I have over 29 years of extensive experience in analyzing, developing, and supporting complex information systems, with the past seventeen years primarily providing IT security support. My IT security work includes FISMA evaluations, risk assessments, developing security and contingency plans, performing system security assessment and authorization, developing plans of action and milestones, conducting network vulnerability assessments and penetration tests, providing incident response, and developing security policy. I have extensive experience with federal regulations and policies governing the IT security field, including regulations and policies from OMB and NIST (including FIPS). In addition to the work experience listed above, I have worked on many other projects during my twenty-nine years with Carson Associates. These include application development and maintenance projects using a variety of technologies including Perl, C, Visual Basic, SQL, and HTML. Specialties: Payment Card Industry Qualified Security Assessor (QSA) Payment Card Industry Approved Scanning Vendor (ASV) GIAC Certified ISO-17799 Specialist – Silver Certified Information Systems Security Professional (CISSP) Certified Authorization Professional (CAP)

IT Security Specialist @ Member of the Information Assurance group, which is responsible for: • Assisting with all phases of system security assessment and authorization; • Conducting FISMA evaluations; • Conducting vulnerability assessments; • Contingency and disaster recovery planning; • Performing risk assessments; • Developing policy; • Remediation for IT security vulnerabilities and deficiencies; and • PCI DSS program development. From September 1985 to Present (30 years 4 months)

Certificate, UNIX System Administration @ University of Maryland University College From 2001 to 2003 Master, Information Systems @ Virginia Polytechnic Institute and State University From 1991 to 1996 Bachelor of Science, Computer Science @ University of Delaware From 1981 to 1985 Jane QSA is skilled in: Vulnerability Assessment, CISSP, Computer Security, Security Policy, Information Assurance, Vulnerability Scanning, IT Audit, Information Security Management, PCI DSS, Risk Assessment, Information Security Policy, Security Assessments, Information Security, NIST, FISMA, System Administration, Incident Response, Security