Project Portfolio

Led a team that built an application to automate FedRAMP and Department of Defense Cloud Service Provider assessments. Ran several pilots through the application. Trained the assessment team on the use and extensibility of the application.

Conducted comprehensive CMMC and NIST 800-171 controls assessment for defense contractor specializing in thermal management solutions. Evaluated current security posture and provided roadmap for achieving required compliance levels for Department of Defense contracts.

HIPAA risk and security controls assessment for major health insurance provider. Evaluated existing security measures protecting member health information and developed strategic roadmap for enhanced compliance and risk reduction.

Fractional Chief Information Security Officer (vCISO) for leading data center and cloud services provider. Developed comprehensive security program aligned with SOC 2 Type II requirements, including security policies, incident response procedures, and continuous monitoring capabilities.

Developed comprehensive cybersecurity policies and procedures aligned with ISO 27001/27002 standards for major mountain resort company. Created risk-based security framework covering data protection, incident response, and operational security across multiple resort locations.

Designed and implemented HITRUST-compliant security policies and procedures for healthcare technology startup in preparation for HITRUST certification. Conducted training for leadership and staff in policies, procedures and the stringent repeatability of artifacts.

Conducted comprehensive HIPAA risk assessment for local government healthcare operations. Evaluated security controls across multiple departments handling protected health information and developed remediation roadmap to ensure regulatory compliance.

Cybersecurity risk assessment of an acquisition target for a global hotel and resort chain. Evaluated travel technology company's private-label booking engine solutions, security architecture, and compliance posture to inform M&A decision-making and post-acquisition security integration planning.

Assisted in the development and operation of a comprehensive third-party vendor risk assessment program for global private equity firm. Developed standardized assessment methodologies and conducted security evaluations of critical business partners to ensure appropriate risk management across the investment portfolio.

Conducted comprehensive GDPR privacy assessment for global research and advisory company. Evaluated data processing activities, cross-border data transfers, and privacy controls to ensure compliance with European data protection regulations.

Privacy risk and impact assessment (GDPR) for digital publishing platform serving religious communities. Analyzed user data collection practices, consent mechanisms, and data subject rights implementation across multiple software products.

Developed and implemented comprehensive cybersecurity program based on CIS Critical Security Controls (CSC Top 20) for iconic streetwear brand. Addressed unique security challenges in fashion retail including brand protection, intellectual property security, and supply chain risk management.

Conducted comprehensive risk and controls assessment covering NIST 800-171/172, DFARS, CMMC, and FINRA requirements for major research university. Evaluated security controls protecting controlled unclassified information (CUI) and research data across academic departments and research facilities.

Led comprehensive security refactoring of Human Subject Research Oversight & Accountability Database (HSROAD) application. Managed security hardening, FISMA compliance documentation, vulnerability remediation, and AWS cloud migration for critical government research system.

Directed security refactoring and hardening of Clinical Agents Repository Inventory Management (CARIM) application. Developed comprehensive System Security Plan, conducted vulnerability assessments, implemented security controls, and managed AWS migration for critical clinical inventory system.