CISSP
CISSP - Certified Information Systems Security Professional
https://www.isc2.org/certifications/cissp
Status - 🚧 In Progress
Aug 2026 - I am currently studying to become certified.
- 15+ years security experience
Books
- Deane, Arthur and Aaron Kraus. CISSP: Certified Information Systems Security Professional, 6th Ed. Sybex 2021. ISBN-13: 978-1-119-78999-4.
Work History
Relevant work to CISSP role is the following:
(list is NOT exhaustive)
- Security
- Threat Modeling
- Documented tool and framework for Threat Modeling.
- Shared knowledge on how to use tool for Threat Modeling.
- Evangelized best practices to Threat Modeling.
- IAM
- Performed annual Identity & Access Management review/corrections of access groups (name, description, auth grant, level of access)
- Created access groups and applied access controls to tools
- Decommissioned deprecated access groups
- Penetration Testing
- Aided and directed penetration testing
- Offensive Security
- Identified cyber attacks, mitigations, and long-term remediations
- Rate Limiting
- Identified key identifiers to visitor (session, IP address, etc)
- Created hueristics to determining optimal rate limit value
- Drafted multiple level rate limiting rules (IP Address, domain, visitor, etc)
- Documented how-to use hueristics and GlooEdge configs to implement rate limiting
- Configured rate limiting
- Bot Mitigation
- Configured bot mitigation to block unwanted traffic
- Training
- Participated in a Red Team Assessment
- Operation
- BIA
- Tracked down Business Impact Analysis
- Pointed out gaps in BIA
- BCP
- Participated in crafting Business Continuity Plans from tech perspective
- Identified technical processes for specific BCP actions
- Created check list to make sure owners kept up-to-date for BCP actions
- Encouraged quarterly table-top exercise of BCP
- DR
- Created Disaster Recovery Plan for several applications
- Participated in companies largest and most complete DR Exercise
- Executed multiple DR Exercises
- Prepared artifacts for proof of DR Exercise
- Created & executed first DR Table-Top Exercise within SVP’s division
- Data Retention & Disposal
- Collaborated with business to define data retention & disposal requirements.
- Designed ETL app extracting data from Third-Party, enriching, transforming, and loading into BigData for storage.
- Labeled country, creation date, customer/merchant/corporation marker.
- Analyzed data classifications
- Analyzed retention schedules per classification
- Researched enterprise tables to join on for account close date of customer, merchant, or corporation.
- Created BigQuery queries to execute disposal of data per retention schedule and account close date, if required.
- Privacy
- Privacy by Design
- Designed app from beginning to have server-side data store for any and all cookie-like data well in advance of further advancements in Internet privacy policies becoming more strict.
- Privacy Risk Assessment
- Identified: jurisdictions, legal entities, third-parties, etc
- Researched each legal entity & third-party for physical address, etc
- Documented data handled
- Researched each system handling data, how it did so, and retention period
- Identified contract identifiers for each system and respective owners
- Collected attestations of data retention & disposal from system owners
- Cookie Appendix
- Collated all cookies across websites and applications
- Labeled purpose for each cookie
- Provided samples for each cookie
- Ascertained what data, if any, stored in each cookie
- Identified entity using each cookie
- Legal
- Audit/On-site Investigation
- Participated in Privacy Control Panel
- Prepared legal response on what cookies used and why.
- Helped design how to only drop a cookie based on Cookie Privacy Preferences
- Planned immediate fix to remediate legal deficiencies
- Drop cookies only if Cookie Privacy Preferences allow
- Remove as many cookies as possible and push data into server-side data store
- Data Breach
- Participated in activities related to a Third-Party data breach
- Data Forensics
- Performed data forensics investigation and collection regarding an incident