnerability management programs.

Washington, Dc, Us

Member of the Information Security Division Operations Branch, responsibilities include providing technical oversight and guidance for Federal Employee and Contractor members of the team. Agency lead for implementation of Phase I of DHS Continuous Diagnostics and Mitigation program (Hardware Asset Management, Software Asset Management, Configuration Settings Management and Vulnerability Management). Operations and Engineering liaison for annual Payment Card Industry (PCI) Data Security Standards (DSS), A-123 Financial, and various Treasury Office of the Inspector General (OIG) network security audits. Participate in various internal working groups to provide secure designs for cloud based e-mail, secure mobility solution, and a cloud-based Web Content Management System. Designed a network segmentation and firewall security model to enhance the security of various United States Mint computing enclaves. Implemented Web Application Firewalls on all Internet websites. Implemented an Intrusion Detection System reporting to a centralized Security Incident and Log Event Manager at all U.S. Mint sites and Internet Access Points. Implemented Secure Web Gateway proxies and SSL inspection capabilities for web traffic. Implemented advanced in-line e-mail and web malware protection systems. Member of the Vulnerability Management Working Group, Infrastructure Working Group, Change Control Board and Engineering Review Board to provide security advisories for new and existing technologies at the United States Mint. Responsible for performing vulnerability scans and penetration tests. Performed Forensic Analysis on several computer security incidents. Assisted in OIG and General Counsel investigations as required. Received “Outstanding” performance ratings in all rating periods.

Reston, Va, Us

Member of the Information Assurance Governance team at a federal agency. Responsible for: evaluating, improving and developing information security related processes and policy, and identifying policy gaps and related impacts for the customer. Plays a key role in evaluating new technology for potential security vulnerabilities--to include SCADA and Mobile technologies--and assists in ensuring secure communication paths between the customer and other agencies and organizations as well as providing risk-based recommendations to the customer. Application security subcontractor for large application development project at a federal customer. Advised the prime contractor in aligning their SDLC with FISMA requirements. Supported the Assessment and Authorization of FISMA-inventoried systems. Analyzed network- and application-level vulnerability scans and provided recommendations for remediation of common vulnerabilities, including but not limited to Cross-Site Scripting, SQL Injection, and Cross-Site Request Forgery. Worked with application developers to encourage secure coding practices based on OWASP Top 10 application security risks and MITRE Top 25 CWE. Member of the Software Engineering Process Group, overseeing development of security requirements into coding standards and change management processes. Developed training materials on common web application security risks for the development staff, implemented a developer training program.

Dublin 2, Ie

Infrastructure Security Lead for project teamDesigned infrastructure security solution based on RFP response to the clientProcured and implemented infrastructure security components (AntiVirus, HIDS/HIPS, File Integrity Management, Vulnerability Scanning, Application Scanning, Source Code Scanning)Supported client security testing of the solutionCreated client deliverables in accordance with NIST recommendations, including Patch Management Plan, Security Configuration and Change Management Plan, Security Audit Plan, Incident Handling, Monitoring and Response Plan Provided input to the System Security Plan and IT Contingency PlanDefined Service Level Objectives for ongoing operations phase of the project

Falls Church, Va, Us

Deployed and managed endpoint security products: Endpoint and E-Mail Anti-Virus, Host Intrusion Prevention, Application WhitelistingCoordinated and improved processes across multiple functional security teams: Endpoint Protection, Perimeter Security/Firewall, Internal Security/Firewall, and Computer Security Incident Response (CSIRT)Performed annual performance evaluations for direct reportsReceived "Excellent" feedback rating from the client every month

Falls Church, Va, Us

Maintained Tenable Nessus and SecurityCenter vulnerability and configuration compliance scanning infrastructure with custom MySQL backend for over 100,000 endpointsPerformed remote and on-site ad hoc scans in support of Certification and Accreditation effortsReduced enterprise vulnerability and compliance scan cycles from two weeks to three daysAssisted in the product selection, design and implementation phases for McAfee Foundstone and Policy Auditor infrastructure to replace the Tenable solutionUtilized Vulnerability CVSS scores to provide input to a highly visible cross-bureau Site Risk Scoring initiativeDeveloped custom SCAP content for Compliance Scanning based on internal system configuration documentationDesigned and Implemented web application vulnerability scanning capability with HP WebInspectSat on the Department's Software Vulnerability Management Group responsible for accelerating the Department's Patching and Vulnerability Mitigation cyclesProvided customer support for field support staff at over 120 U.S. Embassies and Consulates; including international travelReceived the 2009 NSA Frank B. Rowlett Award for Organizational Achievement (Department of State Site Risk Scoring Team)

Falls Church, Va, Us

Monitored for and responded to computer security incidents on the FDIC network on a 24x7, on-call basisMonitored and investigated alerts from network- and host-based security sensorsEvaluated Vulnerability Notifications and Suspicious Activity Reports from vendors to determine applicability and impact to the environment, issuing advisories when appropriate

Falls Church, Va, Us

Responsible for timely verification and completion of customer application, network resource, and database access requests

Global, Us

Provide computer support as required.

Ms, Information Assurance

Bs, Info Tech, Information Security And Network Administration