Douglas Zipay
Cybersecurity Analyst
About Me
I’m a Cybersecurity Analyst and Lead CMMC Certified Assessor (LCCA) at a C3PAO, performing CMMC Level 2 assessments for organizations in the Defense Industrial Base (DIB). My days are spent on the other side of the table from where I used to be: evaluating how contractors protect Controlled Unclassified Information (CUI) and helping the DIB meet the standard (NIST SP 800-171).
Alongside the day job, I’ve been riding the AI wave. I’m working to become fluent in tools like Claude/Gemini, and I’m on a couple of AI projects of my own. I’m interested in how AI can sharpen the work of security, audit, and assessment.
Before assessing, I was an IT Systems Auditor supporting the Defense Logistics Agency (DLA), where I learned what an audit looks like from the inside. Before that, I was a Cybersecurity Project Manager at the Department of the Interior (DOI).
Before DOI, I spent more than ten years supporting U.S. Special Operations Command (SOCOM). That second act started with Special Forces communications. I supported SF communicators across every kind of system, everything from SATCOM antennas down to the laptops, and everything in between. I went where they deployed, keeping their critical systems on the air and processing traffic. Over time I moved into management, then project management, until it was time to see what else was out there.
This whole second act came after a clean break. When I left the Navy, I wanted nothing to do with IT or DoD. I had earned my MBA in Financial Management before retiring, and I stepped into operations management. It lasted about two years. The pull back to the gear was stronger than I expected, and before long I was back in IT (with new skills), back in DoD, and eventually back in management.
It all started in the Navy. I’m a retired Chief Petty Officer, and that’s where I learned Information Technology, computer theory, and discipline. It was a rewarding experience.
Along the way, I make it a point to mentor people moving into tech and cyber: career changers, veterans, and folks at every age and stage figuring out their own way in.
Below, you’ll find my blog, where I write about the experiences, lessons, and milestones along this path.
The "Doug Was Built, Not Born" Blog
Careers aren’t built in straight lines, and neither is this blog. Here you’ll find the wins, the pivots, the lessons, and the occasional strong opinion from my journey so far. New posts show up whenever there’s something worth saying, so jump in anywhere.
Go to: the blog: dougwasbuiltnotborn.blog.
Three Months – It’s Great Too!
It’s been three months since I departed DLA. In that time I’ve participated in a variety of assessments. Each one was different, each one interesting, and each one a learning experience. I’ve now completed an assessment as the Lead CCA. The assessing itself is essentially the same, but now I take my turn with the administration and leadership responsibilities that come with the role. New challenges make you stronger. I can’t imagine, for even one second, staying in the same job for the past ten years. I’ve learned so much since leaving my first tenure in post-military contracting. I started each of these new jobs nervous and unsure, but that passes, and it builds confidence. Tech is great. – Doug
Learn First, Then Get Marketable
In early 2025, I found myself unemployed after DOGE contract cuts. Suddenly I had more time on my hands, so I stepped up my attendance at events around Tampa Bay. I was already a semi-regular at several user groups (AWS, Java, AI, and others). Now I became religious about attending them. I also had the chance to go to conferences and other events that normally happen during the 9-to-5 workday. Yes, I networked, but more than anything, I went to learn. In fact, I first learned about CMMC at a couple of these events, which led to my most recent career pivot. My routine was simple: attend a presentation, then go introduce myself to the presenter or to other recognized subject matter experts. Talking with them taught me more about the...
Learning While You’re Earning
If you're not learning while you're earning, you're cheating yourself out of a better portion of your compensation. - Napoleon Hill. Great quote. Ten years ago this Halloween, I submitted my two week notice to a great job I had as a contractor supporting US Special Operations Command. I was an Operations/Project Manager leading 35+ staff in the US, Germany, Qatar, Afghanistan, Africa, Japan, Hawaii, and I'm missing a location. I got to travel. My boss and our company resided in Fayetteville, NC. My first five years on the contract I was leaving I served as a IT/Satcom tech (some people call it an engineer, but I'm not an engineer.. I traveled the world. I was then promoted to Operations/Project Manager once tthe first five year contract...
Reflections Three Months Later
Coming up to three months on my new job assessing cybersecurity in small/medium defense contractors. I've got to assess systems with all these neat security tools. Tools that I only read about prior. First assessment was intimidating. Now it's "soft of" normal. Are there things that still baffle me? Yes, of course. If I was still in that Technical Project Manager position at USSOCOM, I would never had this opportunity. At DOI I learned CyberArk, SailPoint, and various Microsoft tools. At DLA I learned how to audit in large enterprise settings. In my current position, I'm seeing systems like ThreatLocker, Tanium, Meraki - way more. It's great to be learning all this neat stuff. DougWasBuiltNotBorn
Back at the Keyboard: Two Months Inside the CMMC Arena
It's been quiet here since late July. That wasn't for lack of material. It was because the material was happening faster than I could write it down. Here's the short version: I've changed jobs, earned a new credential, and spent the last two months learning what CMMC looks like when it's no longer a study guide. The New Role On July 27, I joined Sentar as a Cybersecurity Analyst and CMMC Assessor. Sentar is a Certified Third-Party Assessment Organization (C3PAO) out of Huntsville, Alabama. For anyone outside the Defense Industrial Base, that means we're one of the organizations authorized to formally assess whether defense contractors are protecting Controlled Unclassified Information the way the Department of Defense requires. For me,...
Current Certifications
