SDIS Risk Assessment & Risk Register (Healthcare SaaS)
Interactive work samples
SDIS Risk Assessment & Risk Register (Healthcare SaaS)
NIST ISO SOC2 Crosswalk
About
I help organizations prove they are secure, not just say it. My work sits where governance meets technical risk: I map controls to NIST 800-53 and ISO 27001, build System Security Plans and POA&Ms, and turn raw scan data from Tenable and Qualys into remediation plans that engineers can act on and leadership can understand. Before cybersecurity, I spent years in operations and project coordination. That's where I learned to manage deadlines, document processes clearly and keep many stakeholders aligned. I now apply those skills to audit readiness, risk assessments and vulnerability triage. I'm comfortable with frameworks and with findings, and I translate between the two. I'm looking for a GRC Analyst, IT Risk Analyst or Vulnerability Management Analyst role where I can reduce real risk and keep audit evidence clean.
Certifications
CompTIA Security+CompTIA · Jun 2026
ISC2 Certified in Cybersecurity (CC)ISC2 · Mar 2026
CompTIA CySA+CompTIA · Sep 2026
CISAISACA · Jan 2027 · In progress
Skills
Frameworks
Tools
Transferable strengths
Projects
Risk Management
System Security Plan (SSP) — Moderate Baseline
COMPLETEDeveloped a full SSP for a fictional patient portal at Lakeshore Health Partners. I categorized the system as Moderate under FIPS 199, selected and tailored the NIST…
NIST RMF (SP 800-37) · Prepare · Categorize · Select · Implement · Assess · Authorize · MonitorVulnerability ManagementVulnerability Scan Analysis & Remediation Plan
COMPLETEAnalyzed a Nessus scan of 120 fictional assets at Midwest Freight Logistics (1,400+ findings). I removed duplicates and false positives, then prioritized by CVSS,…
NIST 800-53 RA/SI families · RA-5 — Vulnerability Monitoring & Scanning · RA-2 — Security Categorization · SI-2 — Flaw Remediation · RA-3 — Risk AssessmentRisk ManagementSDIS Risk Assessment & Risk Register (Healthcare SaaS)
COMPLETE▶ InteractiveAssessed 20 risks for SDIS, a fictional moderate-impact healthcare SaaS platform that handles PHI. For each risk I identified the affected assets, threat source and…
NIST SP 800-30 Rev 1 · RA-3 — Risk Assessment · PM-9 — Risk Management Strategy · PM-28 — Risk FramingThird-Party / Vendor RiskThird-Party Vendor Risk Assessment
COMPLETEAssessed a fictional cloud payroll vendor. I sent a SIG Lite-style security questionnaire, reviewed the vendor's SOC 2 Type II report for exceptions and complementary…
NIST SP 800-53 Rev 5 · SA-9 — External System Services · SR-3 — Supply Chain Controls · SR-6 — Supplier Assessments & Reviews · RA-3 — Risk Assessment