Michael Deblock Email & Phone Number

Remote

Information Security Analyst within the Department of Veterans Affairs (VA), Quality, Privacy, and Risk (QPR), Strategy and Governance Division (SAGD), working remotely with minimal direct supervision. Work to ensure the Department’s Risk Management Framework initiatives are successfully implemented. Accomplished through authority to operate package reviews, security control assessments (review of NIST SP 800-53 rev4 control families), vulnerability assessments, code reviews, WASA scan reviews, and review of information system plans of action & milestones.Divisions subject matter expert on the VAs Governance, Risk, and Compliance (GRC) tool RiskVision. This tool is used for the processes of Assessment & Authorization (A&A) and the Continuous Monitoring of VA’s Information Systems. Responsible for training Division on RiskVision, and specific portions of the tool. Such as Plans of Actions and Milestones (POA&Ms), reviewing evidence to ensure compliance, and general how-to instruction of the tool.Also, responsible for training of the NIST SP 800-53 Rev 4, Access Control and Configuration Management control families, and the review of POA&Ms.

Provide assistance with the establishment and maintenance of a Department of Veterans Affairs information security program, at all levels of the organization as appropriate, and both clinical and administrative, ensuring the effective, efficient, and timely accomplishment of information security requirements recognizing the goals and measurable targets of the organization in which I work. Responsible for the auditing and monitoring of systems and users, through the use of event logs (EventsManager), http logs, McAfee ePOL, BigFix, LANGuard, Nessus, Active Directory, SCCM, PowerShell, and other enterprise resources.Responsible for providing Information Security subject matter expert (SME) support for two major VA projects: MyHealtheVet (MHV) and Health Risk Assessment (HRA). Working with and communicating security concepts to team members in Project Management, Development, Operations, and Senior Management. Recognized by senior Field Security Service management, for providing outstanding support to my customers on both of these projects and was named Customer Service ISO of the year.Responsible for assisting with accreditation and oversight activities including: Joint Commission, Federal Information Security Management Act (FISMA) OIG, CRISP, HIPPA, NIST SPs 800-37, 800-53 Rev4, etc.Responsible for ensuring remediation activities are in place and appropriate as they relate to: FISMA, and other Federal legislation and regulations by assisting in the completion or remediation of the corrective action plans, assigned metrics related to the systems I am responsible for, and at various levels of the organization.Responsible for review, reporting, development of recommendations and corrective action plans related to compliance with external and internal audits and other oversight activities both internal and external. Often includes sensitive information.

Currently assigned to Detachment 2, 136th Cyber Security Company, in a Critical Infrastructure Team (CIT). Responsible for cyber defense initiatives for critical infrastructure components in the region.Previously a member of the 4/124th Signal Training Battalion of the Vermont Army National Guard, supporting an Army wide course for Computer and Network Defense. The course is based around the incident response process for reacting to computer security incidents that the students may encounter while with their home units or while deployed as part of a computer and network defense team. The course covers many topics including legal and ethical considerations, secure router and switch configuration concepts and operating system security.Attended the National Guards CyberShield exercise as a member of the “Red Cell (Team)” or opposing force. Used tools such as nmap, Nessus, Metasploit, Cobalt Strike, and Dark Komet during the course of the exercise in order to scan, gain access, retain access, and affect “Blue Cell (Team)” systems and activities.Responsible for UNIX and Linux security instruction for the CNDT-OTE course. The students gain a better understanding of securing *NIX systems and servers they may see in their environments through this instruction. Topics covered in these classes include account management, security policies and enterprise level considerations for a secure *NIX environment. Use a variety of tools during the STX, for example BackTrack/Kali Linux, Metasploit Framework, CobaltStrike, nmap, Nessus, Social Engineers Toolkit (SET), along with creating custom (using Python/Ruby/PowerShell) software/applications in order to obtain and maintain access to systems involved in the exercise.

Currently responsible for instructing two courses for the College as Adjunct Faculty, the courses are Principles of Information Assurance, and Enterprise Security Management. Principles of Information Assurance, introduces students to basic security concepts. Which gives the students an understanding of the current threats and vulnerabilities found in today’s cyber landscape.In Enterprise Security Management students gain an understanding of the principles of risk management, security architectures, incident handling, disaster recovery, and secure systems administration.

End user system, software, network and device support for the White River Junction, VT VA Medical Center. Duties included fielding end user phone and in person questions and concerns in relation to their federal information systems.Acted as the Assistant Facility Information Security Officer January 2007 - October 2008. Providing initial Information Security support for the facility including access control for local system, PKI and VPN accounts.

Responsible for configuring and maintaining the School District’s Network Infrastructure, while monitoring usage statistics, and access for 400+ users. Job entailed maintaining five Windows 2003 Terminal Servers for the Districts thin client classrooms, while also maintaining a Windows 2000 Active Directory based Domain Controller, and an Exchange 2000 Email Server. For network infrastructure I maintained the districts firewall and hardware based email spam filter, along with a wireless infrastructure in the Franklin high school.