Akwasi Yeboah

GRC Analyst with 8+ years of experience supporting federal and commercial systems through security control assessments, continuous monitoring, and risk management aligned with NIST SP 800-53 and RMF. Skilled in Microsoft Sentinel, Microsoft Defender, and KQL for threat detection, log analysis, and incident investigation across cloud and on-premises environments. Proven ability to develop ATO documentation, validate audit logging, and drive vulnerability remediation using tools such as Nessus.

Experienced in assessing and managing vendor and system risk, implementing mitigation strategies, and supporting compliance with standards such as PCI DSS and SOC 2.

GRC Analyst - Battelle Memorial Institute - Columbus, OH

(2025-04)

• Investigate suspicious activities, including unauthorized access attempts, abnormal login behavior, and malware detections.
• Analyze logs using Kusto Query Language (KQL) across Azure AD, Windows, and Linux systems for threat detection and investigations.
• Develop and refine SIEM analytic rules and detection queries to improve identification of privilege escalation, account misuse, and anomalous activity.
• Support incident response activities, including alert analysis, investigation, containment coordination, and documentation.
• Document investigation findings to support continuous improvement of security operations and monitoring capabilities.
• Create and maintain KQL queries to support security monitoring, audit validation, and compliance reporting.
• Validate audit log ingestion, retention, and monitoring across critical systems in alignment with AU control requirements.
• Identify logging gaps and recommend improvements to enhance visibility and strengthen the organization's monitoring posture.
• Review and prioritize Nessus vulnerability scan results, identifying high-risk security issues requiring remediation.
• Coordinate with system owners to track remediation efforts and ensure timely vulnerability resolution.

Information Security Analyst - ISHPI Information Technologies (IRS) - Suffolk, VA

(2023-02 - 2025-04)

• Performed security control assessments (SCA) for federal systems in alignment with NIST SP 800-53 Rev. 5 and Risk Management Framework (RMF) guidelines.
• Conducted Security Test and Evaluation (ST&E) activities to verify control implementation and effectiveness.
• Reviewed and validated critical ATO documentation, including System Security Plans (SSP), Security Assessment Reports (SAR), and POA&Ms.
• Led evaluation and deployment of advanced security tools and practices to address emerging threats, including AI-driven attacks.
• Analyzed system categorization, risk assessments, and inherited controls to support tailored baseline recommendations.
• Assessed security postures of AWS and Azure cloud-based systems for FedRAMP compliance.
• Conducted issue resolution and exit briefs after assessment testing sessions and documented Risk Exposure Table findings.
• Collaborated with ISSOs, system owners, and stakeholders to recommend remediation strategies and ensure A&A readiness.
• Supported continuous monitoring and compliance activities across enterprise systems.

Third Party Risk Analyst - Columbia Bank - Tacoma, WA

(2020-04 - 2023-02)

• Conducted readiness assessments of service organization controls based on the SOC 2 framework.
• Managed vendor risk activities by ensuring complete documentation of relationships and upload of related contracts for outsourced services.
• Conducted comprehensive third-party vendor risk assessments and reported on vendor risk management activities.
• Delivered actionable recommendations for identified security exceptions and defined remediation strategies, emphasizing PCI compliance.
• Identified and addressed system vulnerabilities, recommending countermeasures and supporting vulnerability management, control mapping, gap analysis, and remediation of penetration test findings.
• Performed internal and focused risk assessments for existing and emerging technologies and services.
• Partnered with IT, HR, contracts, and security teams to address compliance issues and ensure adherence to PCI, SOC 2, and other regulatory requirements.
• Contributed to GRC reporting and presented cyber assessment metrics to senior management to support strategic risk decisions.
• Cultivated strong stakeholder relationships to maintain alignment on information risk management strategies across the organization.

IT Risk Manager - Third Party Management - AGO Worldwide Consulting - Severn, MD

(2017-08 - 2020-03)

• Provided analysis and recommendations for identified security exceptions and participated in defining remediation efforts.
• Documented vendor relationships and ensured contracts for outsourced services were uploaded into the system.
• Performed third-party vendor risk assessments and supported reporting of vendor risk management activities.
• Ensured vendors were classified and assessments were completed in accordance with VRM policy.
• Managed the VRM system as the central repository for vendor contracts, due diligence, and issue management records.
• Provided guidance to business, Legal, Compliance, Purchasing, and other stakeholders to ensure VRM requirements were understood.
• Collaborated with Legal, Compliance, Information Risk Management, Purchasing, and Internal Audit to integrate third-party risk considerations into their risk domain frameworks.
• Monitored compliance with VRM policy and general procedures.
• Maintained detailed VRM policies and procedures.
• Provided senior leadership with risk-based vendor evaluation reporting, identifying material risk areas and sources.
• Reported on vendors supporting core organizational processes and identified vendors or processes representing the greatest risk exposure.
• Developed reporting for unresolved contractual conflicts, including dispute sources, involved parties, timelines, milestones, and expected resolution dates.

Bachelor of Science - Electrical Engineering - University of Akron (2016)