Extensive experience leading enterprise risk and vulnerability assessments across federal systems, networks, applications, cloud infrastructure, and High Value Assets.
Strong expertise in vulnerability scanning, security configuration assessment, vulnerability prioritization, risk analysis, and remediation validation.
Advanced hands-on experience with Tenable Nessus, Tenable Security Center, Qualys, Rapid7, and comparable vulnerability assessment platforms.
Ability to analyze CVEs, CVSS scores, CISA Known Exploited Vulnerabilities (KEV), configuration weaknesses, exploitability, and business impact to prioritize security risks.
Experience conducting Risk and Vulnerability Assessments (RVAs), technical security assessments, control validation, and security posture evaluations aligned with NIST guidance.
Strong knowledge of NIST SP 800-53, NIST SP 800-53A, NIST SP 800-115, FISMA, FedRAMP, and federal vulnerability management requirements.
Experience managing vulnerability remediation tracking, POA&M development, corrective action verification, accepted risks, and executive risk reporting.
Ability to develop Risk Assessment Reports (RARs), vulnerability assessment findings, remediation roadmaps, risk metrics, and recommendations for reducing recurring security weaknesses.