01
Continuous monitoring, automated
Python, PowerShell, Bash, and Power Automate now produce the POA&M and ConMon evidence that used to be a week of copy-paste. Same package. Less theater.
Philadelphia · Public Trust · U.S. Citizen
Nic Colarossi
I run continuous monitoring for SAP Concur’s FedRAMP environment — vulnerabilities, evidence, change review, and the report that has to land on time.
What I do
Day-to-day security operations on a small team for an authorized SaaS platform. The work is tracking, hunting, writing controls, and automating the parts that used to eat a week.
~300items on the POA&M
7 days → 1to assemble the monthly package
30+on-time ConMon submissions
Rev 5 / 20xFedRAMP, CR2026, CMMC, IL-5
02
Hunting that becomes a finding
Splunk, Kibana, Nessus, and SQL extracts from Concur. If it matters, it goes on the risk register or the POA&M — not a slide that dies in a meeting.
03
CR2026 / 20x ops app
Internal SAP CAP + UI5 app used by the ConMon team for VDR, VER, SCN, and SDR workflows and KSI connectors. Built with Claude Code. OSCAL POA&M export is next.
04
AI features inside an authorization
Advise on data handling, significant-change review, and monitoring before AI capabilities reach the FedRAMP-authorized production path.
Experience
SAP America, Newtown Square. Three roles, same company.
Information Security Specialist · POA&M Manager
Feb 2024 — now · SAP Concur
- Vulnerability tracking, evidence collection, change review, ISSO communication, agency reporting.
- Prioritize ~300 open POA&M items with system owners.
- Wrote SSP language accepted for SC-13, AU-2, and related SC / AU controls.
- Completed IL-5 and CMMC gap analyses.
Associate Solution Support Engineer
Mar 2022 — Feb 2024 · SAP Fieldglass
- SAML, OAuth, PKI, and TLS/SSL failures — diagnose, then walk the customer and engineering through the fix.
- SQL investigations and KBAs that cut repeat identity and certificate tickets.
IT Service Desk Associate
Mar 2021 — Mar 2022 · contract, US Experts Team
- Escalated access and technical incidents for about 100,000 internal users (ServiceNow, Azure AD / SCCM, Jamf).
Tools
Operations
Vulnerability management, POA&M, threat hunting, SCN review, ConMon evidence, KSI collection, risk register, DISA / CIS STIGs
Identity
SAML, OAuth, PKI, TLS/SSL, access reviews
Platforms
AWS GovCloud, Splunk, Nessus / Tenable, Kibana, Azure AD, F5, ServiceNow, Jira, SAP CAP, SAPUI5, Kali
Automation
Python, PowerShell, Bash, SQL, Power Automate, NIST OSCAL, Claude Code
Frameworks
NIST SP 800-53, FedRAMP Rev 5 / 20x, CR2026, CMMC, DoD IL-5
About
Music degree, then a help desk, then identity tickets, then authorized-cloud operations. The through-line is systems that have to stay correct under someone else’s audit.
Contact
FedRAMP / GRC work, ConMon automation, or reviewing an AI feature against an authorization boundary.