Security Engineer
Resume:
Kenneth Williams
*****************@***.***
PROFESSIONAL SUMMARY:
Security Engineer with extensive experience
Performed many Internal Auditor for Private industry
Over 15 years of experience in the Information Technology
Over five years experiences performing third party Assessment
In the past five years performing Risk Assessment for Federal and Private Industries
In the past three years used Archer Governance, Risk and Compliance (GRC) Tools as an Administrator
In the past eight years using Best Practices such as NIST, ISO 2701/2702, PCI, HIPAA, CMS, SOX, COBIT and DIACAP
Kaiser Permanente, Oakland California (Short Term Contract)
August 2015 to Present
Security Analyst / HIPAA Consultant
Implement security compliance policies and requirements
Coordinate with various teams to ensure the HealthCare applications meet the organization’s security compliance needs.
Coordinate with various teams in the implementation of HIPAA information security practices including policies, standards, guidelines and procedures.
Conduct information security reviews to determine compliance
Conduct HIPAA or PCI information security audits and reviews
Used RSA Archer GRC tool to create and update Control Baseline
Used Smart Sheet as a Timeline for managing Tasks and collaborate with IT departments
Options Clearing Corporation, Keller Texas (Contract)
October 2014 to August 2015
Security Analyst
Used RSA Archer GRC tool to create and update Control Baseline
Work with technology platform owners to develop IT control baselines
Work with IT department to coordinate the draft, review, and approval of additional controls implemented in support of Regulation System Compliance and Integrity (Reg SCI)
Coordinate with control owners to perform self-testing of key controls supporting Reg SCI subsequent to their implementation.
Perform periodic reviews and updates to existing IT control baselines with IT department groups
Perform execution of Control Self-Assessments, management self-testing of key controls
Perform security architecture reviews
Establishes effective relationships with departments; builds and maintains effective business relationships.
NIST 800-53, ISO 27001/27002, Center for Internet Security (CIS), COBIT 5, & ITIL
CareFirst BCBS, Owings Mills MD (Short Term Contract)
June 2014 to August 2014
Security / Business Analyst II
Worked with our trading partners together, documents, and artifacts and communicate business requirements to technical development teams
Worked in close collaboration with business partners and developers to ensure consistent understanding of business processes and requirements.
Established effective relationships with other departments; builds and maintains effective business partner relationships.
Assisted with tasks and deliverables related to System Development Life Cycle phases for package and custom solutions
Attended and participates in user and project meetings and teams to expand knowledge as a participant and not in a lead capacity; facilitates project status meetings; tracks project status.
ISO 27001/27002, PCI, NIST, COBIT, SOX, and HIPAA Security and Compliance.
CHRISTUS Health, Irving TX (Short Term Contract)
March 2014 to May 2014
Security Engineer
Responsible for supporting the architecture, design and assurance of information security mechanisms and services throughout the enterprise. Works as part of cross-functional teams that deal with the full spectrum of information management technology providing security-based direction in technical standards, planning, and strategy to other technical staff and management.
Development and implementation of key security initiatives and global security parameters based upon level of risk for all enterprise IT platforms and infrastructure.
Provides internal consulting, analysis, and security review to project teams and business units in identifying secure solutions for attaining business goals and objectives.
Recommending new security policies and modifications to current security policies.
Performs probes of networks, applications, and devices to determine if security vulnerabilities exist and/or if security and access control policies have been violated.
Use of scan assessment tools (Nessus, Acunetix, QRadar (view firewall logs)
Used Archer Governance, Risk and Compliance (GRC) Tools
Used Tivoli Endpoint Manager (TEM) IT asset management tool)
Used Service Now which is an enterprise service management ticketing tool.
USFHP, CMS (Center for Medicare/Medicaid Services), SSAE16, COBIT, PCI, NIST, HIPAA, DIACAP, IT Audit, Security and Compliance.
Army & Air Force Exchange Service, Dallas TX (Contract)
June 2013 to March 2014
Information Assurance Engineer
Provide Information System Security Engineering and Certification and Accreditation (C&A) expertise in accordance with DIACAP
Assist in preparing Certification & Accreditation (C&A) documentation for submission to the Designated Approving Authority (DAA)
Provide security analysis and C&A/DIACAP support for Enterprise wide IT C&A to include: Datacenter C&A, Enterprise Network device C&A, and Enterprise Services/Application C&A
Utilize standard software tools to conduct vulnerability scans of all equipment on the network for vulnerabilities to ensure sound security configurations
Run and create McAfee ePO vulnerability reports work with system owners to mitigate finding.
Assist systems administrators in implementing corrective actions required as a result of vulnerabilities uncovered during system scans in coordination with Information Assurance Manager (IAM) and IA Program Manager
Assist with project planning and scope
Noridian Blue Cross & Blue Shield, Fargo North Dakota (Contract)
March 2013 to June 2013
Senior Security Analyst/IT Auditor
The IT Internal Auditor will perform risk-based IT audits, consult with personnel on effective internal controls, and assist in developing and executing the annual Internal Audit Plan. More specific responsibilities include:
Develop a sound understanding of the company’s information systems, and assess the adequacy of controls over the systems.
Run McAfee ePO report in order to assist the team to mitigate vulnerability with the application.
Independently test the design and operating effectiveness of general computer controls and application controls, and provide guidance on appropriate actions to address control exceptions.
Write audit reports to communicate findings, recommendations, agreed-upon actions, and targeted completion dates to management and the Audit Committee.
Identify opportunities to automate business process controls, and reduce reliance on manual controls.
Recommend best practice corrective actions to policies and procedures, where necessary.
Track audit deficiencies and perform follow-up to ensure appropriate controls have been implemented and are operating effectively.
CMS (Center for Medicare/Medicaid Services), FISMA, NIST, ISO 27001, PCI-DSS, SSAE16, SOX, IT Audit, Security and Compliance.
American International Group, Inc, Fort Worth TX (Short term Contract)
April 2012 to January 2013
Senior Security Analyst
Provide guidance on implementation strategies for new security technologies on network
Develop and publish Information Security policies, procedures, standards and guidelines based on knowledge of best practices and compliance requirements.
Conduct company wide data classification assessment and security audits and manage remediation plans.
Assess security controls for annual FISMA self-assessment testing through interview, documentation review, analyzing scan results, and reviewing other audits/reviews for applicable findings, maintain a high-level of knowledge on related criteria and guidance such as FISMA, NIST Special Pubs, OMB Memorandum, Privacy Act, HIPAA, VA directives and handbooks, and local directives and handbooks
Act as interface with customer to provide audit support for both internal and external audits and reviews
Help clients mitigate security related risks by providing alternative recommendation and guidance
Guide clients in defining and implementing overall security strategy, policies, and procedures
FISMA, NIST, FEDRAMP, SOX, SSAE16, ITS Audit, Security and Compliance.
U.S. Department of Veterans Affairs, Austin, TX (Contract)
March 2011 to April 2012
Senior Security Analyst
Responsible for developing and updating C&A security artifacts such as security plans, contingency plans, risk assessments, privacy impact assessments, incident response plans, configuration management plans, configurations checklists, and interconnection security agreements. Also includes continuous monitoring, self-assessment testing, and audit and compliance support. These artifacts must meet all applicable FISMA, NIST, VA, and CDCO criteria, including obtaining management approval.
Provide third-party auditing support
Provide day to day research information through documentation review, interview, and the use of automated tools such as the Configuration Management Database
Provide continue monitoring specific change orders information that can be used to update documentation through the use of tools such as CA Unicenter
Assess security controls for annual FISMA self-assessment testing through interview, documentation review, analyzing scan results, and reviewing other audits/reviews for applicable findings, maintain a high-level of knowledge on related criteria and guidance such as FISMA, NIST Special Pubs, OMB Memorandum, Privacy Act, HIPAA, VA directives and handbooks, and local directives and handbooks
Act as interface with customer to provide audit support for both internal and external audits and reviews
Meet with task order Contracting Officer’s Technical Representative (COTR) and/or Project Manager on a bi-monthly basis to discuss status of work
Meet with Contracting Officer and PM on an as-needed basis to discuss problems and concerns, status of work, changes in assignments or other contract related issues
Responsibilities for developing appropriate documentation require for FISMA reporting including responsibility for the System Categorization, in accordance with FIPS 199 and NIST SP 800-60, generation of the System Security Plan (SSP) associated Security Control selection and documentation in accordance with NIST SP 800-37 and 800-53, and generation of the Monitoring strategy.
Provides direct support to the business and IT staff for security-related issues.
Assess security controls for annual FISMA self-assessment testing through interview, documentation review, and scan results.
Provide third-party auditing support
Help clients mitigate security related risks by providing alternative recommendation and guidance
Guide clients in defining and implementing overall security strategy, policies, and procedures
Perform security assessments, risk analysis, and vulnerability testing and reviews
SOURCECORP, INC., Dallas, TX (Contract)
October 2010 to January 2011
Information Security Administrator
Responsible for ensuring the confidentiality, integrity, and availability of data and information systems for Health Net Federal Services for DIACAP
Review systems for effective security measures, including analysis and design of security systems, documents, and requirements throughout SOURCECORP. Perform adherence testing and support and promote quality assurance, while delivering excellent customer service at various levels
Provide security administration for all IT Security applications and associated accounts participate in designing and managing IT Security strategy including both infrastructure and applications for Health Net Federal Services/DIACAP
Responsibilities for developing appropriate documentation require for FISMA reporting including responsibility for the System Categorization, in accordance with FIPS 199 and NIST SP 800-60, generation of the System Security Plan (SSP) associated Security Control selection and documentation in accordance with NIST SP 800-37 and 800-53, and generation of the Monitoring strategy.
Provides direct support to the business and IT staff for security-related issues.
Assist with projects involving database and security issues and requirements. Knowledge of security principles, Public-key infrastructure (PKI) and Industry best practices
Analyze vulnerability assessment results
Experience with Infrastructure Server and/or Database Administration
Use of scan assessment tools – Retina (Network and Web Scanning Tools, OpenSTA Web Stress Performance Test, AppDetective, Gold Disk, Tenable and Nessus. Strong knowledge with NIST, FISAM and DIACAP compliance
HeiTech Services, INC., Landover, MD
November 2008 to September 2010
Information System Security Analyst
Responsible for information security policy development and maintenance; design of security policy education, training, and awareness activities; monitoring compliance with IT security policy and applicable law; coordinate investigation and reporting of security incidents
Work with the Information Technology Services (ITS) Systems Support team to monitor, and fine-tune the business continuity and disaster recovery program
Perform network vulnerability assessment scans and risk assessment reviews
Collaborate on solutions to mitigate risks and enhance system security
Work effectively with a diverse group of Information Technology and Security professionals in government and the private sector.
Provide third-party auditing support
Analyze vulnerability assessment results
Provide information assurance policy guidance to both internal and external customers
Help clients mitigate security related risks by providing alternative recommendation and guidance
Guide clients in defining and implementing overall security strategy, policies, and procedures
Perform security assessments, risk analysis, and vulnerability testing and reviews
Provide periodic written and verbal update to customer management on current vulnerabilities and countermeasure recommendations
Lead the information security team in the Information Security Awareness Program through presentations and content development.
Perform risk assessment on an application according to NIST SP 800-30
Use of scan assessment tools – Retina (Network and Web Scanning Tools, OpenSTA Web Stress Performance Test, Gold Disk, Tenable and Nessus.
Responsibilities for developing appropriate documentation require for FISMA reporting including responsibility for the System Categorization, in accordance with FIPS 199 and NIST SP 800-60, generation of the System Security Plan (SSP) associated Security Control selection and documentation in accordance with NIST SP 800-37 and 800-53, and generation of the Monitoring strategy.
Provides direct support to the business and IT staff for security-related issues.
Technifax Office Solutions, Carrollton, TX
July 2008 to November 2008
IT Specialist (Temporary Contractor)
Responsible for network connectivity and installation and repair of Technifax Office Solutions products
Installed software at customer locations; Design, document, and install custom software required by customers to use Technifax office equipment
Provide systems analysis, modifications and testing to user applications
Manage time, IT inventory, and customer relationships
Diagnose and solve customer initiated IT service calls
Periodically, work the IT Help Desk. Maintain customer satisfaction through expedient response to service requests
Network Security Systems Plus LLC, Falls Church, VA (Contract)
June 2007 to June 2008
Senior Security Engineer (MHS/TMA IA Contractor)
Responsible for the overall technical guidance for all teams. Complete reports meeting Department of Defense, DIACAP, and DISA standards for Certification and Accreditation
Provided solutions for Defense Health Systems TRICARE Management Activity risk assessment teams on technical questions and issues
Help clients mitigate security related risks by providing alternative recommendation and guidance
Guide clients in defining and implementing overall security strategy, policies, and procedures
Perform security assessments, risk analysis, and vulnerability testing and reviews
Implemented policies and procedures regarding how problems are identified, received, documented, distributed and corrected
Knowledge of Public-key infrastructure (PKI) and Industry best practices
Performed assessment testing, network infrastructure design, privacy impact assessment and vulnerabilities, monitoring & auditing, security testing on the mainframes, SQL, Oracle Database, Apache Web servers, Win 2003/2000/XP’s and network systems, Serve as SME on mainframes, midranges, and non-standard operating system platforms, scanning and testing tools (specifically CA-Examine), and the mainframe STIGs
Perform risk assessment on an application according to NIST SP 800-30
Use of scan assessment tools – Retina (Network and Web Scanning Tools, OpenSTA Web Stress Performance Test, Gold Disk, Tenable and Nessus
Department of Labor, Landover, MD (Contract)
April 2006 to May 2007
Senior Security Analyst
Implemented and manage IT security solutions
Provided security reports that meet FISMA requirements for DOL including risk assessments, policy & procedures, evaluation & periodic ST&E testing, incident response, contingency plans, disaster recovery plans, disaster recovery test drills to the alternate site, network infrastructure design, privacy impact assessment and vulnerabilities, monitoring & auditing, and disposition plans.
As analyst made recommendations regarding firewall and router ACL to senior staff
Participated in disaster recovery planning, implementation, testing and readiness for the organizations data center systems
Provide third-party auditing support
Perform risk assessment on an application according to NIST SP 800-30
Develop table top exercise scenario for disaster recovery.
Perform Incident Response Plan procedures, standards and processes to discover, resist and recover from security incidents and to limit the impact of any such occurrence or reoccurrence.
Assists in the development and management of security for one or more IT functional areas across the enterprise.
Participates in the system/application development life cycle to ensure Information Security processes and concepts are incorporated into all applicable systems and software
Help clients mitigate security related risks by providing alternative recommendation and guidance
Guide clients in defining and implementing overall security strategy, policies, and procedures
Maintained up-to-date documentation of network topology equipments and data center environment.
Provide DOL Certification Package using NIST methodology in preparation for Security Certification & Accreditation audit process. Perform yearly security awareness training.
Work with system owners of DOL five major applications and General Support System to perform system scans and validating system boundary, MOU, ISA, and ICON
EMC, Plano, TX
February 2005 to April 2006
Customer Engineer
Performed installations and maintenance of EMC data storage equipment at customer locations
Showed professionalism and customer’s satisfaction at each account
Prepared clarify case reports for each event
Prepared accurate expense reports and daily time sheets
Performed part replacements as directed by PSE lab. Documentation and other duties as assigned
Market Scan IS, Westlake Village, CA
May 2003 to February 2005
Field Service Technician
Installing, troubleshooting maintaining and coordinating the use and proper operation of network environments and desktop and server operating systems/environments (Windows 2000/XP/2003) for Car Dealership subscriber locations
Conducted pre-installation onsite surveys with the customer to explain and demonstrate the functionality of the equipment and software. Install network cabling systems including CAT5e, CAT6, multimode and single mode, coax
Termination of RJ-45, RJ-11 (4/6-pin), BNC (coax)
Installed modems, terminate cables, connect terminals, install peripheral interface boards, configured hardware, install software, perform network conversions, bring up LAN, conduct onsite customer training demonstrating the software, performed equipment audits as required, responded expeditiously to requests as necessary
Performed multiple tasks within established time frames and criteria. Perform POST installation quality checks or calls, if requested
Worked independently using experience and judgment to accomplish assigned tasks and achieve goals
Tax Service Companies, Keller, TX
July 2002 to May 2003
Network Consultant
Performed hardware/software installations and configurations on Dell Windows 2000, XP workstations and Windows 2000, 2003 Servers for Tax Service companies
Conducted pre-installation onsite surveys; Install DSL, routers, modems, terminate cables, connect terminals, install peripheral interface boards, conducted onsite training and demonstration of equipment and software
Performed routine follow-up and quality checks
Sabre Holdings / American Airlines (Outsourced to EDS in 2001), Southlake, TX
July 1991 to July 2002
Desktop Support/Field Comms & Service Tech
Provide and manage installation with Sabre hardware/software on Compaq, Dell Windows 2000, XP workstations and Windows 2000, 2003 Servers including restaging and troubleshooting hardware/software problems on Win95, 98, 00, XP and NT, Novell NetWare Operating Systems, Cisco router and switches configuration, LAN and Hardware Diagnostics, Gateway, File Server, LAN & WAN connectivity, PC installation/troubleshooting and LAN design/installation troubleshooting
Ensured all OS systems and software tools utilized in the data center are kept up-to-date and do not allow any to fall behind more than one version from latest general release
Data center equipment rack planning and installation/racking of equipment into telecommunication racks
Performed layer three (3) configurations, implementing, monitoring and troubleshooting Cisco 7600 series router and Catalyst 2900, 3500, 3700, 4500, 4900 and 6500 series switches. Performed hardware/software installations for American Airlines/Eagle airport and travel agency locations on Win 2000/2003/NT workstations and servers; Administered TCP/IP network running Windows NT 4.0 and Windows 2000 with over 500 users in support of operational exercises
Provided end-user support and technical assistance; new installations and upgrade file servers, PCs, printers, print servers, OS2 operating systems; loading the operating system for Novell servers; Configure UNIX databases. Independently perform tasks in a rapid pace environment with tight schedules. Respond to telephone calls, emails and Remedy action request system trouble tickets for technical support. Installed Enhanced Gate Reader, IER 557 Printers, loaded TCP/IP for the Intranet, Remote Group Wise, installed routers, MUXSABRE Gateway, File Servers, and Printers
Conduct maintenance, analysis, troubleshooting and repair of computer systems, hardware and computer peripherals; Documenting, performing upgrades or replaces hardware and software systems
Provide support and maintenance of user account information, including rights, security and systems groups
Adhere to department operating procedures and reporting requirements
EDUCATION:
Master of Science in Information Security Management from the University of Fairfax, May 4, 2013
Bachelor of Science, Information Technology, Colorado Technical University, April 2006
Studying for my Certified Information System Security Professional (CISSP) certification
Diploma, Computer Operations, Computer Learning Center, Springfield, VA
CERTIFICATIONS:
Information Systems Security Professional (ISSP)
Senior Security Manager (SSM)
Contact this candidate