Transformed the Vulnerability Management Program by implementing risk quantification and data science principles, utilizing large-scale data engineering, and enforcing configuration baseline hardening to reduce vulnerability arrival rates.

Programs: ITOPS & SECOPS (Centers for Medicare and Medicaid Services Cloud Programs)Program Role(s): Compliance Engineering Lead, Information System Security Officer (ISSO) Contractor Support, Senior Security Engineer, Software Engineer- [Client] Conduct continuous security control implementation tests, security posture gap analysis, and create technical specifications and project teams to implement solutions for gaps identified.- [Client] Create technical specifications for security solutions with data-driven delivery estimates.- [Client] Oversaw and coordinated 6 ACT Assessments in AWS and Azure, including the renewed authorization to operate for CMS Cloud's AWS General Support System.- [Client] Created documentation and Agile review standards for change deployment runbooks.- [Internal] Developed and implemented the internal security program from scratch to comply with Federal Acquisition Regulations and client security standards.

Program: CCS (CMS Cloud)Program Role(s): Lead Security Engineer & Security Delivery Manager- [Client] Migrated 10,000+ endpoints across 700+ AWS accounts and Azure subscriptions between endpoint protection services.- [Client] Developed automatic onboarding into all required security and compliance services across 600+ AWS accounts.

Programs: ACOMS, HPMS (CMS Cloud)Program Roles: Security Engineer, DevOps Engineer- [Client] Wrote custom security tools that integrate technologies such as Clair and OWASP ZAP into CI/CD pipelines as security gate checks.- [Client] Conducted and coordinated regular web application security tests throughout the application development life cycle.- [Internal] Composed thorough application security-related documentation and provided regular OWASP Top 10 training for developers.

- Automate and monitor security alerts for both employee machines and cloud environments. - Create custom solutions to integrate a variety of alerts into a seamless interface. - Conduct security scans and limited penetration tests on system infrastructure and applications. - Participate in security audits and security policy writing. - Publish a recurring security newsletter distributed company-wide.