Xavier Dobey

GRC professional with multiple years of experience leading cybersecurity assessments, risk management initiatives, compliance programs, vulnerability management, and security advisory services across highly regulated federal environments. Validated success conducting risk assessments, evaluating security controls, developing policies and procedures, advancing audit readiness, and advising stakeholders on risk mitigation strategies. Well-versed with NIST CSF, NIST 800-53, NIST 800-171, ISO 27001, FedRAMP, FISMA, HIPAA-related privacy and security activities, third-party risk management and continuous monitoring programs.

Recognized for translating complex security requirements into practical business solutions while improving organizational security posture and compliance readiness.

Senior GRC Specialist/Security Steward at Centers for Disease Control (CDC) (2023-09 – Present)

• Serves as the primary security steward for five (5) federal information systems, ensuring compliance with FISMA, NIST 800-53, and FedRAMP requirements.
• Provides expert advisory support to system owners, SSPOs, and leadership on cybersecurity policies, risk posture, and control implementation decisions impacting mission-critical systems.
• Lead enterprise-level risk assessments and vulnerability analyses, identifying control gaps and recommending mitigation strategies that reduced overall system risk exposure by approximately 30%.
• Develops, implements, and maintains security policies, procedures, and control standards, thus strengthening system reliability, availability, and protection against unauthorized access.
• Directs ATO lifecycle activities, including SSP development, control validation, and POA&M management, reducing ATO processing timelines by 20–25% through workflow optimization.
• Conducts security architecture and system integration reviews, ensuring new technologies align with enterprise security requirements and federal compliance standards.
• Coordinates enterprise risk inventory and critical asset identification, maintaining accurate records of system components, risks, and mitigation status.
• Prepares and delivers executive-level briefings, dashboards, and reports, improving visibility into system security posture and reducing reporting effort by 15–20%.
• Facilitates stakeholder engagement sessions and cross-functional collaboration to align security strategies with operational and regulatory requirements.

GRC Consultant at Fedex (2025-07 – 2026-07)

• Evaluated and implemented 100+ security controls, strengthening compliance posture and reducing control deficiencies across enterprise systems.
• Developed security documentation, over 25 assessment reports, executive briefings, and client deliverables improving stakeholder visibility into risk and compliance status.
• Researched emerging cyber threats, vulnerabilities, and industry trends, contributing to risk mitigation strategies and security awareness initiatives.
• Collaborated with cross-functional teams to develop security strategies, frameworks, policies, and road maps aligned with business objectives and regulatory requirements.
• Managed stakeholder relationships across multiple engagements, maintaining high client satisfaction through proactive communication and risk-based guidance.
• Created dashboards in Power BI to visualize risk registers with heat maps showing likelihood vs impact.
• Tracked control testing status and evidence collection progress.
• Utilized Power BI to reduce reporting time from days to hours with automated, refreshable dashboards, which allowed senior managers to view quickly and lead risk conversations.

Compliance and Privacy Analyst at Maximus Contractor (CDC Contractor) (2020-05 – 2023-09)

• Conducted 50+ comprehensive risk assessments and third-party security evaluations, reducing vendor-related risk exposure by approximately 20% prior to onboarding.
• Evaluated system architectures, SSPs, and security controls, identifying vulnerabilities and recommending remediation strategies aligned with NIST 800-171 and federal standards.
• Developed and executed Privacy Impact Assessments (PIA) and Privacy Threshold Analyses (PTA), ensuring 100% compliance with federal privacy requirements.
• Supported vulnerability scanning and remediation activities, achieving 98% compliance with remediation SLAs and reducing exposure to known threats.
• Designed and maintained risk dashboards and reporting tools, reducing stakeholder review time by 15–25% and improving decision-making efficiency.
• Provided guidance on risk acceptance and mitigation strategies, supporting governance structures and enterprise risk management practices.
• Validated Assisted in the development and interpretation of security policies and procedures, ensuring consistent compliance across systems and programs.

CAD Design Engineer at Northrop Grumman (CDC Contractor) (2013-11 – 2020-05)

• Led cross-functional design projects, coordinating across multiple engineering disciplines to meet federal standards and deadlines.
• Served as project lead, managing schedules and deliverables, improving team efficiency and reducing project delays.
• Supported development of designs impacting secure environments and contributed to foundational knowledge of system architecture and integration of state and federal laws.
• Provided mentorship and oversight to junior team members, improving quality and consistency of deliverables.

Master of Information Technology Management in Information Security – Keller Graduate School of Management

Bachelor of Science in Computer Information Systems (Cybersecurity Programming) – DeVry University

Associate degree in Drafting and Design – Gwinnett Tech