Masanari
Kennyon Sadler, CISSP — Headshot

Cybersecurity & Risk Management Specialist

KennyonSadler, CISSP

Subject Matter Expert  ·  Risk Management Framework  ·  Medical Device Security

📍 Bossier City, LA | kennyon.sadler@outlook.com | 504-344-5984

Cybersecurity and risk management professional with 11 years of information security experience, including more than 7 years focused on the cybersecurity of networked medical and clinical devices within a federal health care system. Skilled in applying the National Institute of Standards and Technology (NIST) Risk Management Framework, conducting vulnerability assessments and risk analyses, and developing security documentation and corrective action plans. Regularly briefs senior officials and Authorizing Officials on risk-based decisions and translates complex technical security issues into clear guidance for both technical and executive audiences. U.S. Navy veteran.

11
Years InfoSec Experience
7+
Years Medical Device Security
80%
Turnaround Time Reduction
100%
Network Compliance Achieved
◆ ◆ ◆

Core Qualifications

I
Medical Device Cybersecurity
  • Risk analysis, secure network architecture, and compliance review for networked medical equipment.
RMF & FISMA Compliance
  • NIST SP 800-53 security control assessment, remediation tracking, and Authority to Operate (ATO) support.
Vulnerability Assessment
  • Risk mitigation for information systems, including incident response and disaster recovery planning.
Security Documentation
  • System security plans, risk assessments, corrective action plans (POA&Ms); program compliance auditing.
Stakeholder Engagement
  • Briefing senior leadership and AOs; training technical and non-technical staff; cross-team liaison.
HSCC & SMART Toolkit
  • Contributing member, Health Sector Coordinating Council (HSCC) Cybersecurity Working Group; recipient of the group's 2025 Medallion award for partnership contributions.

Professional Experience

II
Cyber Risk Analyst / Information System Security Officer
U.S. Department of Veterans Affairs, Office of Information Security — 810 Vermont Ave NW, Washington, DC 20420  ·  March 2022 – Present  ·  GS-2210-13
  • Issues practical, field-ready guidance on software bill of materials (SBOM), vendor attestation, and documentation requirements — aligned with Executive Order 14028, Improving the Nation's Cybersecurity — reducing processing delays in risk assessment workflows.
  • Clarifies Risk Management Framework and Authority to Operate (ATO) decision pathways for intake reviewers, clinical technology partners, and system owners, accelerating authorization decisions for multiple specialized medical device systems.
  • Developed a risk-review tool that cut review time from days to minutes, and reinforced federal privacy and audit-retention requirements to strengthen records management and audit readiness.
  • Coordinates with legal counsel and contracting officials to resolve vendor confidentiality agreement requests, protecting personnel while securing the proprietary information needed for cybersecurity analysis.
  • Represents the team at an interagency cyber risk summit with the Defense Health Agency and partner organizations, and clarifies how new artificial intelligence governance requirements interact with existing risk assessments.
IT Cybersecurity Specialist, Risk Management Team Lead
U.S. Department of Veterans Affairs, Office of Information Security — 810 Vermont Ave NW, Washington, DC 20420  ·  March 2021 – February 2022  ·  GS-2210-14 (temporary, COVID-19 emergency response)
  • Led a team of contractors (reduced from 25 to 20 as the program matured) performing enterprise-wide risk assessments of information systems, including networked medical and clinical devices supporting pandemic response.
  • Briefed the Authorizing Official and senior leadership on risk analysis findings and acceptable risk levels to support formal risk-acceptance decisions.
  • Directed full life-cycle application of the NIST Risk Management Framework across assigned systems, including security control assessment and remediation of noncompliant controls.
Information Systems Biomedical Support Specialist
U.S. Department of Veterans Affairs, Veterans Health Administration — 2400 Canal St, New Orleans, LA 70119  ·  March 2019 – March 2021  ·  GS-1601-12
  • Directed network and information systems design to implement cybersecurity policy for networked medical devices, following medical device isolation and segmentation best practices.
  • Achieved 100% cybersecurity compliance across the facility's networked medical devices within 6 months through vulnerability analysis and risk assessment.
  • Reduced average turnaround time for corrective maintenance and cybersecurity service requests by 80% (from 10 business days to 2).
  • Developed disaster recovery procedures as a member of the local business continuity team and conducted regular system audits and reviews.
Senior Solutions Architect
Cerner Corporation — New Orleans, LA  ·  June 2015 – March 2019
  • Led risk assessments and security testing for client healthcare information systems using the ISO/IEC 27001 information security standard and the COBIT governance framework.
  • Designed and implemented cybersecurity contingency plans, including disaster recovery and incident response procedures, for client systems.
  • Directed a security testing team performing vulnerability assessments and penetration testing across client environments.
  • Managed the secure migration of critical systems from Windows Server 2003 to Windows Server 2008 R2 with zero security incidents.
  • Designed and implemented a workflow for 12 of the facility's most critical systems that saved the facility $100,000.
  • Designed an interface and workflow supporting the Neonatology department that reduced radiology read turnaround from more than 24 hours to minutes.

Communications & Stakeholder Engagement

III
Executive Briefing
  • Frequently briefs the Authorizing Official (AO) and Designated Representatives regarding Enterprise Risk Analysis (ERA) decisions and acceptable risk tolerance.
Technical Translation & Liaison
  • Proven ability to communicate complex technical concepts effectively to executive and business audiences.
  • Acted as primary liaison between client sites and corporate HQ to guide solution design and supporting processes.
Strategic Facilitation
  • Facilitates chartered working groups to develop innovative strategies for the reliability and accessibility of Authorized Information Systems (AIS).

Planning & Evaluating

IV
Strategic Alignment
  • Designs and manages enterprise cybersecurity architecture to ensure alignment with IT strategy, agency missions, and budgeting cycles.
Compliance Auditing
  • Executes annual reviews and continuous monitoring of medical and clinical devices to satisfy FISMA reporting requirements.
Vulnerability Assessment
  • Conducts comprehensive assessments on planned and installed information systems to identify protection needs and mitigate compromise risks.
Lifecycle Management
  • Directs the full lifecycle implementation of the NIST RMF, managing security controls and authorization documents end-to-end.

Technical Competence

V
Framework Expertise
  • Expert in NIST SP 800-53 (Rev 4 & 5), RMF, FISMA, FIPS, DIACAP, and HIPAA.
IoMT & Medical Device Security
  • Specialist in Medical Device Security (IoMT), managing Enterprise Risk Analysis (ERA) for clinical devices in alignment with VA Directive 6500.
ATO Remediation
  • Orchestrates efforts for noncompliant security controls to ensure System Owners receive the Authority to Operate (ATO).
Infrastructure Protection
  • Designed and implemented cybersecurity contingency plans, including disaster recovery and incident response procedures.

Technology Awareness

VI
Advanced Threat Management
  • Proficient in Cyber Threat Analysis, Incident Reporting (CIRC), and IT Isolation Management.
Emerging Tech Integration
  • Cultivates industry partnerships to leverage advanced technologies for research, medical, and special-purpose devices.

Core Frameworks & Standards

Interactive Risk Framework ↗ NIST SP 800-53 Rev 5 RMF FISMA IoMT / MDS2 HIPAA FIPS DIACAP VA Directive 6500 FedRAMP IEC 62443 FDA Cybersecurity Remedy CMMS Enterprise Risk Analysis Continuous Monitoring Incident Response Disaster Recovery ISO/IEC 27001 COBIT SBOM / MDS2 EO 14028

Education & Certifications

VII

Education

B.S., Business/Information Systems — University of Phoenix, San Diego, CA (2001)

Certificate, Managing Cybersecurity Risk in the Modern Age — Harvard University, Cambridge, MA (2020)

Certifications

Certified Information Systems Security Professional (CISSP) — (ISC)² — awarded April 1, 2025

Member ID: 2355395

Additional Information

VIII
Professional Affiliations
  • Contributing member, Health Sector Coordinating Council Cybersecurity Working Group; recipient of the group's 2025 Medallion award for partnership contributions.
Service & Eligibility
  • U.S. Citizen. Veteran, U.S. Navy, July 1988 – September 1996, Honorable Discharge.
  • Eligible for veterans' preference for civil service employment (documentation available upon request).

Asset Reference Document: masanari-risk-framework.html

◆ ◆ ◆