Neil Frank Email and Phone Number

• Partnered with Maryland State Department of IT implementing NIST SP800-53 Risk Management Framework (RMF) with the goal of attaining ATO for all platforms and applications.• Performed enterprise-wide information security risk assessments, including the reporting and oversight of risk plans-of-action to address findings.• Evaluated and advised on implementation and effectiveness of security controls for compliance with applicable information security laws, regulations, and policies.• Provided analysis and guidance for system security artifacts: Privacy Impact Assessment (PIA), Security Impact Analysis (SIA), System Security Plan (SSP), Plans of Actions and Milestones (POA&M), and Authority to Operate (ATO) packages.Addt’l exp with: AWS, Okta, ServiceNow, Monday.com

• Provided interpretation, guidance, and credible challenge for both internal and external compliance/policy adherence and risk related controls. • Coordinated with lines-of-business, development, and infrastructure units for over 50 applications to identify IS risks and appropriate controls ensuring subsequent mitigation of risks and gaps.• Monitored application vulnerability assessments and performed in-depth risk assessments for applications hosted using AWS/Azure (PaaS, IaaS, SaaS etc), internal or hybrid models• Provided IS oversight and guidance to internal business units requiring 3rd party and/or additional systemic connectivity.• Member of internal CVSS threat assessment tool development workgroup.• Member of internal Information Security Risk Assessment workgroup.Addt’l exp with: RCSA, GRC, Jira, Archer, CI/CD, APIs

• Developed Information Security policies and procedures in compliance with Federal regulations. • Managed Program risk by analyzing root cause of security issues, impact to technology, and required corrective actions leveraging advanced analytical skills.• Managed Security Operation Center (SOC) collaborating with security engineer direct report in monitoring best-in-class information security systems.• Engaged outside vendors for annual systems/platform penetration testing.• Collaborated with Governance, Risk & Compliance group during both internal and external 3rd vendor audits and risk assessments/inquiries supporting our systems/role as a vendor.• Developed and implemented cross-platform Incident Response policies and processes.Addt’l experience with: AlertLogic, Cloud Passage, Duo/RSA MFA, CrowdStrike, Rapid7, Sophos, KnowBe4, Qualys, Veracode, Vormetric, Digital Guardian, TPRM, Akamai

• Developed and maintained Cyber security policies & procedures for LAN, WAN and web-based architectures.• Conducted risk and vulnerability assessments as ISSE for NAVAIR client T-45 contract. • Managed & executed DIACAP-to-RMF transition for NAVAIR contracts.• Established virtual ACAS scanning capability for NAVAIR program office.• Implemented Corporate Cyber security training for development staff to satisfy DoD Application Security & Development STIG requirements.• Established and maintained Corporate NIST SP 800-171 CUI compliance.• Established Application Vulnerability scanning tools & process using OWASP ZAP• Secret Security Clearance obtained.Addt’l training/experience with: Nessus/Tenable ACAS, eMASS, DADMS, SCC/SCAP, STIGs, ISO 27001, FedRAMP

• Contributed to engineering and STIG implementation activities for DoL/DoT hosted environments.• Managed international enterprise Network Operations Center (NOC) Microsoft Active Directory network OS and directed workflows among 3-5 helpdesk technicians and 2-3 network engineers.• Contributed to the development of annual IT budgets of more than 1.5 million.• Enforced internal controls that maintained corporate SAS70/SSAE16/SSAE18/SOC compliance.• Project lead for enterprise MS Exchange deployment, MPLS upgrade & corporate SAN.• Mentored junior NOC team members, providing technical guidance and career skills development.

National Defense Service Medal Recipient - Desert Shield/Desert Storm