Pejman Nejad

GRC/Cybersecurity professional with seven (7) years of IT operations and identity management experience, including 3–4 years of hands-on experience in cybersecurity, Governance, Risk, and Compliance (GRC), and security operations. Hands-on expertise in NIST SP 800-171, NIST SP 800-53, CMMC, HIPAA, SOC 2, Microsoft security technologies, cloud security (Microsoft Azure and AWS), vulnerability management, and risk assessment. CompTIA Security+ Certified; eligible for Public Trust and Secret Security Clearance.

Founder & Security Analyst at Sharp Audit LLC & CMC Guardian (2024-01 – Present)

• Built CMCGuardian, an Azure-based CMMC Level 2 compliance platform that generated System Security Plans (SSPs), POA&Ms, and gap analysis reports with SPRS scoring aligned to DoD Annex A control weighting; successfully onboarded the first Registered Provider Organization (RPO) as a pilot partner.
• Architected Azure cloud infrastructure with defense-in-depth controls, including encryption, RBAC, network segmentation, and audit logging, aligned with HIPAA technical safeguards.
• Executed vulnerability assessments using Nessus and SAST tools and prioritized findings using CVSS scoring to support risk-based remediation.
• Developed the platform end-to-end using Next.js, PostgreSQL, Azure Blob Storage, and Stripe subscription billing; implemented cross-document reconciliation to ensure consistency across SSPs, POA&Ms, and gap analysis reports.
• Developed compliance automation workflows that reduced manual audit and documentation efforts by approximately 60%.

IT Operations, IAM & Security Coordinator at Dialectic Solutions (2021-01 – Present)

• Administer identity and access controls for 20+ office, project, and vendor users; implement and enforce MFA and password policies, reducing unauthorized access incidents by 85%.
• Resolve 200+ annual user access issues, including locked accounts, permissions, VPN access, and group memberships, with minimal business disruption.
• Develop and maintain access documentation, including role definitions, access matrices, and access certification schedules.
• Conduct quarterly access reviews across 8 shared drives using least-privilege principles and remediate 15–20 overprivileged accounts per review cycle.
• Deliver security awareness training to 30+ staff on phishing, malware, and social engineering, reducing security incidents.
• Conduct vendor risk assessments for 10+ third-party vendors by validating security documentation and ensuring access alignment.
• Coordinate MFA rollout, password policy enforcement, and secure authentication practices across all business workflows.
• Assist with Meraki MX firewall configuration reviews, network security monitoring, and firewall rule validation.
• Monitor Microsoft Defender security alerts and coordinate investigation and remediation activities with internal IT teams.
• Support Privileged Identity Management (PIM) and Privileged Access Management (PAM) processes for administrative accounts.
• Administer Microsoft Entra ID user lifecycle activities, including user provisioning, deprovisioning, group membership management, and role assignments, while enforcing least-privilege access.

GRC Analyst & Security Operations at PCPAL (2018-01 – 2021-12)

• Conducted gap analyses against NIST SP 800-53, NIST SP 800-171, ISO 27001, and CMMC; developed POA&Ms and control narratives to drive remediation.
• Deployed Splunk and Microsoft Sentinel and built detection rules for persistence, privilege escalation, and credential access.
• Executed 20 Atomic Red Team adversary simulations mapped to MITRE ATT&CK tactics to validate detection coverage.
• Automated incident response tasks using Python for IOC extraction and log parsing and performed endpoint investigations of security alerts.
• Analyzed complex penetration test findings to identify critical security gaps and developed actionable remediation roadmaps.
• Executed regular vulnerability assessments and prioritized findings based on risk severity to reduce the organizational threat surface.
• Collaborated with stakeholders to interpret technical assessment results and translated them into clear, risk-based reports.
• Coordinated end-to-end patch management lifecycles, ensuring the timely deployment of critical security updates across the infrastructure.
• Performed post-patch validation to confirm remediation success and maintain continuous system compliance.
• Maintained detailed documentation of patch activities to support audit readiness and incident response tracking.

B.S. in Cyber Operations – University of Arizona (2026-05)

M.S. in Cybersecurity – George Mason University (2026-09 – 2028-05)