JOHN WALLEY

FREELANCE CYBERPHYSICAL CONSULTANT (ICS/OT)

Operational Technology (OT) and Critical Infrastructure Protection Expert with a proven track record in defending key sectors—nuclear, water, pipelines, manufacturing, oil and gas —against cyber threats. Specialized in developing and implementing robust cybersecurity frameworks and network security strategies for the Department of Defense, federal agencies, and the banking industry. Renowned for leading comprehensive audit and compliance initiatives, enhancing the security of critical national infrastructure, and pioneering the adoption of advanced security solutions to protect essential services. Demonstrated expertise in fortifying critical systems across the Intelligence Community and establishing crisis response mechanisms. Adept at guiding multidisciplinary teams to safeguard operational technologies and critical infrastructures from evolving cyber risks. Committed to elevating cybersecurity resilience and ensuring the operational integrity of critical sectors through strategic innovation, collaboration, and leadership.

CLEARANCES (No Longer Active – Different Agencies)

  • NRC / DOE Q
  • DoD Secret
  • TS/SCI w/ CI Poly

KNOWLEDGE SKILLS & ABILITIES

Cybersecurity ArchitectMetasploitTenable OT Security
Cybersecurity EngineerVulnerability AssessorNessus / NMAP
Penetration TestingBash ScriptingSecurity Center / ACAS
Cybersecurity CompliancePython ScriptingHIDS/NIDS/HIPS/NIPS/SIEM

WORK EXPERIENCE

TYPE11 (Freelance)

Freelance Cyberphysical Consultant (CPS) (ICS/OT) April 2024 – Present

    • Created a series of online training for Vulnerability Management in OT/ICS environments.
    • Created instructional guilds on the deployment, configuration and operation of “Tenable OT Security” 
    • Developed Services to assist customers with the mitigation and remediation of risks in industrial environments such as power generation plants, manufacturing, and water/waste.

    TENABLE, INC.

    Senior Security Consultant (ICS/OT) March 2020 – April 2024

    • Initiated Tenable’s Operational Technology (OT) program following the Indegy acquisition, crucially broadening the company’s impact on global critical infrastructure protection with a focus on integrating cybersecurity controls with engineering practices.
    • Engineered and launched a comprehensive suite of OT professional services, focusing on integrating cybersecurity solutions with controls engineering for key sectors including nuclear power, rail transportation, and manufacturing.
    • Orchestrated strategic onboarding and specialized training for new team members, merging controls engineering principles with cutting-edge OT cybersecurity product knowledge worldwide.
    • Led the design and implementation of industry-specific OT security solutions, blending technical control systems expertise with cybersecurity measures in sectors such as automotive manufacturing, pharmaceuticals, oil & gas, and water/waste management.
    • Partnered with the sales team to deepen OT security engagement, leveraging technical acumen in controls engineering and cybersecurity to enhance product adoption and secure critical infrastructures.
    • Authored an OT Security Training Curriculum, aimed at elevating internal technical skills and client understanding of the intersection between controls engineering and cybersecurity, thereby advancing industry resilience.
    • Established a global OT professional service framework, emphasizing the integration of cybersecurity with controls engineering disciplines during new product rollouts for Tenable OT Security.
    • Spearheaded the global recruitment and development of OT cybersecurity resources, fostering expertise in the confluence of controls engineering and cybersecurity across worldwide operations.
    • Delivered over 4,000 hours of direct OT engagement, demonstrating hands-on expertise in marrying controls engineering with cybersecurity across diverse sectors.
    • Enhanced business development strategies alongside sales teams, showcasing technical leadership in bridging the gap between controls engineering and cybersecurity to drive sales growth.
    • Innovated Tenable OT Security Training Curriculum for internal and external stakeholders, focusing on strengthening technical competencies at the nexus of controls engineering and cybersecurity.

    INTERNATIONAL CRITICAL INFRASTRUCTURE SECURITY INSTITUTE

    Senior OT Cybersecurity Architect – Training & Engineering April 2018 – March 2020

    • Engineered a comprehensive hardware product certification framework to evaluate cyber resiliency, aligning with key cybersecurity benchmarks including NIST SP 800-53, ISO 27001/27002, Common Criteria, NIST’s Risk Management Framework (SP 800-37), DIACAP, DIARMF, PCI, NIST 800-81, NERC CIP, and HIPAA. This initiative significantly bolstered defenses against threats targeting the nation’s critical infrastructure.
    • Spearheaded the formation of strategic alliances with over 117 educational institutions, including universities, colleges, and trade schools, to bolster their cybersecurity curricula through immersive student experiences, thereby enhancing the future cybersecurity workforce.
    • Initiated and deployed immersive cyber-physical training environments, facilitating remote access to engaging, mission-centric training modules. This included a pioneering $40M project involving a Small Modular Reactor (SMR) with an extensive ten-story Component Cooling Water (CCW) system.
    • Conceptualized and implemented a cutting-edge cyber-physical training curriculum focusing on the integration of Information Technologies (IT) and Operational Technologies (OT), serving key industry stakeholders such as Tenable, First Energy Nuclear, Dominion Nuclear, and the US Army. This program is instrumental in preparing the workforce for real-world cybersecurity challenges.
    • Created an innovative Incident Response Game, enhancing training effectiveness and annual tabletop exercises by fostering collaboration among organizational leadership, team leads, and Security Operation Center (SOC) staff, leading to improved incident management outcomes.
    • Authored and instituted a wide array of operational protocols, encompassing workplace safety and inclusive hiring practices, demonstrating a commitment to creating a secure and equitable work environment.

    OASIS SYSTEMS

    Director of Cyber Security and Critical Infrastructure Protection October 2015 – April 2018

    • Served as Program Manager for the NRC’s Nuclear Security and Incident Response Cyber Security Division (NSIR), where I applied my technical expertise to overhaul the team’s approach to cybersecurity, directly contributing to enhanced system resilience, increased revenue, and the acquisition of a pivotal five-year sole-source contract.
    • Led critical cybersecurity dialogues in public forums with key stakeholders from the nuclear industry and national laboratories, sharing in-depth analyses of cybersecurity risks and articulating advanced strategies for threat mitigation, showcasing my subject matter expertise.
    • Spearheaded the strategic development of regulatory policies, leveraging my technical knowledge to advocate for robust cyber protection standards at nuclear fuel cycle facilities, thereby strengthening national cybersecurity defenses.
    • Directed the creation and refinement of core regulatory guidance for the NRC and the nuclear industry, including pivotal contributions to NRC Regulatory Guide 5.71, NEI 08-09, NEI 13-10, and the drafting of NRC Guide 5062 and Rule 10 CFR 73.53. My technical leadership was instrumental in evolving cybersecurity regulations and guidelines.
    • Innovated the NRC’s training methodology for Nuclear Cyber Security Inspectors by integrating advanced andragogy techniques, significantly enhancing the technical acumen and inspection capabilities across regional offices, and standardizing high-quality cybersecurity practices nationwide.
    • Played a key role in the conceptualization and development of a cutting-edge nuclear cyber training range at the NRC Technical Training Center (TTC) in Chattanooga, Tennessee. This initiative has been critical in elevating the cybersecurity skill set of NRC inspectors, ensuring the safeguarding of nuclear assets through rigorous training and practical application of cybersecurity principles.

    CLEARPATH

    Cybersecurity Subject Matter Expert Founder August 2009 – March 2020

    • Served as a Subject Matter Expert for Financial Improvement and Audit Readiness (FIAR) and Federal Information System Controls Audit Manual (FISCAM), directly reporting to the Defense Contract Management Agency (DCMA) Director of eBusiness. Drafted SSAE 16 for reporting entities and the Office of the Secretary of Defense (OSD).
    • Spearheaded the DCMA’s cybersecurity strategy under FIAR directives, overseeing the transition from the Department of Defense Information Assurance Certification (DIACAP) to the Risk Management Framework (RMF) in alignment with DODI 8510.01 requirements.
    • Orchestrated the development of DCMA’s policies and procedures for the implementation of high-criticality FISCAM controls, as mandated by the FIAR Directorate.
    • Acted as the lead auditor for IT controls, conducting comprehensive test plans and documenting results to assess both design and operational effectiveness.
    • Identified agency-wide deficiencies, formulated, and oversaw Corrective Action Plans (CAPs) to address and mitigate these issues.
    • Authored the management section of DCMA’s Contract Pay SSAE No. 16 SOC 1 – Type 2 Report, demonstrating a commitment to stringent audit standards and transparency.
    • Implemented and tested controls in accordance with Generally Accepted Government Auditing Standards (GAGAS)/Yellow Book standards, Federal Financial Management Requirements (FFMR), and Federal/DoD policies across finance and IT spheres.
    • Functioned as a key liaison among the Defense Logistics Agency (DLA), Defense Finance and Accounting Services (DFAS), and Defense Information Systems Agency (DISA), enhancing support for DoD Contract Pay initiatives.
    • Conducted thorough reviews and assessments of the DCMA Security Operations Center (SOC) processes, ensuring optimal identification and management of security events and incidents.
    • Contributed to the Office of Management and Budget (OMB) federal-wide technical compliance assessments for the Federal Desktop Core Configuration (FDCC) and IPv6 implementation, in collaboration with the U.S. General Services Administration (GSA).
    • Delivered targeted training to federal staff on cybersecurity risks and the impacts of new technology implementations within federal frameworks.
    • Led the Federal Information Security Management Act (FISMA) certification process at the Nuclear Regulatory Commission (NRC) within the Computer Security Office (CSO), ensuring adherence to all FISMA and NIST guidelines throughout the security lifecycle.
    • Co-authored the NRC Regulatory Guide 5.71 – Cyber Security Programs for Nuclear Facilities, establishing a benchmark for cybersecurity measures within nuclear facilities.

    PROMETHEUS GLOBAL, INC.

    Cybersecurity Subject Matter Expert – Vulnerability Analysis May 2007 – August 2009

    • Innovated and launched a transformative employee training initiative, “30-Second Expert,” which dramatically boosted team morale and aligned staff with the organization’s vision. This program was a key factor in driving a significant uptick in productivity, directly contributing to an additional $3.5 million in sales within its inaugural year.
    • Engineered comprehensive vulnerability analysis frameworks and penetration testing methodologies for prestigious clients, including the National Indian Gaming Commission (NIGC), National Aeronautics and Space Administration (NASA), and Department of Homeland Security (DHS). These strategies enhanced our clients’ cybersecurity postures against sophisticated threats.
    • Played a pivotal role at the U.S. Department of Labor by coordinating with 19 scorecard agencies to develop a unified set of standards and strategies. My efforts led to the establishment of the Enterprise Architecture (EA) Standards Reference Model (SRM), Technical Reference Model (TRM), and Performance Reference Model (PRM), integrating cybersecurity measures throughout all organizational tiers and business operations.
    • Led comprehensive cyber assessments encompassing penetration testing, strategic planning, and risk mitigation efforts. My proactive approach in identifying and addressing vulnerabilities has fortified the cybersecurity defenses of numerous federal agencies.
    • Contributed as a co-author to the Chief Information Officer’s (CIO) handbook, “A Practical Guide to Federal Service-Oriented Architecture.” This publication has served as a critical resource for federal agencies in implementing efficient and secure service-oriented architectures.
    • Sold Espy Technologies to Prometheus Global in 2008 (http://www.prometheusglobal.com/about/news/34-products/122-prometheus-acquires-espytech.html ).

    CORNERSTONE CONSULTING, INC.

    Penetration Testing – Robbery Training and Penetrating for Banking Industry July 2004 – May 2007

    • Executed comprehensive Statement on Auditing Standards (SAS) No. 70 (SAS70) audits for third-party vendors affiliated with the banking industry, providing expert opinions on critical services including server hosting, encryption, and online transaction security. This ensured that vendors met rigorous standards essential for banking operations and data integrity.
    • Served as the primary liaison reporting directly to the bank executives on all matters related to State Corporation Commission (SCC) and Sarbanes-Oxley (SOX) compliance. Adhered strictly to Virginia Code § 13.1-518, overseeing investigations and safeguarding the confidentiality of sensitive information and documents.
    • Orchestrated and executed controlled, realistic security breach simulations, including armed bank robberies and black-box penetration tests for the banking industry. These exercises pinpointed critical vulnerabilities in personnel training, system security, and procedural integrity, guiding subsequent enhancements to security protocols.
    • Formulated and implemented Incident Response and Continuity of Operations plans conducting thorough evaluations to identify and mitigate vulnerabilities related to cyber threats affecting cash center operations and the secure transit of assets. This proactive approach significantly bolstered operational resilience against potential cyber-physical attacks.
    • Directed targeted penetration testing initiatives for cash centers and delivery routes, compiling comprehensive reports on findings and recommending remediation strategies for exploitable vulnerabilities. These efforts played a crucial role in reinforcing the security posture of cash handling and delivery systems against advanced threats.

    BOOZ ALLEN HAMILTON

    Project Manager / Network Engineering – Boundary Protections March 1998 – October 2005

    • Delivered comprehensive network security solutions for various agencies within the Intelligence Community (IC), encompassing the design of firewalls, configuration of intrusion detection systems, and the architectural planning of a network spanning over 10,000 nodes. This foundational security infrastructure was crucial in safeguarding sensitive intelligence data.
    • Engineered robust boundary protection mechanisms for a global collateral network, enhancing the security posture against external threats and ensuring the integrity of classified information across worldwide operations.
    • Founded the crisis response team at the National Geospatial-Intelligence Agency (NGA), providing pivotal support during national emergencies, including the September 11, 2001, terrorist attacks and the Space Shuttle Columbia disaster in 2003. My leadership during these critical moments underscored the team’s essential role in national security and emergency response efforts.
    • Recruited and directed a highly skilled team of 14 network and systems engineers, overseeing the successful completion of over 150 projects within a two-year timeframe. Under my management, the team excelled in enhancing network capabilities, ensuring operational efficiency, and maintaining system security across enterprise-level networks.

    UNITED STATES NAVY

    RM21 Third Class Petty Officer – Penetration Testing January 1994 – January 1998

    • Achieved the pioneering RM21 designation, merging Radioman (RM) and Data Processor (DP) rates, enhancing skills in satellite communications, radio frequencies, networking, computer science, and cryptologic technologies.
    • Underwent cross-rate training as a Cryptologic Technician (Communications) (CTO), supporting TS/SCI communications within the USS Mount Whitney (LCC-20) Intelligence Center.
    • Designed, documented, and implemented a Microsoft Windows NT 4.0 network in the USS Mount Whitney’s Intelligence Center, setting new standards for naval intelligence operations.
    • Collaborated with the Fleet Information Warfare Center (FIWC) to deploy the first Intrusion Detection System aboard the USS Mount Whitney, advancing cybersecurity measures.
    • Served as Terminal Area Security Officer (TASO) for Intelligence systems, managing location, inventory, and antivirus measures for all systems within the Intelligence Center.
    • Performed as Tech Control satellite communications technician, responsible for patch panel configuration, crypto installation, and circuit troubleshooting.
    • Promoted to supervisory roles, demonstrating strong leadership and communication skills, leading teams to achieve excellence and fostering a culture of innovation and resilience.
    • Concluded service with an Honorable Discharge and special designation as a wartime veteran for participation in Operation Uphold Democracy, embodying values of leadership, innovation, and commitment.       

    EDUCATION

    STRAYER UNIVERSITY

    Loudoun Campus, Virginia
    BSCN – Computer Networking
    2001-2004
    (Incomplete)

    COASTAL TRAINING INSTITUTE

    Mobile Campus, Alabama
    AAS Engineering
    1987-1989