Cybersecurity professional with 10+ years of experience across the IT industry
Send a job offer directly to this candidate
Cybersecurity professional with 10+ years of experience across the IT industry, focused on cybersecurity strategy, risk, compliance, and control assurance. Experienced applying industry frameworks including NIST CSF and NIST SP 800-series, FISMA/FIPS-aligned requirements, PCI DSS, HIPAA, CMMC and ISO standards to evaluate security posture, strengthen governance, and improve control effectiveness across complex environments.
Senior Consultant, Cybersecurity – Strategy, Risk, Compliance & Resiliency - Ernst & Young LLP (EY)
(2022-01)
Supports enterprise cybersecurity programs by assessing governance, risk management, and control effectiveness across cybersecurity domains, and translating findings into prioritized improvement opportunities. Applies EY cybersecurity assessment methodologies and industry frameworks (e.g., NIST CSF, NIST SP 800-series, CIS) to perform current-state maturity assessments and develop strategic roadmaps. Leads stakeholder interviews and evidence collection to evaluate control design and execution, and synthesizes results into executive-ready reporting.
Supports regulatory-aligned cybersecurity readiness efforts by aligning governance, control assurance, and documentation expectations to applicable requirements. Oversees development of remediation artifacts (e.g., Plans of Action and Milestones) and coordinates evidence packaging and submissions to support ongoing authorization and compliance programs (e.g., StateRAMP). Coordinates application and integration risk assessment activities within audit contexts, documenting risk factors and control gaps in partnership with control owners.
Supports onboarding and integration of security testing capabilities (e.g., DAST / web application scan
Information Security Analyst (GRC) - West Corporation, PA - PA
(2017-09 - 2022-01)
Conducted information security control assessments, third-party risk assessments, and PCI gap assessments; responded to client risk questionnaires. Generated and analyzed vulnerability assessment results and coordinated remediation with system owners to address findings within defined timelines. Facilitated gap analysis of business continuity and incident response plans and participated in tabletop and test exercises.
Supported compliance initiatives through continuous monitoring of security controls and updates to policies and procedures. Experienced with ServiceNow (SNOW) GRC and ITSM modules for managing policies, standards, and procedures. Supported policy lifecycle workflows, IT ticketing (incidents, changes, requests), and user access/entitlement management.
Worked with external auditors on information security compliance activities across regulatory and GRC standards (including HIPAA and SOC 2).
Information Security Analyst - NCR, PA - PA
(2015-09 - 2017-09)
Applied security controls for federal information systems using NIST RMF (NIST SP 800-37) and supported control assessments aligned to NIST SP 800-53 and 800-53A. Reviewed and updated system categorizations using FIPS 199 and NIST 800-60 to validate impact levels and control requirements. Created and updated contingency and disaster recovery plans aligned to NIST SP 800-34 and supported ongoing continuity readiness activities.
Performed continuous monitoring after authorization (ATO) to maintain compliance with security requirements and support audit readiness. Conducted risk assessments to ensure protection of regulated health information in alignment with federal security and privacy expectations. Developed and maintained system security plans (SSPs), security baselines, and supporting documentation aligned to NIST and FISMA/OMB guidance.
Information Security Analyst - BNY Mellon - King of Prussia, PA
(2015-02 - 2015-09)
Conducted security risk assessments for new applications and system changes to validate baseline control compliance and residual risk acceptance. Supported ongoing control monitoring, policy compliance, and remediation tracking for identified vulnerabilities. Performed PCI DSS control risk assessments in preparation for compliance reporting.
Release Analyst (Quality Assurance) - BBC - London, UK
(2011-01 - 2014-11)
IT Service Delivery Engineer - Thomson Reuters - London, UK
(2009-12 - 2010-11)
Systems Engineer - Barclays Capital - London, UK
(2005-01 - 2009-12)
IT Engineer - Department of Work and Pension - UK
(2004-03 - 2005-01)
Bachelors - Computer and Information Systems - University of Derby, UK
