Jon Ford Email & Phone Number

United States

Served as Security Program Lead for a 20-year, $341 million cloud modernization project for financial, acquisition, and property applications for a US Federal Government Department.Maintained compliance documentation and assessed AWS GovCloud and Oracle Cloud Infrastructure (OCI) systems for security control effectiveness against NIST Risk Management Framework, FedRAMP, regulatory requirements, and department security policies to obtain the annual Authority to Operate (ATO).Achieved… Show more Served as Security Program Lead for a 20-year, $341 million cloud modernization project for financial, acquisition, and property applications for a US Federal Government Department.Maintained compliance documentation and assessed AWS GovCloud and Oracle Cloud Infrastructure (OCI) systems for security control effectiveness against NIST Risk Management Framework, FedRAMP, regulatory requirements, and department security policies to obtain the annual Authority to Operate (ATO).Achieved ATO for 13 FedRAMP Authorized Cloud systems, including the department's first Oracle Cloud Infrastructure implementation.Developed a cloud-specific vulnerability management program for multiple cloud environments.Led the transition to new scanning tools and improved reporting procedures, cutting costs by over $150,000 and enhancing vulnerability detection.Served as Privacy Lead, maintaining required documentation, assessing compliance with department policies and relevant standards and laws, and ensuring data protection at rest and in transit.Protected sensitive and private information of over 50,000 department employees, US citizens, and private businesses.Served as Client Data Protection (CDP) Lead, ensuring data protections complied with Accenture policies and standards.Developed new data storage standards, reducing actionable data leakage incidents by over 60%.Served as Risk Lead for Security Workstream, identifying project-level risks, tracking them through the project risk register, and collaborating with the Risk Management Lead on remediation.Led cross-functional incident response and remediation for the major vulnerability (log4j) release.Coordinated remediation efforts across Security, Technical Architecture, Network, Development, Vendor, and Cloud Service Provider teams.Successfully remediated all affected environments within 30 days. Show less

Washington Dc-Baltimore Area

Served as Information System Security Officer for seven financial and development applications for a Department of the US Federal GovernmentMaintained all applicable compliance documentation and assessed systems for security control effectiveness against the NIST Risk Management Framework, Regulatory Requirements, and Department Security Policies in pursuit of the annual Authority to Operate (ATO)- Constructed security awareness training materials and a monthly security newsletter… Show more Served as Information System Security Officer for seven financial and development applications for a Department of the US Federal GovernmentMaintained all applicable compliance documentation and assessed systems for security control effectiveness against the NIST Risk Management Framework, Regulatory Requirements, and Department Security Policies in pursuit of the annual Authority to Operate (ATO)- Constructed security awareness training materials and a monthly security newsletter to promote awareness of relevant security topics and strengthen the relationship between customer and security team.- Developed data-driven risk scoring methodology to provide guidance to Department leadership on where best to allocate security tasks and remediation efforts.- Produced project and enterprise-level risk presentations for Department Directors.Led Vulnerability Management team responsible for 100+ virtual machine servers in a department cloud environment.- Analyzed Infrastructure (Windows, Linux, Solaris) and Database (Oracle, SQL) vulnerability scans to ensure timely remediation of issues and compliance with internal and external (CIS and USGCB) baselines.- Scanned several custom and Oracle-based applications against OWASP Top 10, SANS TOP 25 vulnerabilities, common exploitable vulnerabilities, and security best practices.- Developed new vulnerability management processes and standards to ensure the program was compliant with Department and Federal Standards- New processes and standards became required policy bureau-wide.- Developed a new reporting template to significantly reduce reporting time by 80%Led Security team in preparing initial security package for new cloud-based application to pursue Authority to Operate (ATO) and FedRAMP Software as a Service (SaaS) Authorization. Show less

Washington Dc-Baltimore Area

Lead Continuous Monitoring/Vulnerability Management Program for information systems supporting a Federal Government Public User Portal-Compiled monthly reports for both Client and Accenture leadership.-Enhanced reporting template to significantly reduce reporting time-Updated Operations Guide for Nessus Vulnerability Scanning and Reporting.-Evaluated and Assessed Security Controls based on NIST RMF and Department policies.-Submitted Required Compliance Documentation… Show more Lead Continuous Monitoring/Vulnerability Management Program for information systems supporting a Federal Government Public User Portal-Compiled monthly reports for both Client and Accenture leadership.-Enhanced reporting template to significantly reduce reporting time-Updated Operations Guide for Nessus Vulnerability Scanning and Reporting.-Evaluated and Assessed Security Controls based on NIST RMF and Department policies.-Submitted Required Compliance Documentation, Configuration Management Reports, and Application Scans to Client and Accenture Leadership.-Managed Intrusion Detection System for Portal-Daily interactions with IDS service providers-Responsible for delivering any credible threats to CIRT-Compiled all events for Monthly Report to Client and Accenture leadership. Show less

Washington Dc-Baltimore Area

Assessed several new applications for a Federal Government Project as a Security Analyst for their initial authorization to operate (ATO).- Consulted with Director-level personnel, system administrators, and users to determine control implementation.- Reviewed applicable security documentation to assess compliance with overall Federal and Department Policies. - Assisted system administrators in researching sufficient actions to remediate issues found during the assessments.-… Show more Assessed several new applications for a Federal Government Project as a Security Analyst for their initial authorization to operate (ATO).- Consulted with Director-level personnel, system administrators, and users to determine control implementation.- Reviewed applicable security documentation to assess compliance with overall Federal and Department Policies. - Assisted system administrators in researching sufficient actions to remediate issues found during the assessments.- Developed test plans and procedures to evaluate implementation of technical controls on infrastructure and web applications.- Delivered ATO recommendation and assessment results to Directors and System Owners. Show less

Washington Dc-Baltimore Area

Assessed Accenture Delivery Centers and Data Center as a part of a global security team.- Examined location security documentation and observed employee operations.- Reviewed current location policies and procedures to discover deficiencies compared to corporate policies and security best practices. - Developed social engineering scenarios and test cases for testing employee compliance with internal policies.- Provided assessment results and policy recommendations to center… Show more Assessed Accenture Delivery Centers and Data Center as a part of a global security team.- Examined location security documentation and observed employee operations.- Reviewed current location policies and procedures to discover deficiencies compared to corporate policies and security best practices. - Developed social engineering scenarios and test cases for testing employee compliance with internal policies.- Provided assessment results and policy recommendations to center managers and Accenture leadership. Show less