- Lead security team in identifying risks and remediating vulnerabilities as part of a continuous monitoring program for a FedRAMP authorized Cloud Service Provider (CSP)- Configure vulnerability and compliance scans using Tenable.sc (Security Center), Nessus, Burp Suite, Qualys and DB Protect to ensure full and accurate coverage of operating systems, databases, and web applications- Collaborate with development and operations teams to ensure weakness remediation within defined time periods- Provide deliverables for monthly continuous monitoring and audit findings- Develop policies and procedures for a robust vulnerability management process resulting in seamless integration between operations, security and compliance teams- Create automation scripts and procedures for continuous monitoring reducing costs and enhancing efficiency of assessments and operations- Perform gap analysis on applications for development teams to evaluate significance of change requests in relation to security posture- Collaborate with the technical reviewers for the Joint Authorization Board (JAB) to discuss continuous monitoring and vulnerability mitigation processes and strategies- Participated in 12 successful assessments for a FedRAMP authorized moderate level CSP- Integrated vulnerability management process to ensure continuous monitoring compliance for a regulatory environment

- Partnered with Cloud Service Provider (CSP) clients to develop holistic strategy management plans to ensure compliance with FedRAMP- Assessed and advise CSPs in attaining the Authority to Operate for FedRAMP- Developed System Security Plans and perform security gap assessments for CSPs utilizing controls identified by FedRAMP- Identified weaknesses within CSP vulnerability management plans, create remediation policies and procedures, and oversee implementation- Developed Python and PowerShell scripts to automate the FedRAMP continuous monitoring process- Acted as project manager to create automated processes in alignment with FedRAMP to reduce labor costs and ensure sustainable future compliance for clients

- Assessed vulnerabilities, recommended improvements, and implemented solutions to minimize risk to the business- Developed security policies and documented processes and procedures to be used for compliance and training- Conducted vulnerability assessments on company assets and monitored systems, networks, firewalls and IDS/IPSs for potential breaches and remediated issues- Actively managed company infrastructure to ensure only authorized devices, software, and users were permitted access- Utilized Splunk and vRealize Log Insight to automate diagnostic reporting and log analysis- Implemented and maintained Incident and Response Management procedures and conduct functional testing with team to ensure containment, recovery, and eradication of any incident that may affect the organization- Worked with internal audit and external QSA to ensure companywide compliance under PCI DSS for a tier 2 vendor- Implemented data classification, control creation, process auditing, and data governance

- Focused on key operational, technical, and financial reporting controls within the assigned areas and scope for SOX audit- Detected operating deficiencies and proposed ways to remedy control failures- Identified mitigating controls to minimize risk exposures while adhering to established practices and SOX standards- Coordinated with team to meet client specifications for SOX compliance within a financial institution

- Tested software to ensure critical security practices were accurately addressed including separation of duties, input form sanitization, error message obfuscation to end users, and least privilege- Performed functionality, system, and performance testing to identify and communicate defects to developers then completed regression testing after defects were resolved- Organized defects and test results with the use of HP Quality Center quality management system