Angela Morrison

· Perform I.T controls risk assessments that included reviewing organizational policies, standards and procedures and provided advice on their adequacy, accuracy, and compliance with NIST SP 800-58, PCI DSS, ISO 27001/2, and CIS

· Coordinate with clients and vendors to support Third-Party Vendor Risk Management processes in various areas to validate vendor risk assessment through a questionnaire assessment process.

· Create SAR or Executive Summary report with the audit team based on Third-party Vendor risk assessment findings and review remediation reports from Vendor to resolve findings appropriately

· Support System Owners and ISSO in preparing Certification and Accreditation package for companies IT systems, making sure that management, operational and technical security controls adhere to a formal and well-established security requirement authorized by NIST SP 800-53

· Ensure risks are assessed, evaluated and appropriate action is taken to limit their impact on the information system

· Prepare and compile required Security Assessment and Authorization (SA&A) documents in a timely manner to facilitate a smooth ATO certification process.

· Enhance internal audit function to further align to company strategy and analyst identified risk to select control that commensurate with the risk

· Create and manage Plan of Action and Milestone POA&M/POAM reports to track identified system vulnerabilities until each one is resolved and approved for closure by the Information System Security Manager (ISSM).

• Implemented and maintained compliance programs in alignment with HIPAA regulations, ensuring the protection of sensitive healthcare information.
• Conducted risk assessments and audits to identify vulnerabilities and recommend mitigation strategies, resulting in improved security posture.
• Developed and documented policies and procedures based on the NIST framework to enhance governance and risk management practices.
• Collaborated with cross-functional teams to address security incidents, investigate breaches, and implement corrective actions.
• Provided training and awareness programs to educate employees on cybersecurity best practices and compliance requirements.
• Generated reports and metrics to track compliance status, identify trends, and present findings to senior management.