Michael Johnson - Ms, Cissp Email & Phone Number

Nashville, Tn, Us

Hunt Valley, Md, Us

Franklin, Tn, Us

Accountable for defining and delivering security strategy and capabilities across the enterprise for infrastructure, product development, technical services, and cloud services. Responsible for risk governance while strengthening productive relationships with all business unit leaders, acting as a true partner, and making security a business enabler. • Strategy: Advised executive leadership and board members on emerging threats and risks with potential to undermine the company’s goals and evolving needs. Recommended practical solutions for risk reduction. Reduced cyber insurance costs while preventing ransomware attacks by implementing proven controls around privileged identity management, logging and monitoring, and IT governance checks. • Security Services: Created security services under the MEDTEAMS organization consisting of managed defense and response (MDR) and virtual CISO offerings. Reduced costs while focusing on growth by identifying opportunities to utilize existing tooling and in-house expertise and processes. • Regulatory Compliance: Managed 4 annual System and Organization Controls (SOC) type 1 & 2 reports to assure our clients their sensitive data remained secure within the MEDHOST ecosystem.• Team Development: Hired, developed, evaluated, rewarded, and retained a highly qualified team of security professionals. Fostered a culture of innovation, transparency, and accountability. • Security Operations: Refined metrics and dashboards for managing security effectiveness and for measuring risk reduction efforts to drive continuous improvement. Implemented dev/sec/ops framework to reduce change defects and increase implementation velocity. Assisted IT in achieving 98% success rate on planned changes, and 99.99% uptime. Improved patch testing and automated deployment timelines to decrease risks from vulnerabilities. Implemented next-generation firewalls segmenting client traffic blocking medium, high, and critical threats.

Franklin, Tn, Us

Led security operations center, threat and vulnerability, and engineering teams responsible proactively identifying and mitigating risks. Utilized incident data to architect, design, and implement monitoring and controls reducing risk of a significant compromise.• Governance: Chaired the Security and Compliance Governance Committee responsible for security, IT strategy, and execution. Members included CFO, CIO, CISO, CTO, CMIO, General Counsel, and others. Maintained the security risk register mapping risk strategy and driving project creation. Proactive approach led facilitated improved alignment amongst teams and reduced expenditures by managing risks early.• Security Operations: Implemented an enterprise 24 x 7 security operations center (SOC) to monitor and support applications and infrastructure, reduced operational impact by almost 1,200 events annually. • Firewall Migration: Successfully migrated 120 firewalls from Cisco to Palo Alto networks. Inserted large, enterprise firewalls between facilities and primary data centers forcing segmentation of traffic.• Divestures: Represented information security and security design for multiple hospital divestures as CHS reduced its portfolio from 200 hospitals to under 100.

Franklin, Tn, Us

Managed a growing Information Security Department for an acute care hospital system consisting of 200 hospitals that include Architecture, Engineering, Identity Management, Risk Management, Threat and Vulnerability Management, and Support Services.• Governance: Aligned Information Security principles through a risk management framework to assess, remediate, and mitigate enterprise risk through the solution delivery lifecycle to support the operations of the business.• Incident Response: Responsible for coordinating incident response and subsequent controls for a 2014 data breach by a Chinese nation-state threat actor. • Meaningful Use: Coordinated annual Meaningful Use security compliance audits and remediation of action plans across 200 hospitals and ~5,000 clinics.• PCI/DSS: Implemented the initial PCI/DSS standards for the storage, transmission, and processing of credit card data.• Employee Retention: Maintained the highest level of employee satisfaction results across multiple years by developing, coaching, and mentoring young leaders, providing training opportunities to close gaps in career development programs, and conducting routine evaluations.• Windows XP migration: Led the successful migration of Windows XP to Windows 7 for 70K workstations introducing application rationalization and zero-touch automation to convert 500 machines per day. • HMA Acquisition: Coordinated with peers to complete a $7.6B acquisition by identifying synergies and consolidating security controls.

Franklin, Tn, Us

Managed multiple teams including regulatory compliance, threat and vulnerability, and engineering for a young information security department with 23 direct reports.• Regulatory Compliance: Identified potential issues, coached IT Directors, and implemented monitoring controls to reduce Sarbanes-Oxley issues identified by CHS internal and external auditors. Controls eliminated all medium, high, and critical SOX findings for a two-year period.• Software Compliance: Responsible for enterprise software compliance for 70K workstations and 16K servers. Developed a portal to track software entitlements and compare against Microsoft data to reduce unexpected software audit exposure. Negotiated $10M dollar software deals with Microsoft and Oracle.• Threat and Vulnerability Management: Rebuilt a threat and vulnerability management team who had struggled with a recent penetration test. Subsequently, the team effectively detected multiple unannounced audits reducing finds by 50%, increased security controls, and mitigated low-level malware withing the company.

Nashville, Tn, Us

• Incident Response: Led the computer security incident response team (CSIRT) partnering with legal and ethics teams. • Malware: Identified and responded to network outages resulting from network worm activity; SQL Slammer and Conficker. • Tool Development: Developed tools to aid in detecting, tracking, and tasking security alerts. Designed and implemented a network packet broker using Cisco switches to replicate traffic to intrusion detection (IDS) devices across data centers and shared service centers. Implemented and tuned WAF, firewalls, and IDS signatures. • Attack and Penetration Testing: Successfully detected attack and penetration testing over a 4-year span. Recruited and trained security engineers of which several are now security executives.

3/100th Training RegimentMichael served 14 years with the Tennessee Army National Guard and the Army Reserves. His last assignment was as instructor with the 3rd/ 100th. Michael's occupational specialty included a Mobile Subscriber Radio Operator as member of the Signal Corp.

Master Of Science - Ms, Cybersecurity And Information Assurance

Bachelor Of Science - Bs

Graduated