Sandra A. Email & Phone Number

Maryland, United States

● Review policies, procedures, standards and guidelines per applicable regulations including ISO 27001, PCI-DSS, HIPAA, HITRUST● Develop and maintain incident response protocols to mitigate damage and liability during security breaches● Develop and enhance an information security framework based on NIST Cybersecurity Framework (CSF) and International Organization for Standardization (ISO 27001)● Facilitate the Information Risk Management process including the reporting/oversight of treatment efforts to remediate negative findings● Develop and publish Security Policies and Standards; provide consulting to technical resources on security mitigation of identified security gaps/risks and compliance to Global Security Policies● Define the Vulnerability Management process including the identification of vulnerabilities, provide consulting to business/technical resources to remediate vulnerabilities, and align vulnerability remediation processes with existing Infrastructure programs.

College Park, Maryland, United States

● Created and updated the following Security Assessment and Authorization (SA&A) artifacts; FIPS 199, Security Test and Evaluations (ST&Es), Risk Assessments (RAs), Privacy Threshold Analysis (PTA), Privacy Impact Analysis (PIA), E-Authentication, Contingency Plan, Plan of Action, and Milestones (POAMs)● Prepared Security Assessment and Authorization (SA&A) packages to ascertain that management, operational and technical security controls adhere to NIST SP 800-53 standards● Performed vulnerability assessment, making sure risks are assessed and proper, actions taken to mitigate them● Conducted IT controls risk assessments including reviewing organizational policies, standards and procedures and providing advice on their adequacy, accuracy, and compliance with industry standards● Conducted the IT Risk Assessment and documented key controls● Developed, reviewed, and evaluated Security Plans based on NIST Special Publications800-18● Investigated possible security breaches identified through review of audit reports and follows up accordingly with departments/management● Prepared and reviewed A&A package for Information Systems.