Joseph Panford
646-***-**** *************@*****.***
Professional Summary
Review security plans, processes and strategies to identify areas for improvement or update. Leverage expertise in security regulations and directives for organizational- and agency-level requirements. Demonstrate expertise in analyzing and implementing security requirements into products and systems. experience in Risk Management and Compliance, Assessment & Authorization process, POA&M management, Vulnerability Assessment, Continuous Monitoring program, Security Control Assessment in accordance with NIST, FISMA, OMB, RMF, FedRAMP and industry best Security practices
Core Proficiencies / Technical Skills
● Risk Assessment & Management, GRC tools, PO&AM Management & Mitigation, Authorization-to-Operate (ATO) Documentation, Networking Fundamentals, Active/Passive Reconnaissance, NIST & HIPPA regulatory compliance, Security Control Assessment (SCA), ATO Package/System Documentation, Threat and Vulnerability Assessment
Work Experience
Application Analyst
Booze Allen Hamilton, Remote 2025 – present
Strengthen and harden the VA's IT security posture, ensuring compliance and risk mitigation for external connections.
Draft, review, and approve Memorandums of Understanding (MOU) & Interconnection Service Agreements (ISA) for external connections, submitting documentation to VA Change Control Board for implementation.
Validate MOU/ISA documents for site-to-site interconnections & cloud connections (VA Enterprise Cloud, AWS, etc.) with FedRAMP, aligning documentation with FIPS 199 Security Categorization standards.
Cybersecurity Engineer
Booze Allen Hamilton, Remote 2025 – 2020
Lead preparation efforts for OIG annual inspections, ensuring the VA’s external connections meet security audit requirements.
Act as a subject matter expert (SME) on NIST controls, supporting assessment reviews and advising senior leadership.
Drive process automation initiatives using Microsoft SharePoint workflows, increasing efficiency in operations. Ensuring the VA’s external connections meet security audit requirements.
Direct Support Associate
Metro DDSO, New York, NY 2020-2017
Coordinated with the Vulnerability and Patch Management department to review vulnerability scan results, report findings and developed mitigation plans for corrective actions.
Worked with system stakeholders to review and maintain security documents such as Configuration Management Plan (CMP), Contingency Plan (CP), Disaster Recovery Plan (DRP), Incident Response Plan (IRP), ISAs and PTA/PIA for compliance.
Responsible for researching and evaluating relevant information security policies, guidance, and best industry practices, including NIST and FISMA for applicability to IT systems security.
Education
Certificate in Cybersecurity
MITx, Online 2023
Bachelor’s degree
Utica College, University 2013
Professional Certifications
CGRC (ISC2)
NIST CSF 2.0 2024 (INFOSEC)
eMASS CBT Training Certificate
Scrum Master
Security+ In Progress