Carmen Cody

Lead and participate in information security projects that develop best practices involving hardware and software configuration, administer the information security infrastructure, deploy tools that monitor, log, and report on the information security status within the Research and Data Analysis office.

Participate in agency-wide workgroups which have strategic implications for DSHS. Complete projects including the analysis, planning, procurement, configuration and administration of information security tools. Serve as an integral technical team member in the RDA division's Health Economics and Client Outcome Database Unit. This unit designs and implements an integrated and analytical infrastructure that aids researchers and analysts in the creation of high-quality empirical studies and metrics that are timely, informative, and reproducible.

As the PKI administrator and supervisor, I manage the internal public key infrastructure, as well as external 3rd-party certificates for my organization.

My team manages multiple certificate authority servers, hardware security modules (HSMs), web servers hosting revocation lists and online responders (OCSP).

Key Contributions:

• Designed, tested and installed new SHA-2 PKI system, migrating all certificates from SHA-1 to SHA-2
• Purchased, configured and installed new fault-tolerant hardware security modules for PKI systems
• Created, tested and implemented disaster recovery plan

Maintained ESX Servers, vSphere Client and Vcenter Servers. Created datastores for storing VMs and data. Deployed Virtual Machines. Configured and used clones, snapshots, and templates. Presented and assigned LUNs to ESX hosts. Resolved security issues identified from security scans or health checks and recommended security enhancements Configured HA, backups, and completed physical to virtual (P2V) and virtual to virtual (V2V) conversions. Trained others and led innovation workgroup.

Key Contributions:

• Coordinated and migrated systems from Hyper-V to VMware with little to no downtime, upgrading servers simultaneously as needed
• Led innovation workgroup and created procedural documents
• Reduced maintenance time by 50%, streamlining server updates by consolidating update windows for several hundred servers, automating where possible

Managed the N-Tier architecture for the Environmental Health Programs throughout entire lifecycle.

Key contributions

• Administered firewalls, established virtual private network tunnels (VPN), utilized a thorough understanding of network architecture and design for troubleshooting communication systems and network components. Maintained the confidentiality, integrity, and availability of assets by applying risk mitigating safeguards and implementing security controls such as software firewalls, limiting open ports, and services. Managed the system access controls and data access controls for Microsoft servers and databases.
• Performed comprehensive testing of system and security safeguards; documented systems for standardization and repeatability. Applied security patches and updated software for vulnerability management; responded to incidents that might compromise systems. Applied knowledge of security architecture and design as well as capability of information systems for high availability of database and web servers - virtualizing to reduce footprint.
• Developed procedures for software change management process and server builds and provided guidance to the application testing group to ensure application testing completeness. Reviewed hardware and software standards exception requests, provided recommendations to leadership. Documented processes for disaster recovery.
• Maintained logical and physical database models for databases and coordinated SQL database conversion efforts. Maintained databases and monitored performance, adjusting as needed. Reviewed databases for compliance to new standards.
• Managed software builds from three environments for development, testing, and production. Reduced maintenance overhead by converting antiquated systems, migrating them to a Citrix application delivery system.