Team Member Lead

John Kenny

Huntsville, AL *****

Phone: +1-703-***-****

******@********.***

linkedin.com/in/tonykenny0199133

Executive Summary

Over twenty years of experience in the electronic/computer industry with a strong background in customer serviceoriented environments. Experienced in team member, team lead, and management roles. Expertise in enterprise security, NIST, DOD, DITSCAP/DIACAP, CNSSI 1253, and ITIL security standards. Proficient in implementing network and computer security solutions such as Splunk, ServiceNow, Azure, Intune, AWS, and Single SignOn solutions. Skilled in Incident Response, Threat Hunting, Security Information and Event Management (SIEM), Vulnerability Assessment, Penetration Testing, and Network Security Monitoring. Cyber Patriot mentor for Columbia High School.

Work Experience

System ISSO

Open Systems Technologies Corporation, Huntsville, AL (Jun 2024 – Present)

●Ensure the day-to-day implementation, oversight, continuous monitoring, and maintenance of the security configuration, practices, and procedures for 8 systems including a MLS cross domain solution.

●Provide liaison support between the system owner and other IS security personnel.

●Ensure that selected security controls are implemented and operating as intended during all phases of the IS lifecycle.

●Ensure that system security documentation is developed, maintained, reviewed, and updated on a continuous basis.

●Conduct required IS vulnerability scans according to risk assessment parameters.

●Develop Plan of Action and Milestones (POAMs) in response to reported security vulnerabilities.

●Manage the risks to ISs and other FBI assets by coordinating appropriate correction or mitigation actions, and oversee and track the timely completion of (POAMs).

●Coordinate system owner concurrence for correction or mitigation actions.

●Monitor security controls for FBI ISs to maintain security Authorized To Operate (ATO).

●Upload all security control evidence to the Governance, Risk, and Compliance (GRC)

●application to support security control implementation during the monitoring phase.

●Ensure that changes to an FBI IS, its environment, and/or operational needs that may

●affect the authorization status are reported to the system owner and IS Security Manager (ISSM)

●Ensure the removal and retirement of ISs being decommissioned in coordination with the system owner, ISSM, and ISSR.

Staff Cyber Architect

Aerojet Rocketdyne, Huntsville, AL (Jun 2022 – Apr 2024)

●Implemented changes in business workflows, reducing security ticket resolution time by 40%:

●Utilized ITIL best practices to streamline incident management, resulting in improved efficiency and quicker response times.

●Identified service redundancies, saving $6M: Conducted thorough costbenefit analysis and redundancy checks, leveraging tools like Splunk and ServiceNow.

●Improved CMDB assets database for accurate software license costs and reduced costs through license metering in SCCM: Enhanced asset management by integrating SCCM with ServiceNow CMDB for precise software inventory and license management.

● Enabled automated diagramming features in ServiceNow: Implemented automation scripts to generate realtime network and security architecture diagrams, improving visibility and compliance tracking.

●Architected DevSecOps solution with CI/CD pipeline tools using GitLab, Jenkins, and Jira: Designed and deployed secure CI/CD pipelines ensuring compliance with NIST SP 80053 and DOD standards.

●Implemented/managed development tools such as StackHawk, Snyk, OWASP, and ZAP: Enhanced application security by integrating static and dynamic analysis tools into the development lifecycle.

●Security POC for Title III Defense Production Act (DPA) initiative for IT/OT and IIOT architecture upgrade using PTC Windchill, Fortinet, and Honeywell SCADAfence tools: Led security initiatives to upgrade and secure critical infrastructure, ensuring compliance with NIST 800171 and CNSSI 1253.

●Configured Firewall, Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS): Kali Linux tools to identify weaknesses and strengthen perimeter defenses and monitor network traffic.

●Managed AWS Security, Azure Security, and Google Cloud Security implementations: Secured cloud environments following CIS benchmarks and NIST guidelines.

●Implemented Security Orchestration, Automation, and Response (SOAR) solutions: Deployed SOAR platforms like Splunk to automate threat detection and response workflows.

Senior Cyber Architect

Northrop Grumman Corp, Multiple Locations (Jun 2007 – Jun 2022)

●Cyber Security POC for multiple DOD missile systems: Provided comprehensive cybersecurity oversight, ensuring compliance with DOD regulations and standards such as NIST SP 80053 and CNSSI 1253.

●Mentored team members and taught improved security processes: Conducted training sessions and workshops to enhance team proficiency in cybersecurity best practices.

●Evaluated business strategies, researched information security standards, and conducted system security and vulnerability analyses: Leveraged frameworks like NIST CSF and ISO/IEC 27001 for strategic security planning and assessments.

●Implemented WhiteSource tools to reduce security risks from opensource software: Automated opensource vulnerability management to ensure secure software development practices.

●Planned and implemented continuous monitoring and reporting solutions using the ELK platform: Developed and maintained a robust monitoring infrastructure using Elasticsearch, Logstash, and Kibana.

●Maintained security program compliance with NIST and CNSSI 1253 standards: Regularly audited and updated security controls to meet regulatory requirements.

●Supervised Information Assurance Engineers and coordinated with Systems Developers, Administrators, and Project Managers: Oversaw security projects and ensured collaboration across multidisciplinary teams.

●Compiled and documented FISMA C&A documents for system authorization: Managed the Certification and Accreditation process, ensuring systems met federal security standards.

●Provided security expertise and wrote policies, technical procedures, and standards: Authored comprehensive security documentation to guide organizational practices.

●Managed several projects from concept to completion while managing outside vendors: Ensured project success through effective vendor management and adherence to project timelines.

●Developed workflow charts and diagrams to ensure production team compliance with client security deadlines: Used tools like Microsoft Visio and Lucidchart for visualizing workflows and security processes.

●Instrumental in developing and maintaining metrics for progress reporting: Created and tracked key performance indicators (KPIs) to measure security program effectiveness.

●Implemented MultiFactor Authentication (MFA) and Single SignOn (SSO) solutions: Deployed MFA and SSO solutions using tools like Okta and Microsoft Azure AD.

●Conducted Risk Assessment, Business Impact Analysis, and Threat Modeling: Applied methodologies such as STRIDE and DREAD to identify and mitigate risks.

●Developed IAM Architecture, RoleBased Access Control (RBAC), and Identity Governance solutions: Ensured robust identity and access management following NIST SP 80063 guidelines.

●Ensured compliance with GDPR, HIPAA, PCI DSS, and Data Privacy Laws: Implemented controls to meet regulatory requirements and protect sensitive data.

Prior Career Experiences

Various Locations (Dec 1991 – Jun 2007)

●Provided lifecycle information assurance (IA) engineering support for DOD's C2 system GCCSJ: Integrated IA principles into system development to ensure security compliance.

●Integrated IT and security engineering expertise into the software development phase: Advocated for secure software development practices using Secure SDLC models.

●Provided security guidance, including Common Criteria, DITSCAP, DOD, and NSA technical configuration guides: Ensured systems adhered to highsecurity standards and guidelines.

●Developed security test plans and assisted in integrating security testing software: Created comprehensive test plans and utilized tools like Nessus and Metasploit.

●Performed HIPAA site security certifications for VA hospitals: Conducted audits and assessments to ensure compliance with HIPAA security rules.

●Senior Security Engineer for multiple DHS clients on the HSDN project: Provided security expertise and managed critical DHS projects.

●Developed security policies, plans, and architecture: Authored and implemented policies to guide organizational security practices.

●Provided security engineering and integration services for customers at foreign embassies: Ensured secure IT infrastructure in complex environments.

●Performed penetration and vulnerability analysis and information technology security research: Conducted thorough security assessments using tools like Burp Suite and Wireshark.

●Served on review boards and panels to ensure procedures and equipment met federal government security requirements: Participated in compliance and review processes to ensure adherence to standards.

●Prepared formal security reports for submission to government CIO: Documented findings and recommendations in detailed security reports.

●Provided security engineering and integration services for Dept of State at foreign embassies: Delivered secure IT solutions and support for diplomatic missions.

●Prepared both classified and unclassified embassy environments for integration into the enterprise network: Ensured secure integration of embassy systems into larger networks.

●Lead tester for Microsoft products within the DMS suite: Conducted rigorous testing and validation of Microsoft products.

●Ensured secure encrypted Email message flow between Microsoft and Lotus Domino servers: Managed secure email communication channels.

●Troubleshot X.400 message flow between Microsoft Exchange and Lotus Domino servers: Resolved complex email routing issues.

●Managed helpdesk on DOJ contract: Provided support and managed ticketing systems to ensure efficient issue resolution.

●Acted as a buffer between level 1 and level 2/3 support groups: Facilitated communication and issue escalation between support tiers.

●Scheduled network and server outages, performed security compliance tests, and integrity checks: Managed maintenance windows and conducted thorough security checks.

●Implemented Microsoft SMS reducing call resolution time by 25%: Streamlined support processes using Microsoft Systems Management Server.

●Maintained a mixed environment of Novell, Windows NT, and SUN UNIX platforms: Managed and supported diverse IT environments.

●Converted a 5000 user 16MB Token Ring LAN environment to a switched Ethernet platform: Led major network upgrade projects.

●Planned and implemented migration from cc:Mail to Exchange 5.5: Managed largescale email migration projects.

●Network administrator for National Rifle Association: Oversaw network operations and ensured secure network management.

●Managed a 37 server PC/LAN including GroupWise Email system: Handled complex network and email system administration.

●Lead network technician in the Personal Computer Support Group at the President's Executive Office (EOP) and White House Complex: Provided highlevel IT support in a sensitive environment.

Education

American Public University

Masters Degree

Computer Information Systems

2024

Contact this candidate