Cybersecurity GRC & RMF Risk Specialist

TEKANG N. CHECK

CYBER SECURITY ANALYST RISK MANAGEMENT & COMPLIANCE SPECIALIST

PUBLIC TRUST CLEARANCE

Landover, MD 20785 240-***-**** *.*****@*******.*** Cybersecurity Professional with 6 years of proven expertise architecting enterprise security programs that reduce risk, ensure regulatory compliance, and protect critical assets. Specialized in Risk Management Framework (RMF) implementation, Security Assessment & Authorization (A&A), and Third-Party Risk Management (TPRM) for Fortune 500 and federal clients. Track record of delivering measurable security outcomes: implemented RMF governance reducing compliance gaps by 40%, orchestrated vendor risk program managing 100+ vendors, and led incident response exercises reducing MTTR by 25%. Strategic communicator who translates complex security requirements into actionable initiatives for executive and technical audiences. NIST 800-53/800-37 subject matter expert with deep expertise in GRC platforms, SIEM operations, and vulnerability management across hybrid cloud environments.

Risk Management Framework (RMF) Security Assessment & Authorization (A&A) Governance, Risk & Compliance (GRC)

Third-Party Risk Management (TPRM) Vulnerability Management Incident Response NIST 800-53/800-37/800-30 FedRAMP ISO 27001 SOC 2 PCI DSS Authorization to Operate (ATO) System Security Plans (SSP) Plans of Action

& Milestones (POA&M) Continuous Monitoring Threat Intelligence Penetration Testing SIEM (Splunk, Sentinel) Vulnerability Scanning (Nessus, Tenable, Nexpose) Business Continuity Planning Vendor Risk Assessment Policy Development Compliance Auditing HIPAA GDPR CCPA SOX PROFESSIONAL EXPERIENCE

Fusion PPT, Vienna, VA SEPTEMBER 2023 – CURRENT

Cyber Security System Analyst

● Architected enterprise-wide RMF program aligned with NIST 800-53 and DoD requirements across 40+ information systems, achieving full ATO authorization within 12-month timeline

● Executed Security Assessment and Authorization activities, developing and maintaining System Security Plans (SSP), Security Assessment Reports (SAR), and comprehensive Plans of Action and Milestones (POA&M)

● Led enterprise vulnerability management program utilizing Nessus, Nexpose, and CrowdStrike to identify and remediate 500+ critical vulnerabilities, reducing security risk exposure by 45%

● Conducted application and network penetration testing using Nmap, Nessus, and Kali Linux, delivering actionable remediation recommendations with real-world criticality assessments

● Orchestrated quarterly incident response tabletop exercises using Splunk and Sentinel SIEM platforms, strengthening team readiness and reducing mean time to respond (MTTR) by 25%

● Evaluated and tested Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) to ensure organizational resilience and control validation

● Developed and enforced enterprise-wide cybersecurity policies, procedures, and technical controls supporting defense-in-depth strategy across all infrastructure layers

● Maintained information security documentation including SSP, ISMS plans, and security policies in accordance with ISO 27001 and NIST standards

● Provided regular cybersecurity risk reporting to executive leadership with actionable insights and strategic recommendations for risk reduction

Walmart, Greenbelt, MD FEBRUARY 2021 – JULY 2023

Third-Party Risk Management/Compliance Analyst

● Established comprehensive Third-Party Risk Management (TPRM) program assessing 100+ vendors against SOC 2, ISO 27001, and PCI DSS standards; reduced vendor-related security incidents by 35%

● Applied expertise in compliance frameworks including SOX, HIPAA, PCI DSS, GDPR, and CCPA, managing certification processes and maintaining enterprise compliance posture

● Leveraged GRC platforms (Archer, ServiceNow, Jira) to streamline compliance workflows, centralize risk management, and track control implementations across business units

● Conducted thorough reviews of vendor security assessments, SSAE 18 and SOC reports, and vendor risk evaluations to validate third-party security controls

● Developed vendor tiering strategy and managed complete Vendor Risk Lifecycle including onboarding, continuous monitoring, and offboarding procedures

● Authored comprehensive reports, executive briefs, and vendor assessment presentations documenting findings, risk ratings, and remediation requirements

● Partnered with procurement and legal teams to incorporate security clauses and data protection requirements into vendor contracts through redlining activities

● Escalated critical gap findings to stakeholders and coordinated remediation efforts with vendor management and business leaders

JetBlue Airline, Remote AUGUST 2019 – NOVEMBER 2020 Security Analyst/Vulnerability Analyst

● Developed detailed risk assessment reports identifying security threats and vulnerabilities using NIST 800-30 and FAIR methodologies with quantitative and qualitative analysis

● Coordinated penetration testing engagements with external vendors targeting network devices, operating systems, databases, and applications

● Evaluated vulnerability findings and developed comprehensive Plans of Action and Milestones (POA&M) with remediation strategies and timelines

● Demonstrated proficiency with enterprise vulnerability scanning platforms including Qualys and Tenable Nessus for automated security assessments

● Communicated threat intelligence, vulnerability data, and risk analysis to executive management enabling informed security investment decisions

● Validated remediation effectiveness through follow-up testing and verification activities EDUCATION & CERTIFICATIONS

University of Bamenda, Cameroon 2016

Bachelor of Science in Computer Science

CompTIA Security+ (Active)

Certified Information Systems Auditor (CISA) (In Progress) TECHNICAL SKILLS

Security & Risk Management: Risk Assessment & Analysis Vulnerability Identification & Prioritization Security Controls Assessment Incident Response & Management Threat Intelligence & Analysis Forensic Investigation Log Analysis & Correlation Data Protection & Encryption Privileged Access Management (PAM) Identity & Access Management (IAM) Infrastructure & Network Security: Network Segmentation & DMZ Architecture Firewall & Intrusion Prevention (IDS/IPS)

Virtual Private Network (VPN) Administration Zero Trust Security Architecture System Hardening & Secure Configuration Cloud Security & Network Design

Compliance & Governance: Security Policy Development & Implementation Compliance Auditing & Control Assessment Third-Party Risk Assessment & Management Contract Security & Compliance Requirements Business Continuity & Disaster Recovery Security Awareness & Training Programs Security Platforms & Tools: SIEM & Monitoring: Splunk Microsoft Sentinel Vulnerability Scanning: Nessus Tenable.io Nexpose Qualys Nmap Penetration Testing: Kali Linux

Endpoint Security: CrowdStrike Falcon Microsoft Defender GRC Platforms: Archer ServiceNow Jira

Infrastructure: Active Directory Windows Server Linux Wireshark Cloud & Database Security: AWS Security Services Azure Security Center Database Security Architecture Public Key Infrastructure (PKI) Certificate Authority Management

Contact this candidate