Jon Ebersole Email & Phone Number

Toronto, On, Ca

Mclean, Va, Us

Identified and escalated cyber security operational risks across the enterprise to include cloud security, data protection, vulnerability management, security architecture & engineering, application security, identity & access management, and insider threat. Brought technical and operational subject matter depth and experience to risk management and risk mitigation activities.

Mclean, Va, Us

Alexandria, Virginia, Us

Establish and manage agency-wide risk-management program and all related activities. Oversee multiple risk-management functions, including risk assessments of current and proposed systems and applications, risk-register creation, risk-tolerance definition, risk prioritization, and risk remediation. Direct all aspects of IT auditing, including representing and defending NCUA policies, coordinating with auditors to ensure timely submission of requested documentation, interviews, and supporting evidence; and defending annual FISMA IT and financial statement audit findings. Monitor and assess overall compliance of organization with federal requirements and regulations through internal and external audits. Plan and coordinate automated threat assessments of systems and applications to identify risks and weaknesses. Recommend modifications and alternate solutions to minimize risks associated with identified threats and vulnerabilities. Liaise daily with developers, system architects, and system engineers in coordinating responses to situations that involve applying and adapting new IT risk management theories and standards. Collaborate with business units in managing IT risk assessment and risk management processes. Present regularly to senior management and executives on status of information security programs. Interact regularly with key representatives of government offices.* Acted as key adviser to executives on all matters pertaining to IT security, including regulatory compliance, and information security policy / procedural / control techniques.* Conceived and implemented information security program and managed all information security governance and organization-wide risk management strategies and activities.* Integral in planning and implementing formal privacy program in partnership with Office of General Counsel.

Alexandria, Virginia, Us

Oversee IT security for the independent federal agency that regulates, charters, and supervises federal credit unions. Held full accountability for overseeing all aspects of information security program. Directed team of six information security specialists covering HQ and five regional offices and 1,800 users in daily information security operations. Monitored and evaluated overall compliance of organization with federal requirements and regulations. Conducted regular internal and external audits, assigning teams to close all identified gaps or weaknesses. Liaised with cross-functional teams throughout Information Services organization to manage stakeholder relationships. Partnered with various business units to coordinate IT risk assessment / management processes. Facilitated strategic planning of future projects to ensure continued network security and cost-benefit analysis as evidence of IT security cost savings. * Orchestrated planning and oversight of agency information security program and all information security governance and risk management activities, leading to 50% reduction in Federal Information Security Management Act (FISMA) findings, 70% reduction in FISMA recommendations, and 80% reduction in financial statement audit (FSA) findings.* Spearheaded development and implementation of short- and long-range strategies for security system reviews to anticipate, identify, evaluate, mitigate, and minimize risks.

Alexandria, Virginia, Us

Functioned as information system security engineer for organization's headquarters, five remote offices, and disaster-recovery site. Performed various daily information security operations, including IT auditing and compliance, incident response, and disaster recovery for mission-critical systems. Facilitated monitoring and assessment of policies for ensuring compliance of organization's systems and applications to federal requirements and regulations through network-vulnerability assessments and web-application testing. Identified and resolved system gaps and weaknesses. Developed, updated, and enhanced information security policies and procedures. Enhanced and optimized existing policies and procedures. Trusted to advise senior management and executives regarding IT security. Reported to senior management and executives on information security.* Conceptualized, developed, and implemented majority of organization’s information security controls and programs.* Drove design and delivery of next-generation perimeter Palo Alto firewalls to improve visibility of users, applications, and content, resulting in improved ability to detect and prevent malicious traffic and high-bandwidth applications.* Architected, deployed, and maintained security event-alerting tools, intrusion-detection and -prevention systems, vulnerability scanning and management program, web filters, and email-spam filters. * Steered deployment of web-based proxy solution that decreased virus activity significantly.

New York, Ny, Us

Charged with conducting risk assessments on information systems based on National Institute of Standards and Technology (NIST) guidelines to support FISMA audits and client certification / accreditation activities. Performed regular, in-depth analysis and auditing of system-security posture by monitoring daily activities and developing security controls to identify system weaknesses and vulnerabilities. Conducted network-vulnerability assessments, as well as risk assessments and penetration tests of client internal and external networks. Planned and coordinated wireless network client-site surveys, vulnerability assessments, and penetration tests. Conducted build assessments of client server and workstation images to comply with industry best practices. Closely analyzed, improved, and re-configured client network device configurations. Recommended changes to existing policies, procedures, and controls to ensure compliance with requirements and to strengthen confidentiality, integrity, and availability of data. Liaised with client representatives daily, including preparation and delivery of final reports and presentations to executive-level staff, subject-matter groups, and government officials.* Demonstrated consistent record of success in identifying vulnerabilities in applications and systems and recommending countermeasures to reduce risk and maintain IT security certification / accreditation.* Provided integral support in selecting and implementing information security controls and technologies for clients in accordance with NIST and Federal Information Processing Standards (FIPS) requirements, as well as Office of Management and Budget (OMB) criteria.

Falls Church, Va, Us

Functioned as information security resource and point of contact for client's network, advising client on best practices to ensure confidentiality, availability, and integrity of data and systems. Supervised, trained, and coached top-notch team of security analysts / engineers. Planned and coordinated vulnerability assessments of client’s internal networks and web applications to determine effectiveness of security measures and to minimize system weaknesses and vulnerabilities. Conducted investigations into security events and information / network security breaches through log monitoring, and situation correlation / analysis. Performed in-depth analysis and optimization of server-image configurations and server-based applications to be deployed on client network. Created custom ArcSight scripts and dashboards to monitor performance and availability of client network and assist with problem diagnosis. Contributed to deployment and configuration of network devices such as switches and firewalls. Generated and disseminated technical and systems-security status reports.* Engineered, installed, and maintained automated network security-scanning servers, as well as intrusion-detection system and other security technologies for client network. * Established and implemented policies and standard operating procedures (SOP) for incident response, network-vulnerability scanning, and security testing of network infrastructure.

Sterling, Va, Us

Held accountable for performing vulnerability assessments and penetration tests of internal and external client networks, and conducting digital forensic investigations of suspect media. Planned and coordinated monitoring and in-depth analysis to assess effectiveness of security measures and to minimize system weaknesses and vulnerabilities. Facilitated wireless network implementations and configurations by conducting architecture reviews, site surveys, vulnerability assessments, and penetration tests. Evaluated internal and external web applications to ascertain effectiveness of security measures present in web-based applications. Maintained records of chain of custody, media duplication, evidence gathering, evidence analysis, and event reconstructions from digital forensic investigations. Aided clients in selecting and installing security controls and technologies. Reported to all levels of management on findings pertaining to policies, procedures, and technical implementation of security controls regarding critical network issues. Liaised regularly with key clients at all levels and managed client engagements / relationships. * Procured and implemented forensic tools and systems, including secure lab space and hardware infrastructure for supporting investigations.* Exercised capacity for conveying technical information clearly and concisely to technical and non-technical audiences, and for tactfully presenting sensitive issues to senior management.

Planned and executed security assessments and penetration testing on government and commercial networks. Monitored and analyzed web-application security including session tracking and application logic. Performed wireless network vulnerability assessments, including architecture reviews, site surveys, and penetration tests. Employed forensic tools to perform forensic investigations, conduct incident response, and reconstruction events. Coordinated validation of security of hardware configurations and software builds. Aided clients in augmenting existing security controls and technologies.* Authored clear, concise reports detailing complex technical data and information security situations to inform client representatives and senior management of critical network issues.