Security Information

FRANCIS T. TORMEN, PhD.

(SSCP, CISM, CISA, CCNP, CCNA, MCSE, MCT, DBA)

Email: *******@*******.*** Phone 302-***-****

PHYLOSOPHY

IT management and leadership expert missioned with alignment of network and security frameworks to business goals and objectives assuring the confidentiality, integrity and availability of information and information systems resources. Person of the highest integrity, a creative and flexible thinker, and a willing collaborator with others and demonstrated through concrete actions a commitment to diversity, including ability to execute and promote desired outcomes. Results-driven information security manager/architect with expertise in developing innovative security strategies and leading teams of security architects to deliver holistic technical solutions to information security and network infrastructure challenges.

WORK EXPERIENCE

FMC Corporation, 2929 Walnut Street, Philadelphia PA 19104 3/2019-7/2019

IT Security & Compliance Architect

Install firewalls and maintain a secure FMC network posture against cybersecurity challenges

Review security standard to assure a secure operation technology and manufacturing process

Review traffic logs and lockdown firewalls to specific services and remove redundant firewall rules

Ensure FMC handles personal data safely and responsibly and follows all applicable data

Partner across multiple teams to build and improve the compliance framework for developing and deploying IT systems, infrastructure and policies that adhere to standard privacy practices

Communicate governance and compliance objectives to ensure an appropriate compliance and risk aware culture.

Coordinate efforts for the implementation of FMCs first Data Leak Prevention (DLP) and Privilege Access/Account Management (PAM) initiatives.

Coordinate efforts to develop Request for Proposal (RFPs) for DLP and PAM indicatives

Support and manage FMC’s global firewalls (Fortinet/Barracuda/F5) SIEM (FortiSIEM), Symantec Enterprise Endpoint Protection (SEP)

Manage Certificate Authority Server (Entrust CA-SSL certificates) for generating SSL certificates

Review an assess AT&T Threat Manager for managing vulnerability assessments within FMC global

Coordinate efforts between FMC’s IT security and Compliance teams to assure effective IT governance practice within the organization

Liaison with external vendors concerning FMC security and compliance related matters.

Campbell Soup Company, 1 Campbell Place Camden, NJ 6/2016-12/2018

Global IT Security Engineer Lead

Responsible for coordinating and maintaining the security architecture, standards and policy roadmap

Leading and managing all IT security projects in support of the operations including firewall implementation, remote access, and endpoint security.

Participating in all IT and Business projects that require security services for operations technology.

Contribute to the design and implementation of short- and long-term strategic vision to assure network capacity meets current and future state requirements.

Develop in-depth knowledge of company documentation representative of network flow diagrams

Develop security standards, firewall rules, and architect remote access deployment strategies

Enforce corporate security standard and policies across the organization to assure that manufacturing security services aligns with company global security strategy and roadmap

Develop, document, communicate, and enforce the operations security controls objectives.

Leads the discovery, evaluation and selection of IT security operations solutions and technologies for manufacturing networks.

Leads and participates as IT security subject matter expert in multiple projects and programs concurrently.

Participates in the business roadmap, leverages the manufacturing roadmap to define the security strategy.

Consults widely with other technical teams and uses that knowledge to prepare and then champion the roadmap for security architecture within the manufacturing environment.

Identifies the right stakeholders and then draws representatives from engineering, operations and IT teams together to formulate technical & architectural security standards for the plant floor.

Acts as IT security subject matter expert and guide to the plant-based teams to ensure they understand and follow the security standards and roadmap including correcting non-compliant implementations.

Implement plant floor security technology and provides operational support in run phase.

Advanced technical knowledge in a variety of information security disciplines:

Security Architecture (Principle of Least Priv/Defense in Depth)

Network Access Control (Firewall, Router ACLs)

Network Intrusion Detection/Protection (IDS/IPS) and Endpoint and Host security

Vulnerability assessment and Incident Response

Remote Access Technologies (VPN, Two-Factor Authentication)

Excellent working knowledge of industry standards and best practices (NIST SP800-53, ISO 27000)

Ability to work in a globally disbursed team.

Ability to translate business needs into security roadmaps and articulate risk, cost and service implications of business choices.

Ability to perform in a challenging, fast-paced technical and business environment.

Strong project management and leadership skills.

Camtech / Newcastle County Government, 240 N James St. Newport, DE 2/2010-6/2016

IT Security Manager / Third Party Audit/Risk Compliance

Subject Matter Expertise within the following realms of security: access control systems; cryptography implementation; operations security; security architecture and models; network security, security auditing and monitoring; application and Internet security; physical security, and development of SOPs and security policies.

Develop organizations IT strategy aligned with the organization’s Strategic Plan with clearly defined outcomes and metrics for measuring success;

Establish and align organization wide IT funding model that addresses current shortfalls both in terms of capital refresh and ongoing operations;

Refine and optimize the IT governance model to clarify committees, membership, decision rights and escalation paths to prioritize IT initiatives and manage resource demand;

Design a new support center model that provides tiered support to the various institutional locations;

Select and implement an appropriate IT service management tool including a service catalog and transparent cost model;

Maintain comprehensive list of Camtech’s IT Controls and IT Control Book

Regularly interact with internal and external auditors regarding audit planning, execution and findings

Assess the risk and impact of audit findings and deficiencies, and lead remediation activities

Interpret audit results and makes conclusions on the adequacy and reliability of the controls

Provide on-going evaluations and validation of IT control effectiveness

Actively track and communicate restraints, conflicts or gaps in existing processes as well as cross functional team remediation

Monitor and track best practices and emerging compliance changes/impacts for continuous improvement opportunities

Perform control and compliance gap assessments

Work with different teams within the Corporate and site IT resources to effectively manage their respective controls and security related activities

Coordinate and develop the security awareness and data privacy training necessary to ensure the global adherence to policies, standards and overall security controls

Participate in SSAE16 / SOC 2 compliance assessments

Assess and review third party vendor Due Diligence Questionnaires (DDQ) and reporting

Create remediation plans based on third party assessment findings

Develop and execute an analytics program that will allow the institutions business leaders to make data-based decisions.

Experience directing multiple complex technology projects including proposal formulation, budget setting, contract negotiations, project planning and implementation, managing staff, and problem solving.

Significant understanding of information technology solutions and services and their applicability within an academic environment;

Highly collegial, consultative, and non-hierarchical management style, the ability to develop and sustain collaborative relationships with faculty, staff and senior administrators, and demonstrated commitment to equal opportunity and creating an inclusive excellence environment;

A combination of technical experience, business skills, and emotional intelligence;

Develop and maintain a plan that provides for succession and continuity in the most critical IT management positions;

Ensure transparency and collaboration between the IT organization and its business partners

Establish appropriate service levels and the processes to ensure that KPIs are met;

Foster a culture of innovation, transparency, and accountability in IT;

Demonstrated success working with complex elected and staff leadership models;

Demonstrated success managing and leading change in a complex, collaborative organization;

Monitor compliance of the enterprise IT architecture with IT security policy/SOPs.

Design and conduct employee phishing campaigns to assure employee training and awareness programs are successful to educate users and staff about potential threats

Perform risk assessments and analysis to determine potential threats and mitigate them

MJHS Group, 914 K Street Washington, DC 6/2005-2/2010

Risk Assessment & Audit Compliance Consultant

Monitored and maintained physical and logical security and access to systems.

FISMA Compliance testing using the risk management Framework from NIST SP 800-37 rev1, 800-53 rev3, including SOX 404 and COSO COBIT Compliance auditing.

Implement security Awareness and Training programs to educate personnel of their roles and responsibilities to maintaining a vibrant security posture

Design a Change Management system to evaluate change requests for (systems or applications) are processed for approval or denial, and validation of test results from testing an environment prior to implementing changes to the production environment

Assisted with testing of installed systems to ensure protection strategies are properly implemented and working as intended.

Supervised the early adoption and integration of NextGen security solutions in support of Agency RAS using SSL-VPN based solutions; effectively reduced vulnerabilities and remote access computing costs.

Compiled threat matrix for valued assets using Risk Ratings & Target Values (2K3-2K7).

Restored relevancy, reliability and functionality to Agency IT services by adopting best-of-breed technology and best-of-practices security approach and integrating rule-based infrastructure management across enterprise supported by QRadar, Cisco ASA UTM appliances and Juniper SSL-VPN App Sec. (2K3-2K7

Align IT strategy and vision of organization with State mandated e-Government initiatives.

Assess vendors and rank them in risk categories of High, Medium or Low

Liaising with company and suppliers senior management teams to assess their security posture influencing best risk management practices and compliance to our company security policies

Identify opportunities for developing creative mitigating solutions to achieve effective third party risks management practices and creating remediation plans to mitigate any deficiencies

Engaging with delivery managers and others assessor experts in both internal and external scoping calls to determine the assessment deliverables to be accomplished.

Scheduling assessment efforts with suppliers within 3 months prior to agreeable date, time and place

Install appropriate network security tools that dynamically audit and report security violations occurring within the network infrastructure.

Develop remediation plans to maintain security compliance and update SOPs.

Monitor, assess, and fine-tune IT business continuity security remediation processes, perform application vulnerability assessment scans and risk assessment reviews.

GSE Systems, Inc., 1900 Red Branch Rd Columbia, Maryland 7/2000-6/2005

Senior Network Engineer

Configure Cisco routers, Switches and Firewalls

Install and configure Microsoft Exchange Servers, Domain Controllers, and File servers

Deployment of DNS, WINS, WEB, DHCP, HTTP, SMTP, FTP, including IPS and IDS security prevention and detection systems

Maintains UNIX/Linux Operating System to provide optimum performance and system availability.

Coordinate the transition of legacy line-of-business application to Distributed Client Server model application.

Designed DB schema and assisted with DBA services.

Configuring Layer-3 ACLs and Layer 2 switches

Windows or Linux server and workstation administration

Log files analysis within Splunk and use of Wireshark for packet capture and analysis

Develop remediation plans to address all potential vulnerabilities found

Monitor, assess, and fine-tune IT business continuity security remediation processes, perform application vulnerability assessment scans and risk assessment reviews.

USAID, 2800 16th Street Washington, DC 4/1997-6/2000

Senior Network Engineer

Possessed a Secret Clearance for this project through USAID with The Mitchell Group

Managed the Enterprise Messaging system and ensure troubleshooting, tracking and reporting of end user issues are addressed accordingly

Implement VPN technology to allow users remotely work from home and gain access to their emails during off business hours

Install and configure Domain controller server, file, email, databases and web servers

Perform backup and recovery operations to ensure data was available when needed

Implement Network Address Translation (NAT) to protect internal network resources.

Configure and install various network devices and services (e.g., routers, switches, firewalls, load balancers, VPN, QoS)

Perform network maintenance and system upgrades including service packs, patches, hot fixes and security configurations

Provide Level-2/3 support and troubleshooting to resolve technical network issues

Investigate and report security incidents, and participate in the incident handling process

Work with IT management team and IT staff to develop security policies and procedures

Maintain awareness of latest security risks, exploits and vulnerabilities and apply remediation techniques to mitigate potential risk to the network as required.

Embry-Riddle Aeronautical University 7/2015 - Present

Adjunct Assistant Professor

Graduate online professor in Management and Leadership courses to Aviation & U.S. military students.

Mentor doctoral students in Research studies, Proposal writing, and Dissertation defenses.

Contribution to graduate faculty review and information technology program delivery excellence

Publication - Dissertation “The Impact of the Workforce Investment Act Training Program on Unemployment in Delaware” December 2013 in hard and soft copy booklet, PROQUEST academic journal.

INDUSTRY DEVELOPMENT / CERTIFICATIONS

Information Technology & Security Certifications

SSCP Systems Security Certified Practitioner

CISM Certified Information Security Manager

CISA Certified Information Systems Auditor

CCNP Cisco Certified Network Professional

CCNA Cisco Certified Network Associate

MCSE Microsoft Certified Systems Engineer

MCT Microsoft Certified Trainer

ODBA Oracle Database Administrator (Oracle 9i)

A+ Certified Computer Technician

Interest, Readings, Trainings, and Research Engagements

Information Security, Big Data / Data & Analytics, Data Mining Strategies

Cloud (IaaS/PaaS/SaaS in Azure, Office 365, and AWS), Regulatory Compliance (NIST, HIPPA, HITRUST)

Infrastructure Architecture, Unified Communications Technologies, Collaboration Technologies

Business Continuity & Disaster Recovery, Project Management & Vendor Management

Process Engineering & Standardization, Application Integration & Migration, Acquisition & Divestiture

Cyber Security Risk Mitigation Strategies, Single-Sign-On Associated Vulnerability Mitigation Strategies

SaaS, PaaS, and IaaS as a global framework for IT implementations. IoT Internet of Things research study.

ACADEMIC ACCOMPLISHMENTS

Degrees Awarded

Walden University, Minneapolis, Minnesota

PhD. Public Policy and Administration - specialization in Management and Leadership (GPA 3.78)

Dissertation published in a 185-pages hardcover book, 2013.

Western International University, Phoenix, Arizona

M.S. Public Administration (GPA 3.85)

Old Dominion University, Norfolk, Virginia

B.S. Healthcare Administration (GPA 3.0)

PROFESSIONAL MEMBERSHIIPS

Information Systems Audit and Control Association - ISACA ID Number 1007167

International Information Systems Security Certification Consortium – ISC2 – ID Number 462537

American Society for Public Administration, Washington DC – ASPA

International Honor Society for Public Affairs and Administration – Pi Alpha-Alpha

Delaware Association for Public Administration – DAPA

Board of Regents – Saint Monica University

Doctoral Dissertation Review Board – Wilmington University (External Member)

Member of Multi-State Information Sharing and Analysis Center (MS-ISAC)

REFERENCES

Available upon request

Contact this candidate