Timothy Medlock, Cissp Email & Phone Number

Falls Church, Virginia, Us

• Completely overhauled the cybersecurity program of one of the largest legacy programs in the U.S. Government inventory ► Program was over 20 years old and required a drastic cybersecurity overhaul ► Implemented a holistic, ground-up cybersecurity program that included regular Operating Systems patching, secure configuration implementations, configuration management, updated policy & procedures (to include security-relevant content), and rewrite of many security-related documents, such as Security Control Implementation Plan (SCIP), Security Test Plan (STP), Continuous Monitoring Plan (ConMon), and System Security Plan (SSP) ► Built numerous relationships with internal and external stakeholders and customers, which included buyoff from internal development, engineering, test, and operations team leads, to develop a comprehensive integrated cybersecurity program • Identify cyber security issues within the software engineering process and provide solutions to applicable leadership. This includes interacting with internal and external subcontractor technical staff and external representatives concerning risk and impact to cost, performance, and schedule• Responsible for maintaining Risk Management Framework (RMF) compliance which includes ensuring applicable documentation such as the System Security Plan (SSP), Continuous Monitoring (ConMon) Plan, and applicable policies and procedures are updated• Currently leading a cybersecurity effort to employ Zero-Trust Architecture within the cloud environment, which includes both securing and accrediting the system.

• Identify, quantify, and mitigate risks with networks and servers utilizing the NIST Risk Management Framework (RMF)• Routinely, conduct and respond to regulatory audits such as Federal Information Security Modernization Act (FISMA) and Command Cyber Operational Readiness Inspections (CCORI)• Routinely, conduct vulnerability scanning and analyze associated reports, then respond accordingly with the development or maintenance of Plan of Action and Milestones (PoA&M) which includes a mitigation strategy• Security Lead and representative for the organization Configuration Control Board (CCB)• Act as the primary contact between the Systems Engineering, Software Development, and Cyber Security Teams within an agile software development life-cycle

• Act as the primary contact between the Systems Engineering, Software Development, and Cyber Security Teams within an agile software development life-cycle• Lead and participate in progress review meetings to discuss cost, schedule, and technical performance with respect to implementing cyber security controls, policy/procedure adjustments, patching cycles, and configuration changes. Risk and impact are key considerations during this process.• Identify cyber security risk within the software engineering process and provide solutions to applicable leadership. This includes interacting with internal and external subcontractor technical staff and external representatives concerning risk and impact to cost, performance, and schedule.• Responsible for maintaining Intelligence Community Directive (ICD) 503/Risk Management Framework (RMF) compliance which includes ensuring applicable documentation such as the System Security Plan (SSP), Continuous Monitoring (ConMon) Plan, and applicable policies and procedures are updated at least annually.• Ensure that external representatives are supplied with applicable information to make executive-level decisions for granting approval to operate within a given environment.► Develop and disseminate Bodies of Evidence (BoE) which include Nessus vulnerability reports, STIG configuration reports, software code Fortify reports, and updated PoA&M► Confirm that the PoA&M is updated at least monthly• Developed and implemented an easily-trackable and maintainable process to track cyber security findings within multiple secure enclaves, with cross-domain solutions (CDS) between each enclave, and totaling approximately 1200 nodes . This process utilizes a database/spreadsheet/report format and significantly cut down the manpower required to maintain a multiple spreadsheet Plan of Action and Milestones (PoA&M).• Identify, quantify, and mitigate risks with networks and servers utilizing the NIST Risk Management Framework (RMF)

San Diego, Ca, Us

• One of two leads that developed and executed the Host-Based Security System (HBSS)/McAfee ePO effort within the U.S. Navy's (PWM-160) CANES program• Provided installation, configuration, and policy development leadership for the ePolicy Orchestrator (ePO) server. This included support for all point products such as McAfee Agent, VirusScan Enterprise (VSE), Policy Auditor (PA), Asset Configuration Compliance Module (ACCM), and Firewall and Intrusion Prevention System (IPS) configuration and policy development for Host Intrusion Prevention System (HIPS)

San Diego, Ca, Us

• Participated in the preparation of proposals, and the development of new business► Participated on most levels of the proposal process to include: blue, pink, red, green, and gold teams► Routinely provide support for oral presentations on several of these efforts► Led several Small Business Innovative Research (SBIR) proposals• Provided interview and hiring support for new candidates and employees• Participated with support staff, project and program managers, and executive management to develop and implement current, annual and long-term technical, schedule, quality, and business objectives for the organization

San Diego, Ca, Us

• Provided Assessment & Authorization (A&A) support to legacy DIACAP-accredited systems that connected to an Risk Management Framework (RMF)-accredited, Common Control Provider (CCP)• Developed a methodology and framework to allow legacy DIACAP-accredited systems to inherit controls from an RMF CCP. This included updates to all applicable documentation such as the System Security Plan (SSP) and Continuous Monitoring (ConMon) Plan.► Effort was defined for a specified amount of time and had a hard deadline

San Diego, Ca, Us

• One of two leads that created and executed the Host-Based Security System (HBSS)/McAfee ePO methodology within the U.S. Navy's (PWM-160) CANES program for all ships receiving HBSS.► Developed and executed initial process for deploying HBSS/McAfee ePO within an afloat environment. This included initial installation and configuration of the ePolicy Orchestrator (ePO) Server and all applicable point products.► Additionally, this effort also included developing the policy tree, initial policies, and applicable documentation such as implementation and user's guide

San Diego, Ca, Us

• Provided Assessment and Authorization support to the Navy's PMW-160 Consolidated Afloat Network and Enterprise Services (CANES) program► As a Risk Management Framework (RMF) pilot program, CANES was required to be accredited utilizing both DoD Information Assurance Certification and Accreditation Process (DIACAP) and RMF. Expertise in both paradigms was required.► Developed initial Security Control Traceability Matrix, Security Control Implementation Guide, and several drafts of the System Security Plan (SSP)► Developed and presented program briefs, security documentation, white papers, and Information Assurance briefs

San Diego, Ca, Us

• Developed a business plan and model which allowed the organization to organically grow a commercial cyber security service to world-wide customers utilizing a "Managed Service" model► Included developing business relationships with cyber security software vendors such as eEye, Core Security, and McAfee.► Managed service model included: vulnerability scanning, penetration testing, remediation of findings, and securing the business environment

Falls Church, Va, Us

• Provided Program-level field test support to the U.S. government as a Subject Matter Expert (SME) in requirements validation, design validation, test observance and information assurance to theJoint Program Executive Office/Joint Tactical Radio System (JPEO-JTRS) program► Tasking included field certifying system could communicate securely within a tactical environment. This included ensuring that system was DoD Information Assurance Certification and Accreditation Process (DIACAP)-hardened and accredited.► Developed and presented program briefs, security documentation, white papers, and Information Assurance briefs► Reviewed system security packages delivered by contractors for completeness, accuracy, and DIACAP compliance► Provided initial support to Risk Management Framework (RMF) transition

Falls Church, Va, Us

• Routinely participated in the preparation of proposals, and the development of new business► Participated on most levels of the proposal process to include: blue, pink, red, green, and gold teams► Provided support for oral presentations on several of these efforts► As a result, won new business opportunities, totaling approximately $100 million, over the course of 5 years

Falls Church, Va, Us

• Provided initial acquisition support for PMW-160 on the Consolidated Afloat Network and Enterprise Services (CANES) Program► Provided project management support that included organizing, planning, scheduling, and coordinating workloads to meet established milestones► Developed initial concept and hardware/software requirements and applicable documentation► Surge effort developed to be phased out over time as milestones were accomplished

Chantilly, Us

• Utilized the Waterfall Software Development Lifecycle extensively to provide software engineering support for several Special Access Programs (SAP)► Utilizing Rational Requisite Pro to validate requirements traceability, wrote several levels of high-level, decomposed, and derived requirements► Contributed to both the high-level and detailed design which included applicable documents for each► Developed initial Graphical User Interface (GUI) concepts and operational documentation► Implemented software with C++, within the Linux environment

Mclean, Va, Us

• Utilized the Waterfall Software Development Lifecycle extensively to develop tactical software applications for the U.S. Navy within the UNIX and Windows 2000 environments.► System was one of the very first NSA-Approved Service-Oriented Architecture Applications that were fielded► Developed several versions of software which included: readdressing system requirements, design, and test methodology. Additionally, updates to the applicable documentation were also required.

Washington, Dc, Us

• Provided system's engineering support to Space and Naval Warfare Center, Pacific (SSC-PAC)► Wrote several new requirements for software being developed► Tested and integrated tactical software for the U.S. Navy and Marine Corp

Master Of Science - Ms, Cybersecurity & Information Assurance

Bachelor Of Science, Computer Science