Michael Cox Email & Phone Number

Maintained A&A packages consisting of an average of minimum seven (7) systems in the portfolio. Managed systems from throughout all six (6) steps of the RMF Process. Managed SSP’s, AP controls, and the Continuous Monitoring compliance process (SIA’s, POA&Ms, and annual SCA asssessments) for systems that had already achieved ATO’s or systems that were in the process of achieving an ATO. Also performed annual activities such as SCA reviews, Contingency Planning meetings, and TableTop exercises. Conducted daily and weekly meetings with the technical staff to assess the cyber posture of the systems in my portfolio

As the DTRA Information Systems Security Officer (ISSO), I provide support for program, system or enclaves information and system security. Provided support for enforcing information system security policies and standards. Maintained operation security for equipment that are being used on assessments by managing baselines, patches, and STIG’s. Managed and maintained AP Controls, POAM’s and Continuous Monitoringcompliance for Systems that had achieved ATO’s or systems that were in the process of achieving an ATO. Developed and maintained A&A packages for multiple systems based on RMF and organization defined guidance.Prepared and maintained artifacts such as Network Diagrams, HD/SF Lists, PPSM’s and scans for multiple systems to achieve ATO’s Completed monthly, quarterly, and annual compliance requirements of all of our systems.Utilized Nessus to scan systems for vulnerabilities in order to better assess the risk of systems. Created POAM’s to track mitigations and open vulnerabilities. Utilized STIG’s and SCAP benchmarks to secure all of our baselines Facilitated maintenance and review of artifacts for networks and information systems.Completed sets of High level SOPs/TTPs (Operational & Compliance) that:Improved the efficiency of the Installation/Configuration process of different applications/tools using our Step by Step detailed Operational guides

Assess and recommend mitigations to address system security threats/risks throughout the program life cycle; determines/analyzes and decomposes security requirements at the level of detail that can be implemented and tested; reviews and monitors security designs in hardware, software, data, and procedures; performs system certification and accreditation planning and testing and liaison activities; supports secure systems operations and maintenance, which includes: Develop and maintain A&A packages for information systems based on customer’s policy and guidance.Review and analyze systems architecture diagrams and networks.Used Nessus to scan systems for vulnerabilities in order to better assess the risk of systems. Created POAM’s to track mitigations and open vulnerabilities. Ensure compliance with annual FISMA deliverables and reporting.

Knowledgeable in NIST and DoD cybersecurity guidelines. Assisted with completing RMF Packages for JSP subscribers. Performs vulnerability/risk assessment analysis to support Assessment & Authorization (A&A). Prepares and reviews documentation to include System Security Plans (SSPs), Risk Assessment Reports, A&A packages, and Security Controls.Responsible for performing site assistance visits (SAV) to support Joint Service Provider (JSP) enterprise and subscribers in preparing for audits, inspections, assessments and similar compliance evaluation events. Utilized DISA (Secure Technical Implementation Guide) STIG Analysis Tools to assist Subject Matter Experts for DISA CCRI’s. Conducts SAV’s in accordance with applicable references and guidance; recommends areas for improving during inspection and review; and communicates and interacts at both a functional level with senior government inspections (CSI's). Utilized STIGS and Secure Content Automation Protocol (SCAP) tools to assist in preparation for CCRI’s.

Virginia, United States

STAGE II - Utilized DISA (Secure Technical Implementation Guide) STIG Analysis Tools to assist Naval Officers for Naval Cyber Security inspections (CSI's). Utilized STIGS and Secure Content Automation Protocol (SCAP) tools to assist in preparation for CSI's. Experience accessing SCADA/Industrial ControlSystems and proprietary onboard Naval Ship system software. Operated as Team Lead for the CSI Stage II Inspection team and liaison to Military Officers. Our inspection team also inspected/briefed personnel regarding open (Information Assurance Vulnerability Alerts (IAVA's) and ACAS/Retina vulnerabilities. (Started as a subcontractor with Apex Systems and was brought over as permanent employee)