Alexandra T

Cyber Security Analyst @Exelon

Documented and managed Risks in accordance with SP 800-30 and SP 800-37 using nine steps to evaluate the threats, vulnerabilities and security controls surrounding the Information System as well as the likelihood of an exploit and the impact it will have to systems operations. Responsible for monitoring compliance with information security policies by coaching others within the organization on acceptable uses of information technology and how to protect organization systems. Prepared and reviewed Authorization to Operate (ATO) packages (i.e, SSP, RA, CMP, ISCP, DRP, IRP and PIA) for over 1200 systems and facilities. Developed system security plans to provide an overview of federal information system security requirements and described the controls in place or to meet those requirements. Created and updated the following Security Assessment and Authorization (SA & A) artifacts; FIPS 199, Security Test and Evaluations (ST & Es), Risk Assessments (RAs), Privacy Threshold Analysis (PTA), Privacy Impact Analysis (PIA), E-Authentication, Contingency Plan, Plan of Action, and Milestones (POAMs). Performed vulnerability assessment, making sure risks are assessed and proper, actions taken to mitigate them and act as a liaison between external auditors and internal process owners, and respond to external auditor\'s requests. Performed I.T controls risk assessments that included reviewing organizational policies, standards and procedures and provided advice on their adequacy, accuracy and compliance with the Payment Card Industry Data Security Standard (PCI DSS). Prepared Security Assessment and Authorization (SA & A) packages to ascertain that management, operational and technical security controls adhere to NIST SP 800-53 standards. Performed vulnerability assessment, making sure risks are assessed and proper, actions taken to mitigate them and perform Self-Annual Assessment (NIST SP 800-53A).