Nisha P. McDonnell

|

Houston, TX / Remote

Scroll Down

About Me

I'm a Senior Cybersecurity Engineer with extensive experience supporting regulated systems through the full Risk Management Framework (RMF) lifecycle. My work focuses on aligning security controls with operational requirements, ensuring compliance, and driving practical security outcomes that strengthen organizational resilience.

I have a deep interest in both the defensive and offensive sides of security. I design, implement, and assess security architectures in cloud environments, with a particular focus on AWS. My background blends hands-on engineering with strong GRC expertise, allowing me to bridge technical and compliance perspectives effectively.

I'm passionate about building security solutions that are actionable, automated where possible, and aligned with modern Zero Trust principles. Beyond my professional role, I share my learning journey through projects, blogging, and mentorship in the cybersecurity community.

Skills & Expertise

Cloud Platforms

AWS (SAA Certified) Azure (Administrator) AWS GovCloud

Security & Compliance

FedRAMP NIST SP 800-53 NIST RMF NIST CSF DISA STIGs CIS Controls POA&M Management

Tools & Technologies

Splunk Terraform Ansible AWS Config GuardDuty Security Hub CloudFormation CrowdStrike Nessus/ACAS eMASS

Programming/Scripting

Python Bash PowerShell

Core Competencies

Security Control Assessment Threat Hunting Vulnerability Management Security Architecture Zero Trust Compliance Automation

Featured Projects

AWS STIG-Hardened Infrastructure

Designed and implemented a secure, STIG-hardened infrastructure in AWS, aligning with RMF controls. Automated baseline configuration checks and enforced compliance monitoring using native AWS services.

AWS Config Terraform Ansible EC2 CloudWatch SSM
  • Automated STIG baseline enforcement for Windows and Linux EC2 instances
  • Integrated compliance findings with AWS Config for continuous monitoring
  • Mapped controls to NIST 800-53 and FedRAMP baselines

Continuous RMF Monitoring Dashboard

Built a compliance visibility dashboard showing the live status of key security controls mapped to RMF requirements. Data is automatically ingested from Config rules, Security Hub, and STIG checks.

AWS Security Hub AWS Config Lambda Python CloudWatch
  • Real-time view of control compliance across cloud assets
  • MITRE ATT&CK and RMF control overlay for better context
  • Reduced reporting lag between operations and GRC teams

Automated Compliance Evidence Pipeline

Built a serverless pipeline to automate collection, formatting, and storage of control compliance evidence for NIST 800-53 controls. Replaced static manual evidence uploads with real-time data pulled from AWS Config.

AWS Config EventBridge Lambda S3 Terraform
  • Automated evidence generation and S3 archiving on compliance state changes
  • Eliminated manual documentation steps for 10+ technical controls
  • Created timestamped reports aligned to RMF control families

RMF Control-as-Code Framework

Developed a reusable Terraform module library that codifies common NIST 800-53 and DISA STIG control requirements as IaC policies. Integrated enforcement through AWS Config and remediation via Lambda functions.

Terraform AWS Config Lambda Python
  • Encapsulated control enforcement into reusable Terraform modules
  • Reduced configuration drift and improved audit consistency
  • Mapped Terraform resources directly to RMF control IDs

Automated POA&M Tracker

Created an automated POA&M tracking workflow that ingests AWS Config compliance findings and generates actionable POA&M entries. Non-compliance is logged and categorized by control family, severity, and resource.

AWS Config Lambda DynamoDB Python EventBridge
  • Replaced manual POA&M tracking spreadsheets with structured, queryable data
  • Provided near real-time visibility into compliance posture
  • Aligned findings with NIST RMF remediation workflow

Certifications

🛡️

CISSP

Certified Information Systems Security Professional

🏰

GIAC GDSA

GIAC Defensible Security Architecture

☁️

AWS SAA

AWS Certified Solutions Architect – Associate

🌐

CCNA

Cisco Certified Network Associate

🔐

Security+

CompTIA Security+

🔍

CySA+

CompTIA Cybersecurity Analyst

⚔️

CEH

Certified Ethical Hacker

☁️

Azure Administrator

Microsoft Certified: Azure Administrator Associate

🌐

Azure Network Engineer

Microsoft Certified: Azure Network Engineer Associate

🎯

eJPT

eLearnSecurity Junior Penetration Tester

Get In Touch

I'm always interested in connecting with fellow cybersecurity professionals, discussing new projects, or exploring opportunities in cloud security and GRC.

Send Email Connect on LinkedIn