Keshia Djan

Hands-on federal Information Systems Security Officer (ISSO) and Security Control Assessor (SCA) with 10+ years of information security experience supporting federal environments, including VA, DoD, CMS, HHS, DOJ, and SBA. Experienced in managing RMF activities across the authorization lifecycle, supporting and maintaining ATO packages, and working directly with System Owners, engineers, and program stakeholders to keep security documentation, risks, findings, and remediation efforts current. Strong background in SSP, POA&M, SAR, risk assessment, Security Impact Analysis (SIA), continuous monitoring, vulnerability management, configuration/change management, FedRAMP reviews, and eMASS/CSAM-based authorization work.

SECURITY ANALYST / ISSO-SCA at Booz Allen (Ping Wind) (2021-01 – Present)

• Provide hands-on ISSO/SCA support for a portfolio of 9 federal information systems, including complex and high-impact environments, supporting systems throughout the RMF authorization lifecycle.
• Lead and support full ATO efforts for complex federal information systems, performing RMF activities from security categorization and control selection through control assessment, risk documentation, authorization package development, authorization support, and continuous monitoring.
• Maintain monthly POA&M updates for ATO packages, track findings against vulnerability scan results and system risk posture, and work with System Owners and engineers to document remediation progress and keep packages audit-ready.
• Assess extensive NIST SP 800-53 security control baselines for federal information systems, with control scope tailored based on system impact level, inheritance, and applicable security requirements; document assessment results, weaknesses, risks, and recommended corrective actions.
• Perform Security Impact Analyses (SIAs) for major system changes and review Configuration Change Requests to determine security impact and whether proposed changes meet applicable NIST and agency requirements.
• Create assessment modules and requirement traceability/test cases in eMASS, document implementation statements, upload supporting evidence, and validate artifact accuracy and completeness before control and package submission.
• Develop and maintain complete ATO packages, including SSPs, SAPs, SARs, Risk Assessments, POA&Ms, contingency planning documentation, and supporting security evidence used to support authorization decisions.
• Apply RMF requirements to both legacy and new systems, including security control selection, tailoring, implementation review, risk assessment, and development or maintenance of SSP, SAR, and POA&M documentation.
• Work directly with System Owners, ISSOs, engineers, and other stakeholders to remediate security control deficiencies and vulnerabilities identified through assessments and continuous monitoring, validate corrective actions and supporting evidence, and move findings toward closure.
• Successfully support full ATO and reauthorization efforts for large and complex federal systems, helping systems achieve and maintain authorization while supporting continued compliance with NIST RMF and agency security requirements.

ISSO / SECURITY CONTROL ASSESSOR (SCA) at Chenega Corporation (2018-03 – 2020-12)

• Supported day-to-day ISSO and RMF activities for federal systems, maintaining authorization documentation, tracking security risks and POA&Ms, and supporting continuous monitoring and ATO-related activities.
• Transitioned security authorization and continuous monitoring activities from CSAM to Archangel, helping maintain system records and supporting a more efficient authorization workflow.
• Obtained and reviewed FedRAMP authorization packages for SaaS and PaaS solutions and evaluated cloud systems seeking agency authorization against FedRAMP and federal security requirements.
• Reviewed cloud security packages and provided authorization recommendations to the Authorizing Official based on control implementation, identified risk, and supporting evidence.
• Developed and maintained SSPs, POA&Ms, Contingency Plans, Configuration Management documentation, PTAs, and PIAs; reviewed PIAs following positive PTAs and supported documentation of PII in the applicable SORN.
• Managed POA&M and remediation activities as part of continuous monitoring, working with stakeholders to track weaknesses, planned corrective actions, and risk status.
• Supported implementation and authorization of new systems by completing ATO checklist activities, identifying information types, supporting system categorization, and developing System Security Plans.
• Reviewed Incident Response Plans against NIST requirements and coordinated plan testing and tabletop exercises with technical and program teams.
• Analyzed automated vulnerability scan results, validated findings and false positives, and supported risk-based remediation decisions.
• Participated in security control assessments, Configuration Management activities, and weekly Change Control Board meetings to evaluate changes to authorized system baselines.
• Tracked program risks, issues, metrics, and security status and briefed the ISSM and stakeholders during recurring status meetings.

SECURITY ANALYST at CEDIS Systems (2016-08 – 2018-02)

• Supported initial and ongoing Security Assessment and Authorization activities for on-premises and FedRAMP-authorized cloud systems, helping keep A&A documentation accurate, current, and ready for review.
• Conducted security control assessments for moderate-impact systems against NIST SP 800-53 requirements and worked with ISSOs, System Owners, and IT staff to identify risk and recommend remediation.
• Performed risk assessments for medical devices and VA environments, collaborating with vendors and biomedical engineers to review technical documentation, evaluate security risk, and support network authorization decisions.
• Used Nessus, IACS, CSAM, and Splunk to support vulnerability analysis, security assessments, evidence review, and continuous monitoring activities.
• Developed procedures and templates supporting the Security Assessment and Authorization process and federal compliance requirements.
• Supported preparation of Certification and Accreditation / authorization packages and maintained security documentation for assigned systems.
• Prepared and presented security and risk briefings to senior management and supported recommendations related to network security operations and continuous monitoring improvements.
• Designed enterprise network topology documentation for VA sites to illustrate communication paths among devices, servers, and routers and support system security analysis.

IT SUPPORT SPECIALIST at iFem Wireless (2012-06 – 2015-07)

• Provided remote and on-site technical support, documented incidents, and escalated complex issues in accordance with established IT procedures.
• Developed and maintained technology, security, privacy, and customer support procedures to improve consistency in incident handling and user support.
• Supported administration and enforcement of organizational security policies and assisted project teams with technology and agency-policy requirements.

Bachelor of Science in Cybersecurity Technology – University of Maryland Global Campus

Master of Science in Cybersecurity Management and Policy – University of Maryland Global Campus