Alfred Agyemang
423 Parkview Ave,MD
Summary
Detail-oriented Information System Security Officer with extensive experience in RMF activities, control assessments, and POA&M tracking for federal systems. Facilitates SSP, SAR, contingency planning, and security testing while coordinating evidence collection and vulnerability reviews. Leverages expertise in ACAS, Nessus, Nmap, STIG checks, and policy review to enhance documentation quality and expedite compliance package reviews.
Overview
1
1
Certification
5
5
years of professional experience
Work History
Information System Security Officer (ISSO)
Hyland Company LLC- Deloitte (National Transportation Safety Board)
11.2026 - Current
- Researched and addressed information security issues to complete RMF packets; created and updated RMF documentation including System Security Plans (SSP), SARs, contingency plans, and control family policies.
- Drafted, reviewed, and updated Plans of Action and Milestones (POAM) to address non-compliant items and developed mitigation strategies.
- Identified trends and root causes of system failures or vulnerabilities using ACAS scans, NESSUS vulnerability scanner, and Nmap to analyze ports, weak configurations, and missing patches.
- Developing and conducting ST&E (Security Test and Evaluation) according to NIST SP 800-53A and performing on-site security testing and reviewing vulnerability scan results.
- Assist in developing Risk Assessment plan and completing risk assessment tab as needed in RMF share point drive.
- Working with other ISSMs/ISSEs to provide updated security scans to address controls requiring STIG checks.
- Coordinate security testing
- Developing, maintaining, and communicating consolidated risk management activities and deliverables calendar to meet deadlines. Evaluate schedule as needed to avoid delays in the ATO process.
- Conducting meetings with the IT team to gather documentation and evidence about their control of the environment. Brief other members of the team and share information as needed to gather artifacts for submission into eMASS.
- Overall, complete packages to receive a 3-year ATO or request extension for packets requiring more time due to project delays, issues with testing or any other issues identified.
Security Analyst II
Chesapeake Employers' Insurance (Towson MD)
Towson, MD
12.2021 - 10.2026
- Perform security control assessments (SCA) for systems to determine their effectiveness using NIST SP 800-53A Rev4 (Examine, Interview, and Test).
- Conduct security test and evaluate (ST&Es) and develop supporting documentation of test results.
- Document and finalize Security Assessment Report (SAR).
- Developed and maintained assessment deliverables, including Final Security Assessment Reports (SAR), Risk Executive Recommendation Memo, and ATO Letters.
- Managed Plan of Action and Milestones (POA&M) for identified vulnerabilities, ensuring timely remediation actions in alignment with FISMA requirements.
- Reviewed and approved contingency plans and contingency plan tests (CPs/CPTs) in CSAM to ensure compliance and effectiveness.
- Work with system stakeholders to develop and update A&A documentation for assigned systems in accordance with FISMA and other regulatory requirements.
- Review Artifacts to verify and validate security controls implementation statements.
Education
Master of Science - Finance and Economics
University of Macerata
Macerata, Italy04-2019
Bachelor of Science - Business Administration
University of Ghana
Ghana05-2015
Skills
- Cloud security
- Data loss prevention
- Control testing
- Policy review
- POA&M oversight
- Access control management
- Network security
- Patch management
- Mobile security
- Identity and Access management
- Security awareness training
- Vulnerability scanning
- ATO packages
- POA&M tracking
Personal Information
- Nationality: US Citizen
- Visa Status: Clearance: Public Trust
Certification
- CompTIA Security+ Ce (Active)
- Certified Information System Manager CISM – Active
- Certified Information System Auditor CISA - In progress
SUMMARY OF QUALIFICATIONS
- Experience with NIST 800 SPs to include but not limited to NIST SPs 800-18, 800-30, 800-37, 800-53 & 53A, 800-60, FIPS (199 & 200), OMB, FISMA regulations.
- Highly knowledgeable in the performance of Security Control Assessment (SCA), prepare report on management, operational and technical security controls for audited applications and information systems
- Experienced with Performing Security Categorization (FIPS 199), Privacy Threshold Analysis (PTA), E-Authentication with business owners and selected stakeholders
- Experienced in Documenting and reviewing System Security Plan (SSP), Security Assessment Report (SAR), Security Plan of Action and Milestones (POA&M), Authorization letter/memorandum (ATO)
- Perform Vulnerability Assessment. Make sure that risks are assessed, evaluated and proper action have been taken to limit their impact on the Information and Information Systems
- Participate in Change Control Board (CCB) briefings/meetings with all client/system senior management.
- Risk Assessment and Analysis skills, quick thinker, taking initiatives and a Problem Solver
Timeline
Information System Security Officer (ISSO)
Hyland Company LLC- Deloitte (National Transportation Safety Board)
11.2026 - Current
Security Analyst II
Chesapeake Employers' Insurance (Towson MD)
12.2021 - 10.2026
Master of Science - Finance and Economics
University of Macerata
Bachelor of Science - Business Administration
University of Ghana