Maurice Ngamine

Tel {***} *******

**** ******** **

Lanham MD 20706

Email ; adzo98@r.postjobfree.com

OBJECTIVE:

I am currently seeking an Information Assurance Officer/Senior IT Security position where creativity, attention to detail, passion for excellence, teamwork, customer loyalty, diligence and client support are ultimate, strongly encouraged and practiced.

PROFESSIONAL SUMMARY:

Cyber Security Analyst/Information Security Officer with over 6 years of IT/cyber security working experience.

Extensive Experience in IT Auditing and supporting PCI DSS and ISO 27001 Frameworks.

Experience working with common information security standards, such as ISO 27001/27002, NIST, SOC 1&2 and HIPPA

Understanding of security related regulatory and data privacy concerns globally

Flexibility to adjust to multiple demands, shifting priorities, ambiguity, and rapid change.

Experience translating information security concepts into business and technical language.

Great Experience in SharePoint sites for analyses, documentation updates, inventories and monitoring/tracking.

Great experience working with Amazon Web Services (AWS) and Ms Azure environments for FedRAMP Compliance.

Great experience working on the following frameworks: HIPAA, NIST, FedRAMP, ISO 27001 and PCI DSS, SOC 1 & 2 and HITRUST

Great Traveling experience and On-Site Facility Assessment and Audit Experience

Great experience on FEDRAMP ATO processes

Great working knowledge of NIST SP 800-53r4, 37, 60, 53A, 34, 30, 115, 137, RMF, FIPS 199 and 200 and FISMA guidelines to comply with Federal and private agencies.

Experienced in the development of System Security Plans (SSP), Contingency Plans, Disaster Recovery Plans, Incident Response Plans/Training, and Configuration Management Plans, System Security Checklists, Privacy Impact Assessments, POA&M, Authority to Operate (ATO) letters,

Knowledge of FISMA Reports, Standard Operating Procedures (SOP) in accordance with Federal, Agency and Organizational policy, to include FISMA, NIST, OMB, FIPS instructions.

Possess in-depth ability performing information Security Risk Assessments and Analysis, Risk Mitigation in large-scale networked application environments.

Experience with applying RMF, FedRAMP, and associated guidance in Platform as a Service Environment.

Ability to coordinate with security officials and business owners to identify and mitigate risks to go-live and ATO target dates.

Experience with vulnerability scanning in accordance with NIST 800-115, using tools like Nessus, Nexpose, Web Inspect and Splunk for log collection, reporting and analyses.

Excellent analytical and problem-solving skills as well as interpersonal skills in interacting with team members, clients and top management as well.

Familiar with VMware and other Virtual Machine Applications

Good communication and writing skills.

Experience with IT security architecture (Firewalls, Intrusion Detection Systems, Virtual Private Networking, and virus protection technologies

Experienced with reviewing and validating privileged accounts for systems facilities.

WORK EXPERIENCE

Information System Security Officer (ISSO) – Abiatech Solutions MD

January 2017 – Present

Significantly reduced System Vulnerability from 123 to 15 in two months

Increased System’s score card from F to A grade in three months.

Significantly reduced systems POA&Ms from 56 to 5 in two months as part on CONMON requirement.

Review Change Request as part of change management process for assigned system.

Performing regular reviews on system user list as part of CONMOPN Compliance

Coordinating system incident response test as [art of IRP Compliance

Conduct high level meetings with work streams regarding vulnerability management for assigned system.

Conduct and evaluate third-party risk assessments, applying established criteria covering cyber security, data privacy, reputational, financial, business continuity, geopolitical, and other risk domains.

Contribute to the development, improvement, and maintenance of the team client relationship.

In consultation with senior business and information security management, establish a client information security strategy which addresses the client’s regulatory and business requirement.

Support client and engagement team security assessment inquiries regarding client’s Global Information Security Program.

Review and provide commentary regarding information security requirements in client contractual agreements to confirm compliance with client information security standards. Participate in client discussions to negotiate contractual terms.

Work independently with minimal oversight from management.

Support Critical Infrastructure National Security compliance, including Network Cyber Reviews.

Support Audits by reviewing and analyzing evidence for third party auditors

Reviewing PBC and updating PBS as per clients and auditor’s request.

Updated NFR and drafted final reports regarding Corrective Action Plans.

Supported SOC 2 Audit by drafting user specific policies such as email policies, bring your own devise policies and AUP.

Communicate effectively through multiple mediums (electronic and in-person), write clearly and effectively, and document findings appropriately and completely.

Collaborate with internal partners and third parties to mitigate and otherwise resolve third-party risks.

Supported in creating SOPs for security programs and systems.

Supported in training in information system security (Security Plus)

Supported in training for CAP certification.

Training on how to create Plans of Action and Milestones (POA&M) for identified vulnerabilities and performed compliance monitoring.

Developing and/or reviewing Information System Security Policy documentation.

Training how to do NESSUS vulnerability scans for systems and networks.

Identify vulnerabilities applicable to systems and applications, determine their severity and urgency, work with system owners to determine whether and/or when corrective action will be taken, and perform necessary actions to verify corrective actions.

Creating SOPs, reviewing packages documents and reviewing POA&Ms as part of continuous monitoring program.

Collaborate with teams in remediating audit findings, Security Planning and reporting, and mitigation of security vulnerabilities are completed in a timely manner.

Conducted risk assessment evaluating security of Web applications and related infrastructure, defining risk matrix, providing technical and executive reports with detailed findings, recommending mitigation strategies, and performing cost-benefit analysis.

Assessing POAMs on clients’ systems and making recommendations to client in order to close findings.

Creating ServiceNow request for monthly vulnerability scans for assigned system.

Create, track and maintain changes through ServiceNow Ticketing system.

Working with Cloud Service Providers in reviewing security documents, scans, POA&Ms and making recommendations on system documentation updates.

Review, evaluate, Develop and update ATO packets for compliance such as BIA, RA, CPT, CP, CMP, PIA, SAR, SAP, PTA, IR, MOU, ISA and POA&Ms, SSP, DRP and SLA

Managing a team of 10 ISSOs on preparing systems towards ATO and Pre-OIG Audit

Supporting client in conducting credential Vulnerability scans using NESSUS, Nexpose and Web Inspect

Leading Vulnerability management at the VA GSS, Facility, and Infrastructures entities.

Supporting customer with managing project supporting the following frameworks: HIPAA, NIST, FedRAMP, ISO and PCI DSS.

Leading and conducting Risk Assessment at the network and system and application for the VA

Support VA with Change management using ServiceNow Ticketing Systems

Leading and conducting Security Awareness Training for the VA

Leading Team: Support VA Client with Traveling and Assessing VA Facilities Internal Security Controls to determine the extent to which they are implemented, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the systems and Facilities.

Review spreadsheet containing review of control associated with findings (implementation details, evidence, and control status) and any findings that are open or closed within the current fiscal year.

Leading Team: Act as the main POC expert for all security related matters between the VA and contracting organizations and subject matter expert of Configuration Management Control.

Support VA client with developing and conducting yearly incident response plan test and testing.

Senior Security Analyst – Abiatech Solutions, MD.

Administrative Office of the US Courts (AOTO),

Washington, DC January 2016 – January 2017

Developing and maintaining System Security Plans (SSP).

Coordinate high level weekly meetings with system owners, COR and system developers regarding system current status as part of CONMON.

Creating and updating system Plan of Action and Milestones (POA&Ms) as part of CONMON.

Working with ITO Internal Scanning SecOPs Engineering Tier 4 Team to request scans for assigned systems as part of CONMON Activities.

Working with M/CIO/IA SecOPs ITO team to exempt False Positive Scans from monthly system application scans.

Coordinating with Cyber Hygiene DHS, M/CIO/IA Cyber Hygiene team to validate reports and remediate issues regarding system verification and validation on monthly basis.

Review and evaluating POAMs for compliance with FISMA as part of continuous monitoring and preparation for OIG Audit (Quarterly Reviews)

Conduct yearly Security Control Assessments and OIG Pre-audits at Regional Entities such as GSS, Infrastructure, VISTA and VA Facilities

Advise and provide guidance to system or facility managers, contracting staff, human resources staff, police and facility management staff in addressing, identifying and gathering supporting evidence that properly satisfy the implementation of the security controls at facility level.

Create and implement Configuration Management Plan template that standardized the Roles and Responsibilities of the CIO, ISO and Privacy Officer, and defined the site Configuration Management Procedures, system name, system description and contact list.

Reviewing and updating PTA and PIA as part of HIPAA and HITRUST frameworks

Developing and maintaining System Security Plans (SSP).

Reviewing, analyzing and reporting monthly AU-6 Audit Logs as part of Continuous Monitoring

Coordinating with Cloud Azure Administrators on log management as part of Continuous Monitoring.

Reviewing and drafting monthly AC-2 Account Management as part of Continuous monitoring.

Set and maintain schedules and ISSO checklists.

Completing control observations for site facilities and finalizing report to the system owner.

Coordinate with System Owner to complete the required security provided by the CSP such as the IRPs, ISAs/MOUs, SAR, POA&Ms and the SSPs with security controls documented in the FedRAMP authorized CSP Customer Responsibilities Matrix.

Lead a team of 10 ISSOs in the creation of the FSS RMF master evidence list. This list standardized evidence required for each Risk Vision control across the Enterprise, thus reducing the number of evidence lists provided to each site from fifteen to one.

Reviewing and updating Technical Architectural Diagram in collaborating with system engineers and other POCs.

Reviewing and updating SSP, CP, CMP, ISCP and IRP as part of Continuous Monitoring.

Conducting Risk Assessment on customer’s application as part of PCI DSS Compliance.

Supporting Data calls for ALL security related issues from Cross Functional Agencies within the Federal Government and Private entities.

Creating Integrated Corrective Action Plan (CAP) for findings after ASSESSMENTS AND AUDITS.

Supporting customer in scans using Nexpose, Web Inspect and Nessus to scan for vulnerabilities scans.

Working with Privacy Office in conducting Annual Privacy Impact Assessment (PIA) Updates.

Support Customer in updating security Policies, Privacy documents as part of supporting SOC 1&2 Reports.

Reviewing and updating vulnerability management team on weaknesses uncovered during scans and audits.

Supporting customers in reviewing and updating security policies as part of ISO 27001 Framework compliance.

Using Data Loss Prevention tool to restrict the exfiltration of data.

Implementing and managing NIST 800-53 Rev. 4 Security Controls.

Supporting the Security Assessment and Authorization (SA&A) process.

Supporting Continuous Monitoring activities.

Managing Plan of Action & Milestones (POA&Ms) and developing remediation strategies.

Aligning systems activities to the NIST Cyber Security Framework (CSF). Supporting the incident response process.

Identifying and supporting system Interconnection Security requirements.

Supporting audit logging review and remediation activities.

Providing OMB FISMA data on a monthly bases.

Developing and documenting incident reporting procedures for service desk, admins, and security staff for incidents.

Evaluation of IT threats and vulnerabilities to determine whether additional safeguards are needed.

Reviewing and updating AC-2 Account Management Review report as part of Continuous monitoring.

Upgraded system to 100% on monthly FISMA Scorecard

Coordinating with MS. AZURE Admins to update Account management reports on a monthly bases.

Accessing AZURE Environment and reporting ALL AZURE Security for Monthly CONMON activities.

Generate and review weekly application audit logs for assigned systems as part of CONMON activities.

Closed 12 POA&Ms in two weeks from previous 1/3 assessment.

Working closely with assessors in providing relevant evidence as part of system 1/3 assessment.

Conducting Systems Contingency Plan Test Tabletop Exercise (TTX) for assigned system.

Generating, reviewing, and analyzing audit logs from Microsoft SQL Server Management Studio (MSSMS).

Coordinating with MS. AZURE PaaS admins to update and review log management report as part of AU-6 CONMON.

Coordinating and writing Log Review report on a monthly basis as part of CONMON.

Coordinating weekly system status meetings with system owner, COR, system developers and program managers.

Reviewing and updating System Health Check Utility (SHCU) to ascertain where deliverables stand as part of continuous monitoring (CONMON).

Review, update and validate applicable security controls for system after SCA for assigned system.

Review, update and validate relevant test evidence for applicable controls for assigned system after independent SCA for assigned system.

Reviewing and updating MOU/ISA for assigned systems.

Coordinating with AIDNET and AZURE Engineers and ISSOs in updating MOU/ISA for assigned systems.

Requesting, reviewing, and analyzing system vulnerability scans as part of continuous monitoring.

Responding to ALL account management issues from the AIDNET active directory and all Bureau Super Users or account Administrators

Updating Systems Boundary, Description and Components on SSP i.e., ports, protocols, services and databases security components such as MSQL and HTTPS traffic.

Performing system POA&M Quarterly reviews, 1/3 Assessments on applicable security controls for assigned systems.

Conducting high level system status meetings on a weekly basis to brief the customer on system security.

Education & CERTIFICATIONS

Bachelor of Arts University of Yaounde 1 1997/98

CompTIA Security+

Cloud Security Alliance

Certified Scrum Master

CISSP in Progress

TECHNICAL SKILLS

All Applicable NIST SP 800 Series

VA 6500 Information Security Handbook

Security Standards-FISMA, OMB, PCI/DSS, NIST, HIPAA, SANS20, OSI/Security Tools MacAfee EPO, MacAfee, Splunk, Wireshark, Snort, Tenable Nessus, Service Now, Remedy Ticketing System.

FISMA Audits & Metrics

Good Experience with DOD DISA STIG

Security Control Testing, Risk Assessment & Risk Management.

Networking Knowledge (TC/IP, WAN/LAN, VPN, firewalls, routers, switches, IDS/IPS), MS Suite (Word, Excel, Power point)

Operating Systems (Windows 2008r2 and Unix/Linux

FIPS Standards, Contingency Plans, Network Infrastructures, Security Impact Analysis, Privacy Impact Assessments & Analyses, Standard Operating Procedures.

Network Monitoring: Snort IDS, Vulnerability Assessment and Penetration Testing tools: NESSUS, Wireshark, NESSUS Tenable Security Center, Web Inspect, Nexpose, Splunk, Cain &Able and Microsoft Baseline Security Analyzer (MBSA).

Contact this candidate