Bob Marshall Email & Phone Number

Plano, Texas, US

• Providing expert level consultation and advice in support of Tyler's StateRAMP authorization project
• Provide specific recommendations on management and implementation of controls to meet StateRAMP requirements.
• Analyze, develop and recommend specific technical updates to ensure compliance with StateRAMP

San Diego, California, US

• Supported Cloud Service Providers (CSPs) with advice on FedRAMP and technical issues
• Delivery Manager for multiple clients providing expert level advice on control implementation in the FedRAMP framework and on compliance requirements necessary to meet FedRAMP standards
• Conducted initial and annual FedRAMP/StateRAMP assessments (Rev4/Rev5) including interviews and artifact reviews; created tools for tracking test case completion and managing artifacts
• Advised CSP clients implementing the FedRAMP Significant Change Request (SCR) process; developed tools for documenting key changes and identifying controls for SCR assessments
• Reviewed and updated CSP documentation in preparation for FedRAMP assessments; this included creating a Rev4 to Rev5 gap analysis and writing/editing System Security Plan attachments

Tampa, Florida, US

• Managed multiple types of security assessments with a focus on FedRAMP/Cloud Security
• Planned and conducted FedRAMP assessments including all phases of the assessment process:
• Developed Security Assessment Plans (SAP), planned assessment schedules, validated client documentation
• Conducted testing, executed on site/remote interviews, collected artifacts, recorded results/findings
• Completed and submitted Security Assessment Reports (SAR), briefed client and federal stakeholders
• Planned and conducted NIST CyberSecurity Framework (CSF) assessments for cloud based systems including conducting tests and completing custom security reports for client stakeholders

Reston, Virginia, US

• Supported multiple Federal Information Security contracts
• Conducted multiple NIST based 800-53 security assessments for the U.S. House of Representatives, this included analyzing/evaluating controls, drafting documentation and interacting with clients/stakeholders
• Developed role-based training modules for the Environmental Protection Agency; these included such topics as Continuous Diagnostics and Mitigation(CDM) and Vulnerability Management

Milwaukee, WI, US

• Supported Cloud Security operations for Northwestern Mutual in the Governance, Risk and Compliance space
• Conducted and supported risk/security assessments for applications being deployed for AWS/Azure
• Analyzed existing processes and implemented improvements to the security assessment procedures for the cloud environment; this included detailed analysis of NIST 800-53 standards
• Prepared and delivered briefings to socialize security implementation, assessment practices and remediation techniques with different internal audiences

Madison, WI, US

• Assigned to the Security Compliance and Governance Team to implement multiple security tasks, including:
• Developed security policies, standards, guidelines and procedures for various cloud services including PaaS/Iaas (Skytap and AWS) and SaaS
• Developed a program to execute assessments on cloud solutions and other providers to identify critical security deficiencies and determine risk; this focused on internal business unit environments and SaaS.
• Updated and managed the security contract review process. Negotiated over 100 Data Security Exhibits (DSEs) with a wide range of diverse suppliers to ensure security of American Family data
• Managed document preparation for multiple PCI (Payment Card Industry) security assessments which includes briefing company personnel in preparation for interviews with assessor personnel

Reston, Virginia, US

Executed IT security assessments including physical inspections of Critical Digital Assets (CDAs) for key systems at multiple nuclear power plants. Security assessments were based on NEI 08-09 requirements. Researched and composed reports on a wide range of CDAs including Industrial Control Systems(ICS)

Reston, VA, US

Assigned to a wide range of information security tasks for multiple government and private sector clients conducting security assessments, working on Pen testing engagements, writing and implementing test plans, and analyzing US Government policies and documentation.

Reston, VA, US

Conducted formal security assessments and implemented security solutions for the National Oceanic and Atmospheric Administration (NOAA) utilizing the NIST standards. Additionally, conducted Department of Defense (DOD) security assessments based on the 8500.2 controls.

Reston, VA, US

Developed and implemented security solutions for the Military Sealift Command (MSC), United States Navy primarily managing security compliance on a Windows/Unix server farm.

Arlington, Virginia, US

Army reservist mobilized for a one year tour; assigned to RCERT-South, Ft Gordon, Georgia providing management and subject matter expertise in support of the US Army's CyberSecurity tasks.

Reston, VA, US

Provided technical consulting, training and support to the 11th Wing, Bolling AFB, United States Air Force.