Looking for a job

Matthew Flemings

@matthewflemings

Message

I build durable security programs for critical infrastructure and regulated organizations.

United States

Message

What I'm looking for

I'm looking to build and lead durable security programs for critical infrastructure, financial services, and other regulated organizations where risk, resilience, compliance, and executive-level security leadership matter.

At the Analysis and Resilience Center for Systemic Risk, I protect national critical financial infrastructure as ISSM and Principal Security Architect. I've delivered consecutive zero-finding collective attestations, built hardened networks and threat intelligence tools, and maintained zero security incidents across seven years of operations.

Previously at Hilltop Consultants, I built an MSSP practice from zero to a full-service offering in under 12 months and served as de facto CISO for 35 clients across 10 compliance frameworks. I also reduced open RDP exposure across more than 300 client environments from over 85% to under 3%.

I've rebuilt disaster recovery programs, led HIPAA compliance with zero audit findings, supported FEMA disaster operations, and delivered secure systems under urgent conditions. I focus on entering high-stakes environments where security is absent or failing, then building programs and infrastructure that last.

Experience

Work history, roles, and key accomplishments

Current

Information Security Systems Manager

Current

Analysis and Resilience Center for Systemic Risk

Jan 2019 - Present (7 years 8 months)

Served as ISSM and Principal Security Architect, achieving multiple zero-finding results across consecutive Bank of America-led collective attestations. Architected secure network rebuilds and threat intelligence tools protecting national critical financial infrastructure.

NIST RMF FedRAMP FISMA HIPAA ISO 27001 PCI DSS HITRUST DoD RMF GDPR FFIEC Threat Intelligence Incident Response Vendor Management Budget Management AI Security Claude Code GitHub Co Pilot Microsoft Copilot Studio

Senior Security Engineer

Hilltop Consultants, Inc.

Nov 2016 - Jan 2019 (2 years 2 months)

Built an MSSP practice from zero in under 12 months, contributing to a $10 million exit valuation. Reduced open RDP exposure across 300+ client environments from over 85% to under 3% in eight months.

MSSP RDP HIPAA FedRAMP FISMA PCI DSS ISO 27001 HITRUST DoD RMF GDPR FFIEC NIST SP 800 171 Security Program Development Vendor Management SOC Selection Security Due Diligence

Security Analyst

Shenandoah Community Health Center

Apr 2013 - Nov 2016 (3 years 7 months)

Assumed full ownership of HIPAA compliance as the sole security professional at a 300-employee community health center, passing the first audit under new oversight with zero findings. Rebuilt disaster recovery and pandemic response programs from scratch.

HIPAA Disaster Recovery Pandemic Response Endpoint Security Network Security EHR Security Security Awareness Training Risk Management

IT and Network Administrator

Farmers & Mechanics Insurance Companies

Aug 2012 - Apr 2013 (8 months)

Led security and network architecture for an eleven-company insurance database integration, delivering seven months ahead of schedule. Rebuilt disaster recovery infrastructure, reducing failover time from over five hours to under ten seconds.

Network Architecture Security Architecture Disaster Recovery Veeam Rackspace server management Firewall Management Endpoint Security Web Application Security Help Desk Management

Field Technology Manager

Parsons Brinckerhoff

Mar 2008 - May 2012 (4 years 2 months)

Rescued a $980 million federal contract by designing and delivering replacement software in three weeks. Commanded field teams of 100 to 500 FEMA contractors across multiple presidentially declared disasters annually.

FEMA Disaster Response Field Operations Software Design Secure Communications Device Management Team Leadership Incident Management

Slot Machine and ATM Technician

Hollywood Casino at Charles Town Races

Aug 2005 - Mar 2008 (2 years 7 months)

Selected as one of five authorized technicians to conduct state-sanctioned pre-deployment vulnerability assessments on slot machines, ATMs, and horse racing betting systems under West Virginia Lottery Commission oversight.

Vulnerability Assessment Hardware Testing Firmware Testing Software Logic Testing Regulatory Compliance Gaming Systems