Douglas Zipay
Cybersecurity Analyst
About Me
I’m a career veteran, and my post military career path wasn’t exactly a straight line – but it was, or is, a rewarding journey..
When I left the Navy, I wanted nothing to do with IT or DoD. I went back to school, earned my MBA in Financial Management, and stepped into operations management — a clean break from the world I’d just left. It lasted about two years. The pull back to the gear was stronger than I expected, and before long I was back in IT, and back in DoD.
That second act started with Special Forces communications — supporting SF communicators across every kind of system, from SATCOM antennas down to the laptops running on them, and everything in between. I deployed wherever they went, keeping the link up. Over time I moved back into management, then project management, and spent more than ten years supporting SOCOM before deciding it was time to see what else was out there. From there I moved to the Department of the Interior, then to the Defense Logistics Agency — and most recently, into a new role as a Cybersecurity Analyst, focused on CMMC.
Along the way, I’ve also made it a point to mentor people moving into tech and cyber — career-changers, veterans, folks at every age and stage figuring out their own way in. If that’s you, I’m always glad to talk.
Below, you’ll find my blog, where I write about some of the experiences, lessons, and milestones along this path.
The "Doug Was Built, Not Born" Blog
Here I share past and present experiences where I’ve grown professionally and personally – and some opinions along the way. There’s no particular order to my postings as I add subject matter often.
Get a Burner Inbox for Your Career
I've had a dedicated job-search email address since the day I hung up my Navy uniform — never my personal inbox, never a work account. Every resume, recruiter reply, and offer letter has lived in one searchable place for years, which turned it into more than a job-search tool; it's a running career archive. But for my most recent search, I retired that address and opened a brand new one. Years of stale job-board alerts, outdated subscriptions, and recruiter outreach chasing a version of my career I'd outgrown had turned it into noise. A fresh address meant a clean slate, tuned to who I am now, not who I was a decade ago. There's a security reason to do this too. A job-search address is about as public as an email gets — it's on your...
A New Chapter: From IT Systems Auditor to CMMC Assessor
This week marked my first week as a CMMC Assessor at Sentar. It's a title I've been working toward for a while, and now that it's here, I wanted to write down where it came from and how it feels. Last year, I earned my CMMC CCA (Certified CMMC Assessor) credential. A decision that came at an unexpected time, when I found myself affected by the DOGE driven changes moving through the federal contracting world. It wasn't the plan I'd originally mapped out, but it turned out to be the right pivot. I sat for the CCP and CCA on my own terms, paid for the mandatory classes and added it to a credential stack I'd already been building for years: CISSP, CISM, CISA, CEH, PMP, PSM, and ITIL Before this latest move, I was an IT Systems Auditor with...
How I Feed My AI Tools
For several years, I relied on landscapers to cut my grass, much like many of my neighbors. Even in spring 2025, I maintained the service, believing that the hour plus every week saved was better spent on my job hunt and due to DOGE. That fall, I had already found employment, but as the seasons changed in Florida, I realized that my yard would only need cutting every two weeks vice weekly. After some consideration, I decided to take on the task myself for the fall and winter months. It was cooler, and I had gasoline in my garage that needed using up from the last hurricane. This spring, I continued cutting the grass myself and redirected the savings into various AI tools, resources, and subscriptions, such as Claude and Gemini Pro. This...
The Leap I’m Making
There are moments in a career where you can feel the window opening. The question is whether you have the nerve to climb through it. I'm climbing through it. I've accepted a position as a Cybersecurity Maturity Model Certification (CMMC) Assessor, and I want to be honest about what that means — because it's not a clean, simple decision. It's a leap of faith, and leaps of faith are uncomfortable by design. What I'm Leaving Behind Let me be clear about something first: I am not leaving a bad situation. Not even close. The company I'm currently with has been a great place to work. The contractors I've worked alongside are sharp, professional, and genuinely good people. The government employees we support have been outstanding. The work has...
The AI Sandbox: How I Used Claude and Gemini to Master CMMC and NIST Controls
In the contracting world, stability is a luxury. When a contract enters a recompete phase, you don’t wait around to see which way the wind blows; you get ready for whatever comes next. For me, that meant aggressively closing the gaps in my compliance toolkit—specifically around the Cybersecurity Maturity Model Certification (CMMC) and some of the more nuanced controls in NIST SP 800-53. My strategy wasn't just reading frameworks; it was interactive combat testing. Over the last few months, I’ve been running an ongoing, dual-platform simulation, flip-flopping between Claude and Gemini to act as my virtual assessment team. By leveraging both AI platforms, I’ve been able to generate complex, real-world auditing scenarios and rigorously...
Current Certifications
