• Manage one or more information systems throughout the full six-step RMF lifecycle, including assessment, authorization, and continuous monitoring activities • Serve as an RMF Subject Matter Expert (SME), advising stakeholders on cybersecurity compliance, risk posture, and ATO readiness • Develop, review, and maintain RMF packages and associated documentation, including Security Plans, POA&Ms, Risk Assessment Reports, and security control policies • Assess system compliance against NIST SP 800-53 controls and DHA RMF requirements as part of self-assessment and annual reviews • Document and maintain evidence supporting control implementation and compliance • Lead and participate in A&A and stakeholder meetings to track system status, resolve issues, and drive RMF progress • Coordinate with engineers and system owners to develop architecture diagrams, system asset inventories, and security policies • Prepare and deliver status reports to DHA leadership on system authorization and compliance efforts

• Lead security audits and assessments—annual, periodic, and ad hoc—serving as the primary liaison to internal assessors and external auditors. • Guide implementation of security controls and ensure alignment with CBP, DHS, NIST, and federal requirements. • Oversee development and maintenance of security documentation, assessment artifacts, and audit evidence to support audit readiness. • Lead remediation of audit findings and security deficiencies, ensuring timely corrective actions. • Provide technical leadership on cybersecurity, vulnerability mitigation, and security compliance across the application lifecycle. • Partner with BEMSD stakeholders and development teams to integrate security requirements into application design, development, and operations. • Evaluate emerging cybersecurity technologies, threats, and best practices to strengthen program security. • Deliver security reports, risk assessments, dashboards, and compliance updates to BEMSD and GDIT leadership.

• Partner with clients to understand their business objectives, security concerns, and risk management priorities. • Assess Microsoft 365, Azure, and cloud security environments and provide actionable recommendations for improvement. • Design and implement Microsoft security solutions across identity, endpoint, threat protection, governance, compliance, and cloud security. • Configure and support Microsoft Entra ID capabilities, including Multi-Factor Authentication (MFA) and Self-Service Password Reset (SSPR). • Deploy and optimize Microsoft Defender technologies. • Implement endpoint management and security controls using Microsoft Intune. • Build and improve security monitoring, analytics, alerting, and reporting solutions using Microsoft Sentinel. • Support data protection and compliance initiatives utilizing Microsoft Purview, DLP, and sensitivity labeling capabilities. • Develop automation and operational efficiencies using PowerShell and Microsoft Graph. • Deliver trusted advisory services to clients.

• Working closely with Wikimedia movement organizers to mitigate risks and define best practices. • Strengthening the Foundation’s risk management approach. • Leading risk assessments for community conferences and other events. • Creating emergency response plans for physical security threats. • Being on-call to review emergency alerts and ensuring response to threats. • Briefing the Deputy General Counsel and senior leadership regularly.