Brian Heckethorn

Background

About Brian Heckethorn

A senior Information System Security Engineer and cybersecurity Subject Matter Expert with nearly 30 years of experience in federal IT environments, specializing in the practical application of NIST Special Publications to ensure compliance, risk mitigation, and secure system design within the Department of Veterans Affairs. Proficient in implementing NIST SP 800-53 Rev. 5 security controls, SP 800-37 Rev. 2 RMF processes, and SP 800-160 Vol. 1 systems security engineering principles across hybrid and cloud-based architectures. Skilled in developing and reviewing System Security Plans (SSPs), Security Impact Analyses (SIAs), Risk Assessments (RARs), and Security Assessment Reports (SARs) in support of Authority to Operate (ATO) packages within eMASS. I lead technical efforts to perform security categorizations in accordance with NIST SP 800-60 Vol. 1 & 2, tailoring controls to specific information types and mission impact levels. I contribute to AI integration efforts by aligning with the NIST AI RMF and supporting the development of overlay guidance for emerging technologies. My role bridges deep technical analysis with policy interpretation, ensuring traceable implementation of FISMA, FedRAMP, and agency-specific governance. I regularly engage in the evaluation of inherited controls, supply chain risk analysis, and the integration of continuous monitoring strategies, supporting secure digital transformation efforts across agency enterprise systems.