Matthew Scott Email & Phone Number

Alexandria, Virginia, United States

· Maintaining awareness of current DoD and JSP CS developments and issues; · Supporting the accreditation of JSP systems and applications on premises and on the cloud. · Converts existing DoD Information Assurance Certifications and Accreditation Process (DIACAP) systems to RMF· Initiates the accreditation of new systems, and the reaccredits expired/expiring DIACAP systems; and coordinates with other EUS teams · Create and distribute CS policy, processes, and guidance to JSP-supported organizations and components· Develop and submit weekly and monthly status reports.· Maintain current knowledge of relevant developments in area of expertise.· Develop and deliver working level and senior leadership briefs.· Provide general documentation support.· Develop, maintain, and report on key cloud security metrics.· Define security best practices for our cloud platform and provide guidance to application development teams· Experience documenting security controls for web applications, cloud environments and on-premise infrastructure. · Provide support for technical issues and ensure that all components of security around the cloud are properly implemented.· Creating SAP’s and SAR’s from Data Calls in Fed Ramp Packages with understanding of security configuration settings for Microsoft Operating Systems, Linux, and various Data-bases

Alexandria, Virginia, United States

• Manage overall security-related policies, procedures, laws, and regulations; create, document and implement various security plans and compliance documents to enforce Information Assurance principles for Fed Ramp packages.• Develop, maintain and manage Security Authorization and Assessment packages that include System Security Plans (SSP), Contingency Plans (CP), POA&Ms, and other relevant security documentation for existing and new systems• Conduct both technical and non-technical internal audits and testing to validate the system and operational requirements compliance Use workflows to develop security artifacts. Analyze Ap-proved Fed Ramp packages and talk to the appropriate POC located on the Secured FedRamp Package.• The document, organize and implement security control requirements• Identify current and new risks• Prepare vulnerability test plans and coordinate the testing and result procedures• Actively assess existing cloud implementations, identifying security issues and prioritizing fixes• Experience with different models of cloud usage (IAAS, PAAS, SAAS, public/private/hybrid)

Columbia, Maryland, United States

Assist the Information System Security Engineer (ISSE) / Cyber Lead in meeting their duties and responsibilities• Overseeing the development and maintenance of a system’s cyber security solutions• Performing all required Risk Management Framework (RMF) process steps, as provided in DoD RMF Process Guide• Assisting with identification of the security control baseline set and any applicable overlays• In coordination with the Information System Security Engineer (ISSE), support the implementation of the RMF process and the security controls baseline for the NBIS/DSS program• Assist with development, maintenance, and tracking of the Security Plan• Assist ISSE with the security control implementation and testing efforts• Ensure that all users have the requisite security clearances and access authorization, and are aware of their cyber security responsibilities for DoD systems under their purview before being granted access to the system • Assist with any security testing required as part of Assessment & Authorization (A&A) or annual reviews• Assist in the mitigation and closure of open vulnerabilities under the system’s change control process• In coordination with the ISSE, initiate protective or corrective measures when a cybersecurity incident or vulnerability is discovered and ensure that a process is in place for authorized users to report all cybersecurity-related events and potential threats and vulnerabilities to the ISSO• Ensure that all DoD Information System (IS) cybersecurity-related documentation is current and accessible to properly authorized individuals• Assess periodically (minimum annual requirement) the quality of security control implementation against requirements• Plan and perform cyber security testing to assess security controls and recording security control compliance status during sustainment

· Ensure proper system categorization using NIST 800-60 and FIPS 199; implement appro-priate security controls for information system based on NIST 800-53 rev 4 and FIPS 200.· Conduct security assessment interviews to determine the Security posture of the System.· Develop a Security Assessment Report (SAR) in the completion of the Security Test and Evaluation (ST&E) questionnaire using NIST SP 800-53A required to maintain Company Authorization to Operate (ATO), the Risk Assessment, System Security Plans, and System Categorization.· Review, maintain, and ensure all assessment and authorization (A&A) documentation in-cluded in the system security package.· Perform information security risk assessments and assist with the internal auditing of in-formation security processes. Assessed threats, risks, and vulnerabilities from emerging se-curity issues and identified mitigation requirements.· Work with system owners to develop, test, and train on contingency plans and incident re-sponse plans.· Tests, assess, and document security control effectiveness. Collect evidence, interview per-sonnel, and examine records to evaluate effectiveness of controls.· Review and update remediation on plan of action and milestones (POA&Ms). Work with system administrators to resolve POA&Ms, gathering artifacts and creating mitigation memos, residual risk memos and corrective action plans to assist in the closure of the POA&M. Understand the software development life-cycle (design, develop, implementa-tion, testing)· Use Excel to update (POA&Ms), Requirement Traceability Matrix (RTM) before updating into CSAM application· Analyze problems to determine technical solutions

Unresolved trouble tickets as appropriate, and tracks calls· Installs, maintains, upgrades and troubleshoots PCs, laptops, printers and other peripherals.· Installs, maintains, upgrades, and troubleshoots Commercial Off The Shelf applications along with custom applications.· Utilizes help desk ticket system by inputting, updating and closing tickets using Service