Open to opportunities

Tiffany Carey

@tiffanycarey

Message

Seasoned DoD cybersecurity professional specializing in risk management and A&A.

United States

Message

What I'm looking for

I am seeking a senior cybersecurity role where I can lead A&A/RMF efforts, strengthen enterprise security posture, mentor teams, and drive compliance and resilience in a mission-focused organization.

I am a cybersecurity professional with over 10 years of Department of Defense experience focused on information assurance, risk management, and enterprise security oversight. I lead Assessment and Authorization (A&A) activities, develop System Security Plans, and drive disaster recovery and contingency planning to maintain mission readiness.

I have a strong record of conducting risk and vulnerability assessments, security audits, and IV&V to ensure RMF compliance and recommend effective mitigation strategies. I provide technical guidance on enterprise-level security issues, integrate security across the system development lifecycle, and track remediation of audit findings to acceptable risk closure.

I combine project management, policy development, and team leadership to align cybersecurity activities with federal regulations and organizational objectives. My background includes hands-on systems administration, STIG validation, and educating stakeholders through security awareness initiatives.

Experience

Work history, roles, and key accomplishments

Current

Lead Information System Security Officer

Current

Department of Defense

Sep 2021 - Present (4 years 3 months)

Serve as ISSO administering security programs, coordinating A&A activities, and developing SSPs and disaster recovery plans to ensure RMF compliance and reduce enterprise risk across DoD systems.

Assessment & Authorization Vulnerability Assessment Disaster Recovery Risk Management

Cybersecurity Engineer III

Simventions, Inc

Jun 2015 - Sep 2021 (6 years 3 months)

Conducted IV&V assessments and supported RMF compliance by preparing security test plans, vulnerability assessments, and accreditation documentation to validate federal cybersecurity controls.

IV&V RMF Compliance Vulnerability Assessment Test Plans Risk Management Reporting

MCEN Migration Compliance SME

SAIC

Dec 2014 - Jun 2015 (6 months)

Maintained and validated system documentation and provided compliance and QA support for accreditation actions and risk tracking during MCEN migration activities.

& Compliance QA Documentation

Systems Administrator

The Tatitlek Corporation

Apr 2014 - Dec 2014 (8 months)

Performed system hardening, STIG validation, vulnerability scanning, and administered Windows/UNIX/Linux systems to meet DoD information assurance requirements.