Kieffer Carranza Email & Phone Number

Washington, D.C

• Lead congressional system through Authorize to Operate by categorizing the information system and applying allocated, inherited and hybrid security controlso Ensure that the Information Technology Security Directive 5-410.1, FIPS, and NIST policies are followed to categorize and protect the CIA triad (Confidentiality, Integrity and Availability) of the congressional system.o Responsible for leading the congressional system through Authorize to Operate (ATO) using the System Development Life Cycle (SDLC) and the Risk Management Framework (RMF) requirements with the guidance of NIST SP 800-37 Rev 1.o Produce and propose a Work Breakdown Structure using MS Project encompassing all security related tasks to the Authorizing Official.o Provide bi-weekly briefings to the LOC Chief Information Security Officer (CISO) and weekly meetings with the System Owners.o Categorize the congressional system based on PII contents according to FIPS 199 and record it on Archer.o Conduct a Privacy Threshold Assessment (PTA) and a Privacy Impact Assessment (PIA) interview with the Information System Business Owner (ISBO) to classify the sensitivity of PII data.o Identify Common Controls to generate a Security Requirements Traceability Matrix (SRTM) and proceed with the selection of Security Controls for the congressional system utilizing NIST SP 800-53 Rev. 4.o Develop the Data Flow; Network; and Boundary diagrams using MS Visio, as part of the System Security Plan (SSP) on Archer and uploading supporting documentation on Confluence for a collaboration environment across team members.o Complete the Security Assessment & Authorization (SA&A) by producing a Contingency Plan, Configuration Management Plan, Continuous Monitoring Plan, Incident Response Plan, Security Assessment Plan, Security Assessment Report and other related documentation utilized by the Federal Information Security Management Act (FISMA).

Arlington, Va

• Asset Discovery-MSFT Security Baseline Configuration-Client Proposalo Perform asset discovery scans consisting of 50 hosts utilizing Nessus Professional and developing a monthly analysis report containing patching recommendations such as registry keys for the client based on findings.o Deploy Group Policy Object (GPO) using Microsoft Security Baseline Configuration across Windows 10 Pro Operating System workstations and implementing full disk encryption through enabling BitLocker.o Design a small business Security Network Diagram for new corporate office.o Collaborate in establishing a Data Retention Policy document regarding data archival requirements for client.o Participant of a Pink and Red team group effort to submit a client proposal to the Defense Information Systems Agency (DISA).

Staten Island, Ny

• Emergency Department Integration Software implementation to operate Electronic Prescriptions for Controlled Substanceso Support the launch of the Go-Live E-Prescribe system as part of the Allscripts team.o Troubleshoot the Emergency Department Integration Software (EDIS) application to make sure physicians could manage their Electronic Prescriptions for Controlled Substances (EPCS) medications.o Maintain the ticketing system in order to adequately process and respond to service requests.o Provision accounts and granted system access to medical professionals.o Supervised the team and was the point of contact to resolve any issues alongside with the Command Center.

Jersey City, Nj

• Web Service-Web Application-Thick Client Security / Penetration Testingo Conduct security reviews against corporate web-based applications, thick clients, and web services as a member of the Global Application Security Certification Team (GASCT).o Manually tested over 40 vulnerability assessments since date of hire, with a typical workload consisting of 10+ vulnerability assessments at any given time.o Maintain integrity and confidentiality of client information by ensuring appropriate safeguards are in place.o Identify application vulnerabilities including SQL Injections, Cross-Site Scripting, Denial of Service, Privilege Escalation, Cross-Site Request Forgery, SSL Protocols and Encryption, Cross-Frame Scripting, and Unmasked Sensitive data. o Utilize intercepting proxies, automated and manual security assessment tools for evaluating high-risk vulnerabilities (i.e: IBM AppScan, BurpSuite, SoapUI, Fiddler, SSLyze).o Understanding of the Two-Factor Authentication implementation.o Captured payloads in order to inspect parameters to evaluate both false positives and false negatives.o Security Operation Center experience in monitoring real time network and application traffic.o Analyze distinct impact risks to provide documented guidance to developers that define solutions into mitigating high-priority vulnerabilities in order to ensure PCI-DSS Compliance.

Hempstead, Ny

• Technology based consultant organization under the Frank G. Zarb School of Business at Hofstra UniversityTechnical Experience Includes:o Instruct MySQL Workbench and OpenOffice Calc classes utilizing a Raspberry Pi environment to 7th and 8th graders at the Progressive School of Long Island in Merrick, NY.o Structured the technology course curriculum for a local school.o iOS and Android Application Development.o Assemble Data Analytics Team for Cablevision.o Prezi presentation design for the Hofstra Undergraduate Admissions.o Alfresco Software Implementation for the Hofstra Zarb School of Business Syllabus.o System backup to re-image SD Cards for a local institution.o Website development of Global Green Distribution, LLC.o Create online training videos.

Hempstead, Ny

o Guided incoming first-year students through educating them in regard to the University’s resources, influencing them the importance of early networking, and escorting them around the academic buildings on campus.

Merrick, Ny

• Technology Course at a private schoolo Taught enthusiastic 7th and 8th graders who strived to learn MySQL Workbenchand OpenOffice Calc utilizing a Raspberry Pi programming environment.o Structured lessons and exams to be implemented in the Technology coursecurriculum.o Provided solutions such as re-imaging the SD cards when corrupted and/orproducing alternatives when other equipment issues arose.