Douglas Zipay
Cybersecurity Analyst
About Me
I’m a career veteran, and my post military career path wasn’t exactly a straight line – but it was, or is, a rewarding journey..
When I left the Navy, I wanted nothing to do with IT or DoD. I earned my MBA in Financial Management prior to retiremen and stepped into operations management. It was a clean break from the world I’d just left. It lasted about two years. The pull back to the gear was stronger than I expected, and before long I was back in IT, and back in DoD.
That second act started with Special Forces communications — supporting SF communicators across every kind of system, from SATCOM antennas down to the laptops running on them, and everything in between. I deployed wherever they went, keeping their critical systems on the air and processing traffic.. Over time I moved back into management, then project management, and spent more than ten years supporting SOCOM before deciding it was time to see what else was out there. From there I moved to the Department of the Interior (DOI), then to the Defense Logistics Agency (DLA) — and most recently, into my current role as a Cybersecurity Analyst, focused on CMMC supporting the Defense Industrial Base (DIB).
Along the way, I’ve also made it a point to mentor people moving into tech and cyber, career changers, veterans, folks at every age and stage figuring out their own way in.
Currently, I’m becoming more proficient in my profession. That includes learning about all the security tools small and medium businesses use to protect their IT systems. I’m also on a couple AI projects.
Below, you’ll find my blog, where I write about some of the experiences, lessons, and milestones along this path.
Doug was Built not Born
The "Doug Was Built, Not Born" Blog
Here I share past and present experiences where I’ve grown professionally and personally – and some opinions along the way. There’s no particular order to my postings as I add subject matter often.
Learning While You’re Earning
If you're not learning while you're earning, you're cheating yourself out of a better portion of your compensation. - Napoleon Hill. Great quote. Ten years ago this Halloween, I submitted my two week notice to a great job I had as a contractor supporting US Special Operations Command. I was an Operations/Project Manager leading 35+ staff in the US, Germany, Qatar, Afghanistan, Africa, Japan, Hawaii, and I'm missing a location. I got to travel. My boss and our company resided in Fayetteville, NC. My first five years on the contract I was leaving I served as a IT/Satcom tech (some people call it an engineer, but I'm not an engineer.. I traveled the world. I was then promoted to Operations/Project Manager once tthe first five year contract...
Reflections Three Months Later
Coming up to three months on my new job assessing cybersecurity in small/medium defense contractors. I've got to assess systems with all these neat security tools. Tools that I only read about prior. First assessment was intimidating. Now it's "soft of" normal. Are there things that still baffle me? Yes, of course. If I was still in that Technical Project Manager position at USSOCOM, I would never had this opportunity. At DOI I learned CyberArk, SailPoint, and various Microsoft tools. At DLA I learned how to audit in large enterprise settings. In my current position, I'm seeing systems like ThreatLocker, Tanium, Meraki - way more. It's great to be learning all this neat stuff. DougWasBuiltNotBorn
Back at the Keyboard: Two Months Inside the CMMC Arena
It's been quiet here since late July. That wasn't for lack of material. It was because the material was happening faster than I could write it down. Here's the short version: I've changed jobs, earned a new credential, and spent the last two months learning what CMMC looks like when it's no longer a study guide. The New Role On July 27, I joined Sentar as a Cybersecurity Analyst and CMMC Assessor. Sentar is a Certified Third-Party Assessment Organization (C3PAO) out of Huntsville, Alabama. For anyone outside the Defense Industrial Base, that means we're one of the organizations authorized to formally assess whether defense contractors are protecting Controlled Unclassified Information the way the Department of Defense requires. For me,...
Get a Burner Inbox for Your Career
I've had a dedicated job-search email address since the day I hung up my Navy uniform — never my personal inbox, never a work account. Every resume, recruiter reply, and offer letter has lived in one searchable place for years, which turned it into more than a job-search tool; it's a running career archive. But for my most recent search, I retired that address and opened a brand new one. Years of stale job-board alerts, outdated subscriptions, and recruiter outreach chasing a version of my career I'd outgrown had turned it into noise. A fresh address meant a clean slate, tuned to who I am now, not who I was a decade ago. There's a security reason to do this too. A job-search address is about as public as an email gets — it's on your...
A New Chapter: From IT Systems Auditor to CMMC Assessor
This week marked my first week as a CMMC Assessor at Sentar. It's a title I've been working toward for a while, and now that it's here, I wanted to write down where it came from and how it feels. Last year, I earned my CMMC CCA (Certified CMMC Assessor) credential. A decision that came at an unexpected time, when I found myself affected by the DOGE driven changes moving through the federal contracting world. It wasn't the plan I'd originally mapped out, but it turned out to be the right pivot. I sat for the CCP and CCA on my own terms, paid for the mandatory classes and added it to a credential stack I'd already been building for years: CISSP, CISM, CISA, CEH, PMP, PSM, and ITIL Before this latest move, I was an IT Systems Auditor with...
Current Certifications
