Mike Guirguis, Cissp Pmp Email & Phone Number

Virginia, United States

Mclean, Va

• Manage day-to-day activities of IT work streams of financial statement audits and IT control projects for the Department of Defense, Department of the Navy, and the Department of Health and Human Services• Contribute to project delivery by designing and reviewing IT General and Application Control work plans• Develop client relationships, identify new business opportunities, and deepen sector and client knowledge• Collaborate among team members and junior staff; promoting an inclusive working environment• Lead the information technology portion of Federal Information System Security Audit Manual (FISCAM) audits, ensuring that IT system controls are properly implemented to safeguard financial statements for Department of the Navy and Department of Health and Human Services systems• Lead a Microsoft Office 365 Compliance Manager engagement, which developed customer actions that address both security and compliance with NIST 800-53, 800-171, FedRAMP, CSF, HIPAA, ISO 27001, and GDPR• Lead a Governance, Risk, and Compliance (GRC) development and deployment engagement for the Defense Health Agency (DHA) Defense Health Program (DHP)

Mclean, Va

• Led Security Control Assessment projects and tasks for over 18 Department of Energy, Office of Energy Efficiency and Renewable Energy (EERE) and Office of General Council (GC) information systems• Led Independent Verification and Validation (IV&V) project and team to ensure Plans of Actions and Milestones (POAM) items are properly remediated• Conducted stakeholder interviews to perform gap analyses and developed requirements for security assessments • Provided information security expertise to system development teams throughout the System Engineering Lifecycle process• Developed and provided a continuous monitoring methodology that includes software compliance and assurance and vulnerability assessments • Independently managed workload and provided guidance to less experienced staff• Performed security assessments of systems and networks and established strict program control processes to ensure risk mitigation• Recommended improvements and identified metrics for remediation of information security weaknesses• Contributed to the implementation of Tenable Nessus Security Center to aid in agency vulnerability management • Contributed to the development of Tenable Nessus compliance audit files to verify system compliance against agency approved standard• Developed Security Assessment Reports (SAR), documenting identified vulnerabilities and non-compliant security controls• Managed, trained, and mentored junior staff; educating them on firm policies, job duties, and guiding their career growth within the firm

• Led 32 Internal Revenue Service (IRS) Safeguards IT security audits of state agencies information systems housing IRS data and Federal Tax Information (FTI) across 21 states• Reviewed agency developed Safeguards Security Reports (SSR) and interviewed stakeholders to identify all systems that process, transmit, or store FTI• Defined and documented scope based on FTI walkthroughs• Led and conducted onsite security audits, using interviews, manual tests, and Security Content Automation Protocol Solutions (SCAP) such as Secutor Prime• Drafted Preliminary Findings Reports (PFR) and Safeguards Review Reports (SRR) to be presented to state agencies’ leadership, identifying non-compliant items and their risks • Built Corrective Action Plans (CAP) and monitored, validated, and tracked agency periodic responses to CAPs • Updated Safeguards audit testing methodology by implementing automated testing solutions such as Tenable Nessus Security Center, significantly reducing the length of audits while increasing the sample size and scope of tested systems• Developed Nessus audit files, reporting templates, and test procedures• Led training sessions for newly developed Nessus testing methodology

• Led Security Assessment teams to ensure information system compliance for 5 National Institute of Health (NIH) Major Application and over 20 National Oceanic and Atmospheric Administration Marine Fisheries (NOAA NMFS) General Support Systems and Major Applications across the United States• Developed Security Assessment Reports and Risk Assessment reports, documenting findings, performing qualitative analysis of their risks, and recommending mitigation steps • Ensured proper access controls are implemented for both system access and physical access to data processing facilities• Tracked client deliverables and presented weekly status updates to client

• Working alongside Information System Security Officers (ISSO), developed Security Assessment Authorization (SA&A) packages for 5 Department of Energy, Office of the Chief Information Officer (OCIO) systems allowing programs to receive their Authority to Operate (ATO)• Assessed compliance and updated 3 SA&A packages for the Office of the Strategic Petroleum Reserve (SPR)• Developed Information System Security Categorization documents utilizing FIPS-199 data types in accordance with NIST 800-60 • Performed Business Impact Analyses (BIA) and Privacy Impact Assessments PIA • Developed and updated the system security plan, documented configuration of system controls, and maintained POA&Ms • Performed NIST 800-30 based, qualitative, IT Security Risk Assessments on General Support Systems (GSS) and Major Applications (MA)