Senior Cybersecurity Architect and Zero Trust Expert

WAJID HASSAN

Senior Cybersecurity Architect

Reston, Virginia • ******@*****.*** • 571-***-****

US Citizen • Active Public Trust Clearance

PROFESSIONAL SUMMARY

Senior Cybersecurity Architect with 15+ years securing enterprise, federal, and cloud environments for clients including DOE/NREL, Fairfax County Public Schools, Procter & Gamble, and DoD/VA. Specializes in Zero Trust architecture, NIST SP 800-53/FISMA-aligned security design, and multi-cloud security (AWS, Azure, GCP) using Palo Alto, Zscaler, Illumio, and SIEM/NGIPS/EDR platforms. CCIE-certified with hands-on experience in penetration testing, vulnerability assessment, TLS inspection, and SOC operations. Active Public Trust clearance; delivers compliant, resilient security architectures for classified and mission-critical systems.

CORE TECHNICAL SKILLS

• Security Architecture & Zero Trust: Zero Trust Architecture (ZTA) / Micro-segmentation (Illumio) / Security-zone & network segmentation design / PKI / DNS-DHCP security / DDoS / WAF / NAC / 802.1X / AAA (RADIUS, TACACS+)

• Firewalls & Threat Prevention: Palo Alto (Panorama, GlobalProtect) / Fortinet FortiGate / Cisco ASA & Firepower (FTD) / Zscaler / NGIPS / IDS-IPS (Snort, Zeek) / EDR-XDR (Carbon Black) / FireEye NX/PX / ForeScout / Skybox

• SIEM, Vulnerability Mgmt & SOC: Splunk / ArcSight / Vulnerability assessment (Nessus) / Penetration testing (Kali Linux, Metasploit) / Threat modeling & secure coding (OWASP) / Incident response / Cyber Kill Chain / IOC identification / TLS inspection & traffic analysis

• Cloud Security: AWS / Microsoft Azure / Google Cloud Platform — native security tooling, encryption policy, TLS inspection, and compliance configuration

• Identity & Access: IAM (ForgeRock) / SSO & federated identity / Okta and SailPoint integration / Active Directory & Domain Controller security

• Compliance & Frameworks: NIST SP 800-53 / 800-53A / NIST CSF / DISA STIGs / CIS Benchmarks / FISMA / TIC 2.0 & 3.0

/ CDM / CJIS / ISO 27001 / PCI DSS / GDPR

• Automation & Tools: Python / Ansible / PowerShell / Wireshark / SolarWinds / Gigamon

• Networking Foundation: Cisco (ASR/ISR, Nexus, Catalyst) / BGP, OSPF / SD-WAN (Viptela, Meraki) / DMVPN & IPSec VPN

/ VMware NSX-T

PROFESSIONAL EXPERIENCE

Senior Cybersecurity Architect Reston, VA

Logic Finder — Client: Department of Energy / NREL 01/2024 – Present

• Led a Zero Trust network security redesign for classified data-processing environments, assessing firewalls, security zones, VLAN/IP segmentation, and remote-access architecture against target-state requirements.

• Evaluated security and privacy controls against NIST SP 800-53 using NIST SP 800-53A test procedures, maintaining requirements-to-architecture traceability for compliance audits.

• Applied DISA STIGs, NIST 800-53, and CIS Benchmarks to bring network and cloud systems into alignment with federal security standards.

• Strengthened enterprise and cloud security posture with PKI services, DNS/DHCP hardening, and DDoS/WAF defenses across Azure, AWS, and GCP environments.

• Integrated EDR/XDR, Splunk SIEM, and NGIPS solutions to improve Zero Trust resilience and incident visibility.

• Performed TLS inspection and traffic analysis to validate encrypted-traffic compliance without degrading user experience.

• Reviewed firewall rules, ACLs, NAT, and VPN configurations to eliminate legacy and undocumented security dependencies; supported RFP/SOW/SLA security-requirements documentation. Senior Cybersecurity Architect Washington, D.C

Securance — Client: Fairfax County Public Schools (FCPS) 03/2023 – 04/2024

• Supported implementation of Identity and Access Management (IAM) controls using ForgeRock, aligning identity architecture with NIST CSF and ISO 27001.

• Deployed Cisco SD-WAN and integrated Firepower Threat Defense (FTD) to secure connectivity across a 1,000+ endpoint enterprise network.

• Implemented Azure and AWS security controls, including encryption policy and TLS inspection, for a legacy-to-modern infrastructure migration aligned with OWASP guidance.

• Authored and executed security-control test plans for ForgeRock commissioning, validating identity controls against NIST SP 800-53 prior to production cutover.

• Ensured IAM, Office 365, and network security configurations complied with NIST CSF, DISA STIGs, CIS Benchmarks, and GDPR requirements for identity data handling.

• Evaluated application compatibility with PCI DSS requirements for systems handling sensitive student and payment data. Senior Cybersecurity Architect McLean, VA

Cloud9 — Client: InfoSys (DoD/VA) 10/2022 – 03/2023

• Served as subject matter expert on cybersecurity for DoD/VA network projects, developing security policies, standards, and procedures aligned with federal mandates.

• Delivered network security capability assessments and technical recommendations to senior leadership, identifying architecture gaps and remediation priorities.

• Assessed threats to minimize system vulnerabilities and ensure confidentiality, integrity, and availability of systems per DoD/VA security policy.

• Disseminated cybersecurity guidance to subordinate teams and evaluated standardized security-tooling reports to determine network health.

Zero Trust Architect

Integrated Resources Inc. — Client: Procter & Gamble 10/2021 – 02/2022

• Served as subject matter expert on micro-segmentation and Illumio for an enterprise-wide Zero Trust implementation, partnering with InfoSec, DevOps, and systems architecture teams.

• Built a Zero Trust framework and actionable adoption roadmap spanning the five core pillars — Users, Workloads, Data, Networks, and Devices — plus Telemetry & Analytics and Automation/Orchestration.

• Supported digital transformation of SAP applications and databases with Zero Trust-aligned network and access controls.

• Integrated security products across a multi-vendor ecosystem including Zscaler, AWS, Azure, Cisco, Nessus, Okta, SailPoint, Splunk, CyberArk, and Netskope.

Network Security Architect Baltimore, MD

OMM IT Solutions 01/2020 – 01/2022

• Guided enterprise network re-architecture using Zero Trust, TIC 3.0, FISMA, and CDM standards; recommended policy changes enforcing NIST SP 800-53/800-53A.

• Designed security architecture spanning TIC 3.0, SD-WAN/SSE, PKI, and wireless protections; integrated EDR/XDR, DDoS/WAF, and DNS/DHCP hardening into data center and cloud deployments.

• Led SOC-style monitoring and TLS traffic analysis/decryption to support compliance and secure data flows.

• Performed network penetration testing across AWS and Azure cloud infrastructure.

• Implemented SD-WAN with Cisco Meraki and Viptela, validating secure control-plane tunnel establishment across branch sites.

• Authored network/security documentation, diagrams, and standards for government customer review. Solutions Architect Seattle, WA

Amazon Web Services 06/2019 – 12/2019

• Partnered with Amazon's AppSec (BWIT) team to deploy DDoS protection services across new global infrastructure builds.

• Supported Border POP data center security and network hardening for AWS global expansion and new-country launches.

• Standardized configurations and reduced deployment exceptions, shortening POP build timelines to under 120 days while maintaining security baselines.

Solutions Architect Redmond, WA

Gigamon — Client: T-Mobile 02/2019 – 06/2019

• Supported penetration testing for external-facing web applications, assessing DMZ architecture, threat modeling, and secure coding practices (OWASP).

• Performed vulnerability analysis for internal applications while supporting deployment of the world's largest Gigamon network visibility fabric at T-Mobile.

• Conducted Wireshark-based traffic analysis to identify anomalies across 5G core network environments. Solutions Architect Redmond, WA

FirstNet (AT&T Mobility) 02/2018 – 12/2018

• Performed annual deep penetration testing of digital products for the first Mission-Critical Push-to-Talk (MCPTT) network built for U.S. emergency responders, documenting findings for product and engineering teams.

• Implemented VMware NSX micro-segmentation aligned with the physical WAN design to secure a mission-critical public-safety network.

• Engineered a CI/CD-based Session Border Controller deployment with security controls for a scalable VMware infrastructure. Network Architect Redmond, WA

Seshaat Inc. 12/2017 – 03/2018

• Audited bank and enterprise multivendor networks (BGP, OSPF, MPLS) to identify security gaps and configuration risk, recommending remediation and upgrade paths.

Technical Lead, Cloud and Infrastructure Operations Washington, D.C. U.S. Department of Agriculture / FMI 09/2017 – 12/2017 Developed and disseminated cybersecurity guidance across a 2,800+ site USDA enterprise network, evaluating standardized security-tooling reports to determine network health.

• Investigated Azure as an alternative to AWS/Oracle OCI, configuring Azure Load Balancers and Front Door with security-hardened settings.

Earlier Experience 2007 – 2017

• Founder / Solutions Architect, Logic Finder Inc. (Startup), 06/2017–11/2017 — Led a post-incident data center rebuild following a virus attack, integrating Cisco Firepower firewalls, ACS TACACS, and Nexus switching into the redesigned security architecture.

• Solutions Architect, Nexius Insight, 05/2014–06/2017 — Node-level security and engineering support for AT&T carrier deployments across Juniper, Cisco, and Ericsson platforms.

• Packet Core Validation Engineer / LTE Design Engineer, MIW — AT&T Mobility Labs, 02/2011–01/2014 — IPv6 lab security build and NFV/MME-SGSN validation on Juniper MX-960 and OpenStack/Contrail.

• Telecom Network Engineer, QuadGen Wireless Solutions, 01/2011–09/2011; Graduate Research Assistant, Wichita State University, and Lab/Test Engineer, Hamdard University, 2007–2010 — PIX firewall, NAT/PAT, VPN, and Layer 2/3 security configuration for LAN/WAN and security-team operations. EDUCATION

Ph.D., Technology Management – Digital Communications (In Progress) Indiana State University, Indiana, USA

M.S., Electrical and Computer Engineering 12/2010

Wichita State University, Kansas, USA

B.S. Electronics & Computers 12/2007

Usman Institute of Technology

Bachelor of Commerce 03/2005

University of Karachi

CERTIFICATIONS

• CCIE Data Center and Service Provider — Cisco, License #47485 (2015 – Present)

• CCNA / CCNP (Routing & Switching) — Cisco

• VCP 550 — VMware Certified Professional, Data Center Virtualization

• CISSP — Training Completed

• CEH (Certified Ethical Hacker) — Training Completed CLEARANCE

Active Public Trust • US Citizen

Contact this candidate