William (Shane) Isbister Cissp, Cloud Plus, Security Plus Email & Phone Number

Catonsville, Maryland, Us

Gb

Governance Risk Compliance (GRC) AnalystResponsible for reducing information security and cybersecurity risk (identification, qualification, quantification and mitigation by helping to prioritize and drive remediation efforts organization wide. Established and maintained governance and compliance standards.• Conducted cybersecurity risk assessments identifying vulnerabilities in both MSI internal and vendor / 3rd-party supplied products and services.• Created, maintained, communicated, and enforced information security policies, resulting in a pathway to compliance with both internal and industry frameworks such as NIST 800-53 Rev 5 and ISO 27001.• Advised senior leadership on risk management strategies, including risk mitigation, risk reduction, risk transfer, the risk exception process and residual risk analysis.

Information Security AnalystReviewed and provided feedback on security documentation to include Information Security Agreements (ISAs), Security Assessment Reports (SARs), Information Security Risk Assessments (ISRAs), Plan of Action and Milestones (POA&Ms). Assisted customers in defining, interpreting, implementing, and testing security controls in or to achieve compliance and authority to operate (ATO).• Ensured and assisted customers with following / implementing National Institute of Standards (NIST) Risk Management Framework (RMF), resulting in a pathway to compliance and increasing security posture.• Participated and assisted in leading meetings with customers, ensuring required security controls were met and/or a Plan of Action and Milestones POA&Ms was created to address the control gaps.• Reviewed and updated security guidance and template documents, resulting in more refined instruction and guidance.• Reviewed and provided guidance during system change processes, ensuring that changes complied with framework standards.

IT Security Analyst IIDefined, documented, implemented, maintained, and monitored information security requirements and best practices for applications, systems, and other security resources. Researched and recommended security solutions to senior management and department heads. Planned and configured security software and hardware solutions. Conducted information security audits and assessments.• Communicated and instructed information security concepts and issues to other employees and departments, resulting in proactive vs reactive behavioral and product design changes across the organization.• Prepared and presented audit and assessment findings, as well as recommended options to mitigate risks, achieve policy and regulatory compliance, and strengthen controls.• Developed and delivered information security awareness training for the organization, increasing security awareness.• Responded to questions and resolved problems related to the on-line Information Security Training Program.• Monitored employee compliance with information security training policies which enabled reporting of employee training compliance to upper management.

Manassas, Va, Us

Information Security AnalystPrepared work instructions and other guidance to allow clients to maintain a Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST), Health Insurance Portability and Accountability Act (HIPAA) compliant risk management framework.• Developed and provided review comments on certification and accreditation and FISMA / NIST / HIPAA compliance documents, reviewing results of security control assessments and risk.• Participated in security design and architecture review of systems and applications, providing recommendations for correcting security weaknesses in applications and infrastructure.

Product Development AnalystResearched, implemented, and maintained configuration management and document management systems. Created training materials, evaluated products, and managed inventory.

Researched, tested and implemented new applications, products and technologies, maintained servers, created system architecture and network topology drawings, tested new products and applications, managed inventory, worked on various reports and proposals.