Mike Guirguis, Cissp Pmp Email & Phone Number

Virginia, United States

Mclean, VA

• Manage day-to-day activities of IT work streams of financial statement audits and IT control projects for the Department of Defense, Department of the Navy, and the Department of Health and Human Services
• Contribute to project delivery by designing and reviewing IT General and Application Control work plans
• Develop client relationships, identify new business opportunities, and deepen sector and client knowledge
• Collaborate among team members and junior staff; promoting an inclusive working environment
• Lead the information technology portion of Federal Information System Security Audit Manual (FISCAM) audits, ensuring that IT system controls are properly implemented to safeguard financial statements for Department of.
• Lead a Microsoft Office 365 Compliance Manager engagement, which developed customer actions that address both security and compliance with NIST 800-53, 800-171, FedRAMP, CSF, HIPAA, ISO 27001, and GDPR

Mclean, VA

• Led Security Control Assessment projects and tasks for over 18 Department of Energy, Office of Energy Efficiency and Renewable Energy (EERE) and Office of General Council (GC) information systems
• Led Independent Verification and Validation (IV&V) project and team to ensure Plans of Actions and Milestones (POAM) items are properly remediated
• Conducted stakeholder interviews to perform gap analyses and developed requirements for security assessments
• Provided information security expertise to system development teams throughout the System Engineering Lifecycle process
• Developed and provided a continuous monitoring methodology that includes software compliance and assurance and vulnerability assessments
• Independently managed workload and provided guidance to less experienced staff

• Led 32 Internal Revenue Service (IRS) Safeguards IT security audits of state agencies information systems housing IRS data and Federal Tax Information (FTI) across 21 states
• Reviewed agency developed Safeguards Security Reports (SSR) and interviewed stakeholders to identify all systems that process, transmit, or store FTI
• Defined and documented scope based on FTI walkthroughs
• Led and conducted onsite security audits, using interviews, manual tests, and Security Content Automation Protocol Solutions (SCAP) such as Secutor Prime
• Drafted Preliminary Findings Reports (PFR) and Safeguards Review Reports (SRR) to be presented to state agencies’ leadership, identifying non-compliant items and their risks
• Built Corrective Action Plans (CAP) and monitored, validated, and tracked agency periodic responses to CAPs

• Led Security Assessment teams to ensure information system compliance for 5 National Institute of Health (NIH) Major Application and over 20 National Oceanic and Atmospheric Administration Marine Fisheries (NOAA NMFS).
• Developed Security Assessment Reports and Risk Assessment reports, documenting findings, performing qualitative analysis of their risks, and recommending mitigation steps
• Ensured proper access controls are implemented for both system access and physical access to data processing facilities
• Tracked client deliverables and presented weekly status updates to client

• Working alongside Information System Security Officers (ISSO), developed Security Assessment Authorization (SA&A) packages for 5 Department of Energy, Office of the Chief Information Officer (OCIO) systems allowing.
• Assessed compliance and updated 3 SA&A packages for the Office of the Strategic Petroleum Reserve (SPR)
• Developed Information System Security Categorization documents utilizing FIPS-199 data types in accordance with NIST 800-60
• Performed Business Impact Analyses (BIA) and Privacy Impact Assessments PIA
• Developed and updated the system security plan, documented configuration of system controls, and maintained POA&Ms
• Performed NIST 800-30 based, qualitative, IT Security Risk Assessments on General Support Systems (GSS) and Major Applications (MA)