Johnny Vaughan II

Technology Risk, GRC, and IT audit. Eight years across financial services, healthcare, federal and DoD environments. CRISC and CTPRP certified. Currently building automation for the compliance work I used to do by hand.

Chesapeake, VA · vaughanjc2@outlook.com · LinkedIn · GitHub

What I Do

I assess controls, test whether they actually operate, and write up what I find in a way the business can act on. Most of that has been in regulated environments where the evidence has to hold up to someone else's scrutiny — external auditors, federal assessors, banking regulators.

The through-line across nine roles has been the same question in different clothes: is this control real, and can you prove it? I'm now answering that question with code as well as documentation.

Experience

Global IS Risk and Compliance Analyst — PRA Group

SOX ITGC, PCI DSS, and GDPR control evaluation at an international financial services organization. Ran recurring joiner/mover/leaver, role-based, and privileged access reviews, including exception investigation and closure validation. Owned Proofpoint phishing simulations and the Power BI reporting behind them. Participated in Change Advisory Board and assessed implementation risk.

Senior Security Analyst — Azzur Group / SAP NS2

Led the NIST SP 800-53 Revision 4 to Revision 5 control and documentation update for a DoD and U.S. Army-aligned SAP cloud authorization environment. Maintained System Security Plans, FIPS 199 categorizations, privacy documentation, and evidence repositories supporting FedRAMP and RMF authorization readiness. Ran functional and tabletop incident response and disaster recovery testing with engineers and system owners.

Senior Associate, Third-Party Risk — KPMG

Planned and executed 40+ global third-party technology risk assessments for financial services and healthcare clients, end to end: scoping, evidence requests, interviews, control evaluation, risk rating, reporting, remediation, and closure. Led ISO 27001 and GDPR assessments for Lloyds Banking Group. Helped establish the third-party risk program at City of Hope. Challenged incomplete evidence, unsupported control assertions, and remediation plans that did not address the underlying requirement.

Cybersecurity Specialist IV — MindPoint Group (Citizens Bank)

Recurring third- and fourth-party risk assessments using a customized NIST SP 800-53 methodology aligned to GLBA, FFIEC, COBIT, and PCI DSS. Helped transition the program from the Shared Assessments SIG to a NIST-based model and standardize evidence, risk-rating, and reporting practices.

Technical Writer / Cloud Implementation Specialist — NXT (Maryland FiRST)

Developed cybersecurity, cloud, and system-support procedures for a public-safety telecommunications program, translating technical requirements into controlled documentation validated with application and system owners.

IT Specialist / Security Controls Assessor — Paradigm

NIST SP 800-53A and 800-171 security control assessments across Windows, network, application, and cloud environments. Policy review, personnel interviews, configuration examination, and control testing. Used Tenable Nessus and Wireshark to evaluate vulnerabilities and network safeguards. Wrote the Security Assessment Reports.

Projects

GRC Automation Toolkit

Ten Python tools that automate compliance tasks I have done manually for years. Built independently, tested against synthetic data, all source public.

• Access reconciliation — compares system accounts against an HR roster and flags access that should have been removed. Tested against a 505-record synthetic dataset with a known answer key; identified all 25 planted exceptions, 20 terminated users and 5 orphaned service accounts.
• Control testing sample generator — reproducible random sampling with a fixed seed, so a reviewer can re-create and defend the exact selection.
• Findings register analyzer — calculates finding age and groups by owner to show who is carrying the most and whose are oldest.
• Vendor risk scorer — applies a weighted rubric to questionnaire responses and assigns a risk tier for TPRM triage.
• Log analyzer — parses raw authentication logs and flags after-hours access, failed logins, and privileged activity.
• Access expiration checker — flags overdue and due-soon access reviews, recertifications, and vendor assessments.
• Findings summary — tallies a findings register by severity for an instant Critical/High/Medium/Low breakdown instead of counting by hand.
• Control crosswalk mapper — maps NIST SP 800-53 controls to ISO 27001 and reports both coverage and gaps, so overlapping framework obligations can be tested once.
• Control library — tracks a control inventory with owners and last-tested dates, and flags which controls are overdue for testing.
• Findings deduplicator — normalizes finding descriptions and removes duplicates, which matters when registers get merged across sources or assessment cycles.

These are functional prototypes tested on synthetic data, not production systems. Source on GitHub

This Site — AWS Static Hosting

Deployed from a CloudFormation template: private S3 bucket, CloudFront distribution with Origin Access Control so nothing but CloudFront can read the bucket, HTTPS enforced. Infrastructure defined as code and reproducible.

I reviewed the template before running it and logged two gaps against my own site: encryption is not explicitly declared, and access logging is not enabled. Neither breaks anything — S3 encrypts by default — but a control that is not declared is a control an assessor cannot verify. Source on GitHub

GRC Engineering Pipeline — In Progress

A six-week build taking cloud infrastructure from working to audit-defensible: compliant infrastructure as code in Terraform, policy as code in Rego, a CI gate that blocks non-compliant pull requests, cryptographically signed evidence, and a NIST SP 800-53 control mapping in OSCAL. Adding one piece per week.

Frameworks

NIST SP 800-53 and 800-53A, NIST SP 800-171, RMF, FedRAMP, ISO 27001, SOX ITGC, PCI DSS, GLBA, FFIEC, COBIT, GDPR, HIPAA, HITRUST, FIPS 199

Tools

Python, pandas, Power BI, Excel, Git, SQL-adjacent data work, RSA Archer, OneTrust, Diligent, eMASS, Xacta, ServiceNow, Jira, Tenable Nessus, Wireshark, Proofpoint, AWS, Azure, Terraform

Certifications

CRISC — Certified in Risk and Information Systems Control, ISACA
CTPRP — Certified Third Party Risk Professional, Shared Assessments