Tetra Tech

Manages a team in reviewing and maturing the client's security program and providing cost effective steps to achieve goals.
● Coordinate with stakeholders to define next steps of their information security program.
● Document project plan based on stakeholders requirements and organization compliance requirements.
● Identifies areas where current security policies and procedures require change, or where new ones should be developed,
specifically regarding growth.
● Verify FedRAMP and CMMC accreditation and artifacts for systems that operate within the environment.
● Identify security compliance issues and communicate the best approach with systems owners and their system managers.
● Refined metrics for tracking within risk scorecards improving business operations actions and processes.

Cyber Security Project Manager

Frontier Communications

Led search and analysis of privacy vendor solutions. Reviewed technical/business requirements from Frontier as well as vendor
technical requirements. Evaluated and refined processes based on system owners’ requests.
● Successfully launched the privacy compliance program within six months for compliance with CCPA and CTDPA.
● Created vendor self-assessment specialized questionnaires based on various types of accesses which resulted in a week
response time for vendors compared to the original three to four week time.
● Collaborated on multiple concurrent projects of varying criticality and priorities.
● Cultivated strong relationships with system owners, engineers, and architects during data discovery phases. Data gathered
would be used to integrate and prioritize systems in support of rollout of vendor solutions.
● Developed, published, and maintained playbook for all data subject access requests (DSAR) received through OneTrust with
regular collaboration with system owners, privacy professionals, and business leaders.
● Coordinated sprint schedules of six major systems for streamlined DSAR fulfillment.
● Collaborated on webform development on OneTrust for consumer privacy requirements based on the California Consumer
Privacy Act and Connecticut Data Privacy Act.
● Facilitated working sessions between legal and system owners to define requirements for PII deletion based on business
requirements.
● Created a dashboard within Excel to effectively track metrics and processes for vendor security assessments. Provided regular
updates to Senior Directors and VP.
● Assisted in developing a roadmap for cyber security maturity by providing effective steps in multiple areas within the
environment.
● Provided certification subject matter expert support for PCI-DSS, SOX, ISO 27001, and NIST frameworks.

Cyber Security Principal

Booz Allen Hamilton

-Reviewed, drafted, and commented on documentation pertaining to critical infrastructure, election security, and defense industrial base.
-Coordinated multiple agencies and organizations on tasks.
-Ensured the utilization of comprehensive cybersecurity framework that enables management of clients' cybersecurity to make accurate risk-based decisions with a focus on resources for tactical and strategic cybersecurity operations.
-Provided recommendations for prioritization of audit findings based on highest potential impact and risk to the organization.
-Reviewed third party risk assessments and recommends courses of action to clients that minimize risk while meeting business requirements.
-Performed periodic reviews of government cybersecurity policies and provide recommendations for enhancements based on federal compliance mandates, and current and emerging cybersecurity threats and trends.

Senior Cybersecurity Threat Analyst

•Built and managed a team of ten information assurance analysts over six projects, including successfully completing the first Authorization to Operate for a cloud within the client’s environment.
•Engaged with engineering teams for technical and logical compliance during audit reviews of environments and applications.
•Communicated and coordinated customer’s security strategy, programs, business requirements, and services with a diverse group of mission stakeholders.
•Provided GRC with eMass to multiple environments (cloud, physical, and application) within customer’s enterprise. Risk level assessments based on eMass scores would then be discussed with customer’s Director of Information Security.
• Built and maintained working relationships with various teams within customer’s organization.
• Provided support with RMF framework, and review controls in place and verify that documentation is current and reflects what is in place.
•Reviewed and answered security controls based on NIST 800-53 and 800-171. This included drafting out Business Impact Analysis with customer to define which controls would be necessary.
• Created and maintained POAMs based on vulnerability scans and control gaps. I coordinated with engineers/admins/developers to determine criticality of the vulnerability were able to be met in specific timelines and whether there were secure workarounds until proper mitigation was in place.
•Developed business continuity plan and disaster recovery plan and coordinates with teams within the organization.
• Reviewed and advised on cloud security architectures, security components, and correct implementation of controls set in place for compliance and accreditation.
•Monitored and reviewed change management within facility to verify testing has been conducted, documentation has been submitted, and any lessons learned documented.
•Successfully lead Security Development Life Cycle for application development on three projects from planning to deployment.

Senior Information Security / Assurance Manager

AECOM

-Maintained compliant antivirus signatures on multiple networks.  
-Provided access control for multiple applications by verifying user access based on clearance and active directory permissions.  
-Initiated and analyzed vulnerability scans on networks based on DISA STIGs.  
-Maintained account compliance by monitoring iPost and notifying users/owners and their managers of out of scope accounts.

Information Security Specialist

SBG Technology Solutions, Inc.

Assisted customer with their transition from DIACAP to RMF. 
Researched available continuous monitoring tools.

Information Security Engineer

Kratos SecureInfo

Serves on a team of information security professionals in the development of security policies, procedures, and security certification & accreditation (C&A) packages for a variety of commercial and government activities worldwide.  Oversees the development of System Security Authorization Agreements.  Performs threat vulnerability assessments; provides security test and evaluation support; provides technical support in the evaluation of security products; and, develops information system security studies and reports that address areas of information system security concerns.  Consults in all areas of information system security, including physical security, administrative security, personnel security, computer security, operations security, and industrial security.

Information Assurance Security Officer

Universal Consulting Services, Inc.

Provided daily download, test, and installation of virus definition files.  
Provided daily monitoring to ensure anti-virus/anti-malware protection is maintained. 
Coordinated scanning file/folder exclusions with other application owners. 
Entered change requests, attended the Technical Configuration Control Board and the Change Management Board to obtain approval for changes/updates. 
Resolved incidents related to anti-virus/anti-malware. 
Coordinated with the BigFix and Enterprise Management System Tools support teams to reconcile computers appearing with one system and not the other; or, assistance with temporary workarounds. 
Planed and carried out projects for routine application or hardware upgrades. 
Provided compliance reports. 
Monitored McAfee information for available patches and upgrades. 
Tested and installed operating system patches (offered by BigFix) on anti-virus servers. 
Downloaded, tested, and installed application patches. 
Provided process improvement recommendations. 
Coordinated with other IT Services Division as necessary. 
Created and delivered project lifecycle management documentation. 
Part of the Emergency Response team.

Lead Malware Engineer

Truestone, LLC

Coordinated with client management to formulate complex technical solutions. 
Informed client management of appropriate developments in technical support products. 
Evaluated products and upgrades for appropriateness. 
Oversaw and implemented system upgrade strategies. 
Led the implementation, and maintenance of complex solutions. 
Coordinated activities with other technical personnel as appropriate. 
Developed and analyzed highly complex system standards, thresholds, and recommendations to maximize system performance. 
Developed strategies to manage the frequency of appropriate support package/patch application. 
Monitored ePO SQL database maintenance and provides appropriate recommendations, when required. Shared knowledge with other ePO staff and assists other technicians or less experienced personnel with difficult, in-depth operational tasks. 
Set program policies within ePO for users, based off of location and job duties. 
Provided technical solutions and escalated support for non-routine, highly complex technical issues. 
Part of the Emergency Response team.

Vulnerability Analyst

BAE Systems IT

Assigned IP ranges to user from database of addresses. 
Tracked the IP addresses and request processing. 
Monitored network connections, notified technicians of outages and/or status. 
Processed and assign users network requests and circuit requests for satellite air time. 
Assisted users in troubleshooting their IP addresses, equipment, connection speeds, or other general issues. 
Prepared and presented high level presentations for morning briefings.

Network Analyst

General Dynamics AIS

• Trained security operations center (SOC) members on multiple legacy systems during transition from incumbent.
•Monitored and report activities on Snort and Symantec Network Security Console.
•Maintained quality control of server rooms; checked temperature gauges and humidity, perform status checks on servers, replaced tapes.
• Windows system administration using active directory; created/modified/deleted user accounts and groups.
• Installed applications, configured servers, adjusted firewall settings based on customer needs.
• Assisted with the training of new employees/agents to the mission.
• Troubleshot and document issues of the user.

System Administrator/Shift Lead

I'm an experienced information security leader with fifteen years in management consulting industry. I am skilled in Information Assurance, Cloud Security, Risk Management, and Information Security Frameworks. I graduated with an MBA from James Madison, and I'm ready for the next step in my long term career goal of becoming a CISO.

Taplio

Samuel Pena III's Linkedin Analytics

Want to drive more opportunities from LinkedIn?

Taplio

.css-1jgreyo{background-image:linear-gradient(284deg, rgba(39,43,72,1) 0%, rgba(33,47,183,1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Samuel Pena III's Linkedin Analytics

Want to drive more opportunities from LinkedIn?

Samuel Pena III's Linkedin Analytics