Nate Lee

Nathan S. “Nate” Lee, CISSP

Hampton Roads, VA · +1-530-628-3533 · nathan (over-yonder-at) teamlee.fun

Summary (Who is this guy?)

Principal cybersecurity engineer with 25+ years in federal security assessment, with expertise in Common Criteria (design) and FIPS 140 (crypto) certification, Security Controls Assessment leadership and execution, Risk Management Framework (RMF) and risk assessment. Architect of MITRE’s Adaptive Cybersecurity Testing (ACT, act.mitre.org) risk-based assessment framework that replaced the legacy compliance assessment program for 200+ FISMA systems at CMS and is deployed with U.S. combatant commands (COCOMs) and their Foreign Military Sales (FMS) partners in Taiwan, the United Arab Emirates (UAE), and Morocco. Lead group responsible for MITRE’s Security Automation Framework (SAF) saf.mitre.org and for Agentic ACT, an LLM-based tool that automates much of the ACT risk-assessment process.

Core Competencies (and jargon)

Risk-based security assessment (ACT) · NIST RMF and DoD RMF · NIST SP 800-53 · CMS ARS / CMSR · Security Controls Assessment (SCA) and A&A · Vulnerability assessment and penetration testing · Security automation (MITRE SAF, LLM-assisted assessment) · Common Criteria (CC) v2/v3 · FIPS 140-2/140-3 · Cybersecurity policy development · Foreign Military Sales (FMS) engagements · Engineering management and mentoring · Sponsor relationship and expectation management

Experience (What’s this guy done?)

The MITRE Corporation — McLean, VA · 2016 – Present

Principal Cyber Security Engineer

Group Lead, Security Automation & Analysis Group (L521, Cyber Assessments & Security Automation Department) · April 2023 – Present

• Supervise six engineers: staffing and work assignment, goal-setting, performance reviews, training, awards, discipline, and mentoring, in support of the L521 Department Manager.
• Own part of the Department’s security automation portfolio, including the MITRE Security Automation Framework (SAF) (saf.mitre.org), an open-source suite for automating cybersecurity compliance, security validation, and continuous monitoring.
• Lead development of the ACT process and Agentic ACT, an AI-enhanced tool that automates much of the manual ACT risk-assessment workflow and serves as a workaid for risk assessors.

ACT Principal Architect and Task Lead · 2019 – Present

• Architected and lead the ~8-person team developing and deploying MITRE Adaptive Cybersecurity Testing (ACT), a risk assessment process and risk-based decision-making framework now in operational use at the Centers for Medicare & Medicaid Services (as “CSRAP”), USAFRICOM with its Moroccan FMS partner, USCENTCOM with its UAE FMS partner, and USPACOM with its Taiwan FMS partner, with additional sponsors piloting.
• Define ACT’s requirements, methodology, and multi-year roadmap using an iterative, agile approach; manage sponsor projects end to end (staffing, tasking, expectations, cross-department coordination with MITRE, sponsor, and contractor SMEs).
• Led ACT’s implementation at CMS across 200+ FISMA systems, replacing the legacy SCA program. Established quality and acceptance criteria for ACT deliverables and a formal Deliverable Review Panel; performed formal and informal deliverable reviews on CMS’s behalf.
• Mentor sponsor staff and contractors in cybersecurity, assessment methodology, project and contractor management, scheduling, and level-of-effort estimation.
• Contribute individually: perform analyses, build tools and techniques, and author templates, processes, procedures, briefings, and deliverables; brief sponsors, sponsor contractors, and partner organizations.

Cybersecurity Assessment Lead · 2016 – Present

• Lead teams conducting ACT risk assessments, SCAs, vulnerability assessments, and penetration tests for sponsor and internal systems: application and system testing, management and operations (M&O) interviews, and documentation review against federal, sponsor, and industry standards.
• Work directly with system owners, ISSOs, and senior management to define compliance and assessment requirements.

Group Lead, Security Analytics Group (L143, Architecture Analytics Department) · December 2021 – April 2023

• Supervised department staff with the same management responsibilities described above, and mentored other Group Leads and their staff in cybersecurity so they could bring it into existing and new projects.

Policy Lead / Team Leader, CMS Cybersecurity Policy · 2016 - 2021

• Defined requirements and approach for CMS policy development in a domain with mixed-quality data and requirements; performed the analyses as an individual contributor and coordinated MITRE and CMS-contractor SMEs across departments.
• Worked directly with the CMS CISO and staff; presented briefings and delivered official and informal analyses; coordinated staffing and expectations across the work program.

Halfaker and Associates, LLC — Arlington, VA · 2013 – 2016

Cyber Security Practice Area Lead; Principal Cyber Security Engineer

• Created and led the Cyber Security Practice Area, supplying trained cybersecurity staff to programs across the company and mentoring practice staff; provided technical oversight for proposals and business development.
• Oversaw policy, technology management, and program management projects in vulnerability and risk management for federal sponsors; led SCA teams assessing systems against CMS’s implementation of NIST SP 800-53 (CMS ARS/CMSR) and its three-tier network architecture policy.

The MITRE Corporation — McLean, VA · 2010 – 2013

Lead Information Systems Engineer

• Executed vulnerability and risk-management projects within the Center for Connected Government FFRDC for federal sponsors; led SCA teams (system testing, M&O interviews, documentation review) against NIST SP 800-53 and CMS ARS/CMSR.
• Researched and briefed security risks of geotagging in social media; authored whitepapers supporting federal HSPD-12 and E-Authentication strategy.

Corsec Security, Inc. — Fairfax, VA · 2002 – 2010

Principal Security Engineer; Lead Security Engineer; Security Engineer

• Guided vendors through Common Criteria certification of complex systems and FIPS 140-2 validation of cryptographic modules: product analysis, design-compliance gaps, all certification evidence (Security Target, functional spec, HLD/LLD, configuration management, life-cycle, guidance, testing, vulnerability analysis, security policy, finite state model), and management of vendor and testing-laboratory relationships through certification.
• Taught multi-day FIPS and CC requirements-analysis workshops for prospective and current customers; authored post-workshop Compliance Reports mapping standard requirements to product deficiencies and a remediation and certification roadmap.
• Provided technical oversight and QA across all FIPS and CC project teams; managed teams of Corsec engineers, lab resources, and client staff, including milestones, schedules, communications, and billing.
• Applied the standards to hardware VPN/routers, email filters, DBMSs, vulnerability-assessment and firewall appliances, encrypted storage, SAN appliances, RTOSs, and DLP systems.
• Worked with the executive team to streamline corporate and certification processes; designed and maintained proprietary productivity tools including a database-driven certification-evidence generator, project management tools, and timesheet and billing tools.

TWM Associates, Inc. — Fairfax, VA · 2001 – 2002

Information Security Engineer

• Inspected IT and physical security postures of classified government installations worldwide and produced Certification and Accreditation (C&A) packages; designed and re-designed client network architectures and security enclaves.
• Authored and edited physical and information security policies and security testing procedures for DoD and corporate clients; re-engineered a government client’s security testing/honeypot network; built custom security tools and a database-driven internal web application for a DoD agency.

Early Career · 1997 – 2002

• Software Engineer/Contractor, Synergy Consulting Services (custom VB/VBA business applications, 2001–2002)
• Information Solutions intern, Campus Crusade for Christ World HQ (JSP/EJB/Oracle intranet site, 2000)
• Resident Network Assistant, James Madison University campus LAN (1997–2000).
• Showroom Manager, P C Gallery in Chesapeake, VA (1994-1998)

Education

B.S., Computer Science, concentration in Information Technology — James Madison University, 2000

Certifications

Certified Information Systems Security Professional (CISSP), ID# 512193