Bradley Josephs

• Leads client through ISO 27001/27701 certification, including management of GRC tool. • Prepares and presents reports to senior management, highlighting key security risks, compliance status, and recommended actions for continuous improvement.

• Represents CSP in meetings with the JAB, FedRAMP (FR) PMO, and Agencies during ATO and ConMon reviews. • Leads CSP to obtain multiple ATOs: FR JAB High, FR Agency Moderate, DoD IL5, and StateRAMP (SR) • Develops Rev. 5 security authorization packages and addendums for multiple CSPs. • Builds and leads CSP FR ConMon program: POA&M, deviation requests, SCRs, and managing risk mgmt. triggers. • Performs CSP FR Rev. 4 to Rev. 5 gap analysis, prioritizes remediation, transition to FR Rev. 5 compliance. • Performs 3PAO assessments and gap analyses of FR Moderate, High, and DoD IL5 cloud service offerings (CSOs). • Specalized in performing vulnerability scan analysis across all applicable layers. • Partners with SecOps to implement CSP IR Workflow and response to CISA Emergency Directives (EDs).

• Led enterprise-wise GDPR gap assessment and remediation; obtained $1M budget for compliance initiatives. • Developed and performed PIAs and DPIAs on third parties, projects and products. • Designed and implemented GDPR data breach IR process and Data Subject Access Rights (DSAR) process. • Developed and managed information security and privacy awareness training program.

• Performed role of action CISO and Privacy Officer for 4 months, leading the company through a CFIUS audit. • Managed all external-facing customer audits; designed and implemented 3rd party risk management program. • Onboarded Managed Security Service Provider (MSSP) and QRadar and designed enterprise IR process. • Led InfoSec program management of SOC, McAfee Web Proxy, Palo Alto Networks, and DLP.

• Wrote security plan and supported construction, implementation, and deployment of a facility housing ICE mission essential functions (MEFs) and a continuity of operations site; managed costs, project plan, functional and security requirements. • Performed project management oversight of the transition of Service Desk operations and gathered functional requirements for the development of an enterprise telephone system, communicating these requirements to the vendor prior to design. • Developed, documented, and implemented continuity of operations, contingency, and disaster recovery strategy, plans, and training material • Led tabletop contingency and incident response tests and documents lessons learned.

• Documented the security control implementation, as appropriate in SSP from various VA sites, providing a functional description of the control implementation. • Monitored Security Controls by interviewing system owners, network/system/application administrators and other key personnel and developing/updating contingency plans, configuration management plans, privacy impact assessments (PIA), incident response plans, and security configuration checklists.

• Performed security assessments/audit of SBA third-party provider systems and facilities and internal systems using organizational security policy and NIST SP 800-53 Rev. 3/800-53A Rev. 1 • Wrote the SBA Enterprise Information Security Policy in accordance with NIST SP 800-53 Rev. 4. • Collaborated with SBA executive management to develop a monitoring plan for third-party providers and vendors for new and existing information systems. • Provided security oversight for SBA acquisitions by reviewing acquisition documentation, interconnection security agreements (ISAs) and memorandums of understanding/agreements (MOU/A).

Security Analyst, Bureau of Indian Affairs (BIA) • Performed Security, Test and Evaluation (ST&E) of BIA information systems and facilities in accordance with NIST SP 800-53 Rev. 2 for 34 Major Applications (MAs) and 4 General Support Systems (GSS) using the NIST SP 800-53A assessment methodology. • Provided technical vulnerability analysis (TVA) of BIA information systems using Nessus and nCircle IP360 and evaluated the patch management program using MS SCCM, MBSA and Gold Disk. Research Analyst, Networx Transition Team, Department of Commerce (DoC) • Provided program management strategy for the transition of telecommunications services from the FTS2001 contract to the Networx contract. • Conducted Networx transition risk management meeting with 28 DOC Bureaus and stakeholders Information Assurance Analyst, Department of Commerce (DoC) • Performed C&A/ST&E of the CSC General Support System (GSS), ST&E in accordance with NIST SP 800-53, Rev. 2 and NIST SP-800-53A. • Provided DoC Technical Support Division (TSD) Director with recommendations for POA&M closure and for Residual Risk Acceptance and Mitigation Strategies.

• Conducted C&A of the FDA Consolidated Infrastructure (CI), consisting of the following modules: UNIX, Windows, Perimeter Security Infrastructure, Extranet, VoIP, Internal Network Infrastructure, Storage Area Network (SAN), VMS, Active Directory (AD), ePolicy Orchestrator (ePO), Microsoft System Management Server (SMS) • Conducted C&A Interviews with CI module SMEs.