Aire Cobb

12+ years of Business Analysis experience, including technical writing, business case analysis and reformation, and trend analysis. 8+ years of Federal Advisory experience, including Information Assurance, NIST and FISMA compliance, regression testing, GAO remediation, and cybersecurity. Experienced with Risk Management Framework (RMF) Artifacts and Package Accreditations.

Chief Information Security Officer (CISO) at Community health Systems (2024-12 – Present)

• Acting Chief Information Security Officer (CISO) for Region 3 and its affiliated facilities and markets within Georgia, Indiana, Missouri, New Mexico, Oklahoma, and Pennsylvania.
• Ensuring alignment with documented security policies and procedures and communicating business risks.
• Performing Risk Assessments and brief C-suite on upcoming assessments to prepare them for Risk Review Board (RRB) review.
• Providing consultancy services to reduce security and privacy risks, align security posture with security frameworks such as NIST, ensure and enforce HIPAA compliance, and advocate for initiatives to be a collaborative space for both business, IT, and cybersecurity.
• Participating in ad-hoc discussions for Incident Responses (IR), Risk and Compliance Issues, or other security related issues.
• Overseeing risk management actives and adoption of any products/solutions and processes potentially introduced by vendors into the region.
• Implementing uniformity across the region to meet defined standards and policies and driving change to strengthen security posture.

Business Information Security Officer (BISO) at Community health Systems (2023-12 – 2024-12)

• Populated Security Solution Assessment (SSA) reports for solutions/products (i.e., medical equipment, software, etc.) being adopted and/or implemented within facilities.
• Liaised with Business Owners (BOs), third party vendors, and stakeholders to develop Risk Rating Matrixes and define requirements and business needs during Technical and Discovery calls.
• Triaged all Corporate and Regional Contract Intake Flow requests for products/solutions.
• Created and maintained a Solution Repository to help drive efficiency with triage and assessments and exceed Service Level Agreement (SLA) metrics.
• Handled time-sensitive, critical requests and initiatives for security review with successful turnover time of 48 to 36 hours from initial dissemination to completion.
• Fostered Business Management Relationships (BMRs) for Radiology and Imaging, Specialty Applications, Case Management, Emergency Services, and Consumer Engagement service lines and oversee the security aspects of impending business requests.

System Security Manager (US Department of State) at Deloitte (2022-03 – 2023-12)

• Managed cross-functional teams composed of developers and multilevel analysts for several High-Value Asset (HVA) systems and applications.
• Prepared, distributed, and maintained security plans (i.e., Business Continuity Plans (BCPs), Disaster Recovery Plans, etc.), baselines, guidance, and standard operating procedures (SOPs) concerning agency network systems and applications operations.
• Led collaborative efforts to complete cyber assessments for HVAs such as Zero-Trust, security posture analysis and exercises, and Digital Identity Risk Assessments (DIRAs).
• Spearheaded agency-wide Multifactor Authentication (MFA) implementation and Program Increment (PI) Planning efforts and collaborated with stakeholders to identify existing gaps, design implementation sprints, and define progress metrics.
• Oversaw Risk Management Framework (RMF) remediation efforts in the Assessment and Authorization (A&A) process and leveraged web applications (ServiceNow, Confluence, and Engineering Lifecycle Management (ELM)) to streamline and automate sprints, releases, and change management requests.
• Evaluated compliance of development efforts and artifacts for baseline security safeguards, configuration guidelines, and proper installment of contingency automation against risk frameworks.
• Briefed Government Technical Monitors (GTMs) on remediation efforts, Authority to Operate (ATO) statuses, and impediments to the cyber infrastructure.
• Advised Chief Information Officers (CIOs) and senior executives on potential changes that would impact risk levels, security posture, and continuity planning during quarterly briefings.

Lead Information Assurance Privacy Analyst (Defense Health Agency (DHA)) at Deloitte (2022-02 – 2022-09)

• Developed and maintained complete A&A packages for Medical Community of Interest (Med COI) sites within Enterprise Mission Assurance Support Service (eMASS)
• Tested, reviewed, and updated Control Correlation Identifiers (CCIs) for applicable NIST 800-53 Control Families.
• Created ATO timeline placemats and led weekly syncs with stakeholders to address impediments, metrics, and artifacts.
• Collaborated with Technical Subject Matter Experts (SMEs) and Information Systems Security Managers (ISSMs) to identify and develop authorization boundary diagrams, architecture diagrams, and hardware and software inventories.

Deputy Program Manager (Defense Human Resources Activity (DHRA) Agency) at Deloitte (2020-04 – 2022-03)

• Developed agency templates for SOPs and formal documentation, Strategic Disaster Communications Plans, content for Government Accountability Office (GAO) Questionnaires, and reports summarizing security posture impediments, risks, and proposed mitigation strategies for programs and systems.
• Led quarterly DoD Public Key Infrastructure (PKI) In-Progress Review (IPR) briefs to C-suite leadership which looked into cyber postures, ATO statuses, and roadmaps for cyber-related program lifecycle events (i.e., sunsetting of legacy infrastructure, development of next-generation capabilities, issues with encryption, etc.)
• Helmed FedRAMP ServiceNow (SNOW) implementation by evaluating systems and conducting best-fit analysis to determine potential risks and roadblocks, and outline migration lifecycle.
• Created and defined business requirements and change request processes between cross-functional teams within JIRA.
• Oversaw Agile and Waterfall software development lifecycles utilizing JIRA and worked as a liaison between developers and other stakeholders during software development projects, patches, or fixes.
• Collaborated with other Program Managers to create content to submit to the Requirements Review Board (RRB) and Architecture Review Board (ARB) to secure funding for High Level of Effort taskers.

Cyber and Strategic Risk Consultant (Department of Health and Human Services (DHHS) Agency) at Deloitte (2019-03 – 2020-04)

• Developed programmatic governance roadmaps for Enterprise IT Modernization and Cyber Transformation efforts by identifying security gaps and mapping cyber controls and frameworks best aligned for cloud security, log and threat monitoring, DevSecOps, and enterprise modernization.
• Analyzed and supplemented ATO remediation evidence by exporting network configurations, executing script commands, and performing data scrubs to compile reports using Solarwinds and Powershell.
• Improved policies, processes, and procedures to better align with best practices for cyber posture, vulnerability management, and risk metrics based on National Institute of Standards and Technology (NIST) and Center for Internet Security (CIS) frameworks.
• Created and submitted narratives for SOPs, Requests for Risk Exceptions, remediation summaries, and cyber whitepapers.
• Collaborated with developers to address, track, and remediate the Government Accountability Office (GAO) audit report findings.
• Prepared and disseminated weekly status reports tracking overall security posture metrics, remediation progress, and statuses for Plan of Action and Milestones (POA&Ms).
• Compiled and submitted FISMA Report Packages (Kiteworks) to the Office of Inspector General (OIG) on behalf of the Office of the Chief Information Security Officer (OCISO).

Lead Business and Cyber Analyst at Infinite Technologies, inc. (2017-01 – 2019-02)

• Implemented Information Assurance (IA) policies and procedures to ensure systems were compliant and proper Role-Based Access Control (RBAC) was enforced.
• Supported and monitored progress on ticketed sustainment requests, software issues, and deployments.
• Spearheaded System Administrator duties by inventorying, reimaging, configuring, and issuing Government Furnished Equipment (GFE).
• Led the creation and modification of business requirements and rules for systems and applications and the subsequent comprehensive training for software usability.
• Created and managed Quality Assurance (QA) processes for software and program deployments, patches, and fixes.
• Developed and maintained RMF artifacts and system accreditations in eMASS.
• Reviewed and assessed compliance and efficiency of existing Security Systems Plans (SSP) and Disaster Recovery documents.
• Tested, reviewed, and updated Control Correlation Identifiers (CCIs) for each applicable NIST 800-53 Control Family.

IT Specialist/Quality Control Analyst at IKEA (2015-09 – 2017-01)

• Coordinated with third-party vendors for onsite repairs and department rebuilds.
• Headed the migration from Content Management System (CMS) Drupal 6 to Drupal 7.
• Oversaw and managed the scheduling and training of Digital and Cyber Awareness for the Self-Service Department.
• Traced statistics using available database queries and compiled reports for trends and areas of improvement.
• Collaborated with Senior IT Leadership to schedule and implement system security patches and anti-virus updates.
• Utilized internal data systems (iSell, GADD SQL Platform, etc.) to create trend and efficiency reports for management.
• Supported software, licensing, and hardware compliance using in-house Sub-Contractin

BS in Computer Information Systems, Security+, and AWS CCP