James Courtney II

ISSM – FedRAMP (IBM Automation Services for Government)

IBM

Jan 2025 - Jan 2026 (1 year 1 month)

Led FedRAMP security authorization and continuous monitoring strategy across IBM Software’s federal SaaS portfolio within AWS GovCloud environments.

Served as ISSM overseeing multiple Moderate and High boundaries, partnering directly with Authorizing Officials, the FedRAMP PMO, 3PAOs (Coalfire, 38Nort), and internal engineering teams to drive secure federal cloud delivery for IBM Automation Services for Government.

Delivered 14 FedRAMP ATOs across three boundaries in 2025, including Department of State Authorization to Use (ATU), while helping reduce authorization timelines from 12–18 months to 3–6 months through centralized governance, control inheritance (50%+), and audit readiness optimization.

Directe

Sr. Program Manager - Governance, Risk, and Compliance

MDRC

Sep 2024 - Mar 2025 (7 months)

Led and managed MDRC's GRC program, ensuring compliance with regulations by maintaining all compliance documentation, policies, procedures and standards including the System Security Plan (SSP) and IT Risk Management Plan. This involves collaborating with cross-functional teams to understand and implement compliance requirements, while also managing relationships with key stakeholders.

Employed technical and program management skills to plan, track, collaborate, and report on GRC program deliverables, including scheduling and leading meetings, assigning and tracking action items, and developing status reports.

Collaborated with compliance audit and assessment efforts by working with third-party auditors to gather evide

Senior Compliance Manager - FedRAMP

Box

Mar 2023 - May 2025 (2 years 3 months)

Spearheaded Box’s GRC strategy, helping the organization achieve recognition as the #8 Cloud Service Provider (CSP) and #4 SaaS vendor through robust federal, military, and state/local compliance initiatives.

Directed enterprise-wide programs including FedRAMP High Rev5, DoD Cloud SRG (IL4/IL5), CMMC, and Export Control compliance, aligning risk posture with public sector regulatory demands.

Owned the lifecycle management of all federal compliance authorizations—leading readiness assessments, audit responses, continuous monitoring, and reauthorization planning across all cloud environments.

Built and scaled Box’s internal control environment, optimizing cross-functional collaboration with Engineering, Legal,

Sr. IT FedRamp Program Project Manager

LexisNexis

Mar 2022 - Mar 2023 (1 year 1 month)

Led enterprise-level FedRAMP initiatives from readiness through ATO authorization, overseeing large-scale compliance workstreams and ensuring alignment with federal sponsor expectations, technical roadmaps, and executive strategy.

Managed cross-functional program execution across Engineering, Architecture, Security, Legal, and GRC teams, ensuring consistent delivery of FedRAMP program milestones and rigorous adherence to NIST 800-53, FIPS, and DoD SRG requirements.

Directed multi-phase investigations into cloud architecture and control design to assess FedRAMP feasibility, managing strategic intake through to formal program conversion and execution.

Established operating models for enterprise-wide FedRAMP ef

Senior Project Manager - FedRAMP

CrowdStrike

Feb 2022 - Feb 2023 (1 year 1 month)

Led the strategy, planning, and execution of CrowdStrike’s FedRAMP High JAB and DoD IL5 compliance initiatives, aligning program delivery with organizational priorities, cloud modernization efforts, and federal go-to-market objectives.

Directed cross-functional teams to deliver highly regulated compliance programs on time and within scope — coordinating efforts across Engineering, Product Security, GRC, Infrastructure, and Legal stakeholders.

Developed and managed end-to-end project plans and delivery roadmaps tailored to the complexity of FedRAMP High and IL5 programs, ensuring appropriate scoping, resourcing, milestone tracking, and budget adherence.

Partnered with business and operational leaders to trans

Lead Cybersecurity Governance, Risk, and Compliance

CareFirst BlueCross BlueShield

Jun 2020 - Mar 2022 (1 year 10 months)

Led the execution ofCareFirst BlueCross security governance and compliance strategy by designing and enforcing enterprise-wide security policies, standards, procedures, and guidelines to uphold the confidentiality, integrity, and availability of cloud and on-premise systems.

Designed and deployed security controls, automation tools, and monitoring solutions across Azure, AWS, and on-prem environments, ensuring real-time visibility, operational efficiency, and compliance with NIST, and ISO standards.

Implemented technical security solutions to address enterprise risk vectors, including vulnerability management, firewall rule enforcement, access control list (ACL) governance, and endpoint hardening.

Built and

Senior Information Technology Security Manager

ASM Research

May 2020 - Sep 2021 (1 year 5 months)

Oversaw the development and deployment of advanced cyber intelligence tools and methodologies, leading proactive threat detection, analysis, and risk mitigation across an enterprise infrastructure supporting 5,500+ endpoints.

Directed the design and implementation of enterprise cybersecurity architecture, defining and validating technical acceptance criteria to align with security best practices and regulatory standards.

Maintained and evolved the organization’s security architecture framework, ensuring cohesive alignment with enterprise risk management goals and IT transformation strategies.

Authored and maintained critical security documentation, including policies, standards, baselines, guidelines, and op

Sr. Data Privacy Project Manager

NTT DATA Services

May 2020 - Jun 2020 (2 months)

Served as a key member of the Data Privacy Leadership Team, working directly with the Global Data Protection Officer (GDPO) and Director of Privacy Operations to drive strategic privacy initiatives and global compliance capabilities.

Led high-visibility data privacy projects supporting global operations, ensuring alignment with regulatory frameworks (e.g., GDPR, CCPA) and enterprise objectives through close collaboration with functional business leaders.

Executed privacy transformation efforts within a structured project management framework (PMF), delivering on all stage gate reviews, KPIs, and compliance milestones.

Directed end-to-end project delivery activities, including requirements gathering, solution

Sr. Manager Information Security and Risk Management

Otterbase

Aug 2019 - Feb 2020 (7 months)

Directed the development and execution of enterprise security, risk management, and compliance initiatives for a global biopharmaceutical company specializing in vaccines, antibody therapeutics, and biodefense medical devices.

Led a six-month remediation program to address and close audit findings identified by SecureWorks — successfully driving security maturity from CMMI Level 2 to Level 4 through targeted control enhancements and process improvement.

Oversaw enterprise-wide risk management spanning information security, physical security, crisis management, privacy (GDPR), and business continuity—aligning program execution with NIST 800-53, ISO 27001, and biopharma industry standards.

Collaborated with se

Cyber Security Manager, FISMA and FedRAMP

The Goal

Apr 2019 - Aug 2019 (5 months)

Directed the planning and delivery of FedRAMP and FISMA security consulting engagements for high-profile clients including the U.S. Air Force (ACA), New Relic, Armis, Microsoft Azure, and Cisco Cloudlock — ensuring compliance with federal, DoD, and NIST cybersecurity mandates.

Led cross-functional teams of Senior Security Consultants, overseeing execution of 3PAO assessments, control implementations, readiness consulting, and authorization support to help clients secure FedRAMP ATOs and maintain FISMA compliance.

Managed all phases of Security Authorization Package development including System Security Plans (SSPs), Contingency Plans, Configuration Management Plans, Incident Response Plans, Privacy Impact Assessments (

Manager, IT Network Operations and Information Security

Mandiant now part of Google Cloud

Nov 2018 - Apr 2019 (6 months)

Served as a key member of Verodin’s Business Continuity Program, reporting directly to the Chief Operating Officer and acting as the principal security authority for enterprise risk, resilience, and regulatory compliance.

Ensured the confidentiality, integrity, and availability of corporate assets by implementing and maintaining controls aligned with NIST, FISMA, and GDPR frameworks — balancing risk management with operational agility.

Architected and executed Verodin’s enterprise-wide Information Security Policy Framework, developing 14 formalized policies and standards including Change Management, System Security, Patch & Vulnerability Management, and Business Continuity/Disaster Recovery.

Led the procurem

Information Systems Security Manager (ISSM)

GSA

Feb 2018 - Aug 2018 (7 months)

Served as the primary cybersecurity manager within the Office of Inspector General’s IT Division, responsible for securing federal systems, safeguarding sensitive data, and ensuring alignment with NIST 800-53, FISMA, and internal OIG policies.

Led the implementation, maintenance, and continuous improvement of system security controls, ensuring the confidentiality, integrity, and availability of all information systems across OIG infrastructure.

Managed the full lifecycle of information system security programs, including risk identification, vulnerability mitigation, incident response planning, and system recovery procedures.

Oversaw the development and maintenance of comprehensive security documentation, in

Information Systems Security Manager (ISSM)

Administrative Office of the United States Courts

Jun 2017 - Dec 2017 (7 months)

Served as a principal security advisor and technical authority responsible for ensuring the confidentiality, integrity, and availability of Judiciary IT assets and infrastructure, supporting high-value federal systems and judicial data repositories.

Led the development, review, and enforcement of Judiciary Information System Security Plans (ISSPs) in compliance with the Judiciary Information Security Framework (JISF), aligned with NIST SP 800-series, FISMA, and federal security mandates.

Oversaw the implementation of the Security Assessment and Authorization (SA&A) process using CSAM, managing risk authorizations, documenting system boundaries, identifying control gaps, and ensuring continuous monitoring and POA&M reme

Information System Security Officer (ISSO)

University of Maryland Medical System

Feb 2015 - Jun 2017 (2 years 5 months)

Provided strategic leadership in information security governance, aligning cybersecurity program initiatives with SANS CSC Top 20, NIST 800-53, HIPAA/HITECH, and Electronic Health Record (EHR) regulatory frameworks to protect patient and organizational data.

Directed the development, implementation, and enforcement of enterprise-wide security standards, policies, procedures, and technical guidelines for complex multi-platform environments spanning cloud, on-premises, and hybrid systems.

Led the enhancement and deployment of a role-based information security awareness and training program, directly tied to enterprise policy and user roles—strengthening organizational cyber hygiene and compliance readiness.

Pa

Information System Security Officer (ISSO)

Discovery Inc

Feb 2012 - Jan 2015 (3 years)

Operated as a Subject Matter Expert (SME) in cybersecurity operations across global enterprise environments, providing real-time incident response, threat hunting, and advanced malware analysis to protect the Discovery Communications brand and intellectual property.

Monitored and investigated security events using Intrusion Prevention Systems (IPS), Anomaly Detection Systems (ADS), and Splunk (SIEM) — identifying potential threats, validating indicators of compromise (IOCs), and coordinating rapid response activities.

Responded to and managed high-severity security incidents, performing containment, eradication, and root cause analysis activities across on-prem and cloud-based environments in collaboration with cross-f

Information System Security Officer (ISSO)

Superior Group

Mar 2011 - Feb 2012 (1 year)

Provided senior-level leadership in the implementation, monitoring, and operational sustainment of the agency’s IT security infrastructure, directly supporting enterprise cyber resilience, risk management, and regulatory compliance.

Led the coordination of security incident response operations, including threat detection, event triage, containment, forensic analysis, remediation, and root cause review—ensuring timely escalation and reporting to executive stakeholders.

Performed regular security administration and compliance control tasks, including access provisioning, identity lifecycle management, vulnerability remediation, certificate management, and network infrastructure monitoring.

Oversaw vulnerabilit

Information Systems Security Officer (ISSO)

The National Institutes of Health

Aug 2010 - Mar 2011 (8 months)

Directed the implementation of daily information security operations for contract and federal personnel, ensuring full compliance with NIST SP 800-series guidelines, FISMA requirements, and federal security program standards.

Oversaw the enforcement and continual improvement of security policies, controls, and toolsets supporting the confidentiality, integrity, and availability (CIA) of NEI’s enterprise networks, systems, and sensitive data.

Conducted a wide range of performance and cybersecurity audits, evaluating systems and programs to identify deficiencies, measure risk posture, and assess compliance with security mandates and internal standards.

Identified and executed audit strategies and innovative me

DP Technical Support Security Specialist

State of Maryland

Jul 2008 - Aug 2010 (2 years 2 months)

Provided enterprise-level leadership in the coordination, maintenance, and troubleshooting of critical election information systems, including voting systems, voter registration platforms, and candidate information databases, in compliance with state and federal election integrity standards.

Acted as the liaison to State Board of Elections and local IT teams, ensuring secure and reliable telecommunications, application performance, help desk support, and information system security administration.

Evaluated operational workflows and implemented automated solutions — such as custom database development — to streamline inventory tracking and lifecycle management for hardware, software, supplies, and election-related equi

Computer User Support Security Specialist II

State of Maryland

Dec 2007 - Jul 2008 (8 months)

Delivered Tier I/II/III technical support to over 1,550 internal and external users, resolving a wide range of issues via phone, email, and in-person — including hardware diagnostics, software configuration, and user access support.

Installed, configured, and maintained desktop applications, operating systems, and agency software tools in compliance with security protocols and user functionality requirements.

Managed password creation, resets, and account unlocks for agency staff and external system users through Active Directory, maintaining compliance with organizational access control and identity verification standards.

Monitored and assigned incoming IT service requests using HP OpenView Help Desk Softw

Database Management Security Specialist II

State of Maryland

Feb 2007 - Dec 2007 (11 months)

Directed and executed enterprise-level server administration across UNIX and Windows environments, ensuring availability, performance, and integrity of agency-wide systems through proactive monitoring, patch management, and automated backup configuration.

Oversaw the full lifecycle support of critical proprietary systems, including Skills Manager and Training Manager by Crown Pointe Technologies, serving as the principal administrator for functionality, upgrades, and troubleshooting.

Provided operational leadership for environmental infrastructure management, ensuring full functionality of IDF closets, data center, and server room environments; coordinated with facilities and engineering teams to maintain physical and

Senior Cellular Wireless Data Technical Support Specialist

Verizon

Aug 2003 - Feb 2007 (3 years 7 months)

Led high-impact technical support operations and telecom service delivery for over 6,000 internal and external users across voice, data, and mobile platforms, providing expert-level troubleshooting, systems configuration, and customer lifecycle management.

Directed the integration and support of advanced telecommunications infrastructure, including provisioning, activation, and network optimization for wireless services and smart devices—ensuring seamless connectivity for government, corporate, and emergency response clients.

Served as the technical point of contact and SME for advanced data and mobile computing platforms, including BlackBerry, PDA, Pocket PC, Palm OS, Aircards, and other enterprise wireless devices, o

Operations Support Scheduling Specialist

American Red Cross

Jan 2002 - Aug 2003 (1 year 8 months)

Provided strategic oversight of regional resource planning, workforce scheduling, and operational coordination across Maryland, Washington D.C., and Virginia to meet performance targets, customer expectations, and budgeted objectives.

Collaborated directly with District Managers, Account Executives, and Field Supervisors to ensure appropriate staff coverage, scheduling alignment, and operational readiness for all regional sites and sponsors.

Maintained and governed critical operational databases including CSS, DMIS (FDA-regulated), and NBCS, ensuring accurate documentation of site status, compliance activities, and sponsor information in support of regulated operations.

Led a team responsible for delivering

James Courtney II

About

Detail

Timeline

Résumé

James Courtney II

About

Detail

Behavioral traits