Robert Wood

CISO | Servant Leader | Advisor | Lifelong Student (posts here are my own opinions and musings)

I have built, scaled, and run security programs as a CISO at 4 different organizations ranging from small tech startups to trillion dollar government organizations. The early part of my career was spent working in application security and red teaming. Cybersecurity is a passion of mine; using it to do amazing things is something that gets me fired up.

That’s why I founded Sidekick Security. To help organizations achieve security-led growth and digital transformations. In an age of trust as currency in so many industries, I believe this is the time when security truly can be an enabler. 

Beyond that, I am a lifelong learner. I love studying outside of my field and finding ways to expand the mental models I have to solve problems differently, more effectively, or to think about them in altogether new and fresh ways. 

Founder and CEO

Helping to connect SMBs and startups with exceptional security talent. A fresh, blue ocean strategy on the cyber security services market for organizations that really need it. 

HHS Office of Inspector General

Assistant Director for Cybersecurity and Information Technology Audits

Health Resources and Services Administration (HRSAgov), HHS

Serve as the Information Systems Security Officer for critical information systems and ensures the agency maintains a FISMA compliant information security program. In this role, provide direct support and serves as an  advisor  to the HRSA Chief Information Officer, Chief Information Security Officer, and other senior officials on the secure design, implementation, maintenance, or modification of HRSA information systems.  Performs internal assessments and audits of system risk and compliance with NIST Cybersecurity Framework and Risk Management Framework. 

Lead projects with infrastructure and development teams to ensure systems are fully patched, vulnerabilities are remediated, firewall rules are cleaned, system configuration settings are hardened, databases are encrypted, and disaster recovery documentation is developed. Develop metrics and thresholds for service delivery to ensure the operational security posture functions at a high level. As projects are executed, provide on-going and consistent level of communications that keeps managers, staff and customers fully apprised of system and project status as well as issues impeding progress


Independently develops all Assessment and Authorization (A&A) documentation to include System Security Plans, Configuration Management Plans, Business Impact Analysis, Incident Response Plans, Contingency Plans, and Privacy Impact Assessments. 

Performs detail-oriented analysis on security requirements for new systems. This includes Government hosted systems, and cloud hosted systems. Performed detail gap analysis on agency requirements and strategy for control implementation.

Lead Information Systems Security Officer

USDA-NRCS

Ensures the enforcement of National Institute of Standards and Technology
(NIST) Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, OMB, Circular A-130, Federal Information Security Modernization (FISMA) Act of 2014, Public Law 107-347 and NIST SP 800-53 Rev 4 to conduct comprehensive and regular risk assessments of NRCS IT systems.

Uses detailed -oriented and analytical skills to interpret, develop, recommend, evaluate effectiveness of, and disseminate policy and guidance on Information Assurance program requirements. Conducts System Impact Analysis (SIA) to determine whether changes to NRCS IT systems warrant re-accreditation or vulnerability assessment.

Conducts follow-up sessions with IT System Owners, Investment Managers and Project Managers to verify corrective action status and update management on a regular basis of the progress of the POA&M remediation activities for each weakness. Incumbent participates in network and systems design to ensure implementation of appropriate systems security policies.

Orally communicates complex technical information into a clear, convincing, and logical manner by delivering briefings, presentations, facilitating courses and meetings on a wide range of Cybersecurity matters that affects USDA information systems and areas of interest to senior level management officials

Represents the Chief Information Security Officer as directed as the NRCS security official for Security matters including, but not limited to Authorization and Assessment (A&A), FedRAMP certification, and Continuous Monitoring on Integrated Project teams and system gate reviews.

Maintains relationships with members of other work units within the organization that have diverse needs, assessed needs and provided needed information

Cybersecurity Compliance Analyst

Serves as the Information Systems Security Officer for critical information systems to include the agency General Support System(GSS). Plans and manages GSS security program activities including security assessment and authorization (SA&A), plans of actions and milestones (POA&Ms), privacy awareness and incident response.

Leads projects with infrastructure teams, development teams, and other ISSOs to ensure systems are fully patched, vulnerabilities are remediated, and configuration settings are hardened. Develops metrics, thresholds, and dashboards for service delivery to ensure the operational security posture functions at a high level. Provides on-going and consistent level of communications that keeps managers, staff and customers fully apprised of system and project status as well as issues impeding progress

Develops processes, mitigation plans, and standard operating procedures to address weaknesses, findings and POA&Ms. These include processes for privilege user account reviews, mobile device security, foreign travel and IT equipment, protection and sanitation of hard drives and SSD drives.

 
Analyzes results from vulnerability scans to determine the appropriate level of risk for the HRSA network and the Demilitarized Zone. Applies HHS security policies, concepts and practices to plan, coordinate and manage the development and implementation of IT security strategies.

•	Actively participating in the DHS Continuous Diagnostics and Mitigation program to ensure HRSA systems receive security systems and services at optimum pricing. In addition, participates in the Change Advisory Board and ensures security implications are considered for all IT changes. 

Leads OIT’s disaster recovery program and authors applicable contingency plans and business impact analysis. Works with program offices to determine various systems maximum tolerable down time, and recovery time objectives.

Information Systems Security Officer

U.S. Department of Justice, Office of the Inspector General

Provides technical leadership and advice to system administrators, security specialists, application developers, and other stakeholders on critical IT programs regarding security and risk. Plans and coordinates governance framework and manages the security portion of all major IT initiatives.  Develops long-range objects and milestones for major IT security projects. Developing statements of work to procure the tools or services, and acquires independent assessors to perform control assessments and penetration tests. Includes cost benefit analysis, budget justification and project implementation plans for remediation strategies and projects are frequently approved by senior management official.

Maintains the responsibility for all information assurance (IA) program requirements and system accreditation and certification documentation to include developing risk assessments, risk analysis documentation, system security plans, contingency plans,  privacy impact assessments, Plan of Action & Milestones (POA&Ms),  Authority to Operate (ATO) documentation, and other requirements derived from Federal Information Security Management Act (2002 and 2014), OMB Policies and Memorandums,  NIST Special Publication 800 Series documents, DOJ IT Security policies and standards, and Federal Information Processing Standards. Gathers, evaluates, and verifies all security documentation during this process by use of continuous monitoring tools, security tests, and interviews. 

Develops programs, Plan of actions and milestones, along with budgetary information to address any risks or weaknesses identified during assessments and audits. Works with management and IT network staff on development of metrics to ensure timely compliance with all applicable standards.

Researches, develops, and enforces IT security policies, procedures, guidelines, and awareness to the OIG community to assure the protection of the security, confidentiality, integrity, reliability, and availability of information systems and assets. 

Responsible for receiving the Authority to Operate (ATO) of information systems by using the Cyber Security Assessment and Management Tool (CSAM) to complete all certification and accreditation activities to include but not limited to: developing and exercising the OIG’s system security plan, incident response, and IT contingency plan, performing risk assessments, and provide analysis and reports of compliance with metrics in applicable policies such as FISMA and NIST SP-800 publications.

Analyzes, coordinates, tests, implements, and maintains the application of IT standards, controls, patches, and software updates to systems by communicating vulnerability patch requirements, coordinating incident response activities, and conducting contingency planning tests and exercises with IT and other pertinent professional staff, and performing annual self-assessment of NIST controls.

Works with Operations staff to use security tools such as Tenable Security Center, Nessus Security Scanner, and Symantec for workstation and server hardening, intrusion detection and vulnerability scans. 
	
Performs excellent customer service by working with customers and agency stakeholders to assess their needs, provide information or assistance, resolve their problems or satisfy their expectations regarding use of classified and unclassified systems, and advise them of policies and procedures in order for them to effectively accomplish their mission without compromising IT Security.

Identifies complex problems, issues, violations, and incidents, determines the relevance and accuracy of the information gathered regarding the problem, and uses sound judgment to resolve the issues, evaluate alternatives and make recommendations.

Security Specialist

Conducted audits in several divisions to assess information security vulnerabilities and assign risk scores. 

Coordinated an extensive effort to ensure all 450 employees’ desktops have encryption software

Performed extensive research to promote information security awareness and organized information security training for the Office of Human Resources office.

Student Employee

Detail oriented and analytical Cybersecurity and Risk Management Professional with significant technical, administrative, and project management experience. Assesses organizational needs and mission/ business processes to develop and manage an effective Cybersecurity program. 

taplio

The Battle

Robert Wood

IB Mansaray, CISSP

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?