Sandra A. Email & Phone Number

Maryland, United States

• Review policies, procedures, standards and guidelines per applicable regulations including ISO 27001, PCI-DSS, HIPAA, HITRUST
• Develop and maintain incident response protocols to mitigate damage and liability during security breaches
• Develop and enhance an information security framework based on NIST Cybersecurity Framework (CSF) and International Organization for Standardization (ISO 27001)
• Facilitate the Information Risk Management process including the reporting/oversight of treatment efforts to remediate negative findings
• Develop and publish Security Policies and Standards; provide consulting to technical resources on security mitigation of identified security gaps/risks and compliance to Global Security Policies
• Define the Vulnerability Management process including the identification of vulnerabilities, provide consulting to business/technical resources to remediate vulnerabilities, and align vulnerability remediation.

College Park, Maryland, United States

• Created and updated the following Security Assessment and Authorization (SA&A) artifacts; FIPS 199, Security Test and Evaluations (ST&Es), Risk Assessments (RAs), Privacy Threshold Analysis (PTA), Privacy Impact.
• Prepared Security Assessment and Authorization (SA&A) packages to ascertain that management, operational and technical security controls adhere to NIST SP 800-53 standards
• Performed vulnerability assessment, making sure risks are assessed and proper, actions taken to mitigate them
• Conducted IT controls risk assessments including reviewing organizational policies, standards and procedures and providing advice on their adequacy, accuracy, and compliance with industry standards
• Conducted the IT Risk Assessment and documented key controls
• Developed, reviewed, and evaluated Security Plans based on NIST Special Publications800-18