Behind the Shield

The Defense Tech market is full of opportunity, but getting into the space is far from simple.

In this episode of Behind the Shield, InfusionPoints COO Jason Shropshire and CEO Gary Daemer each share their perspectives on the top 5 challenges companies face when trying to break into the Defense Tech and Department of Defense market. The conversation highlights how technical, operational, and business challenges can look very different depending on where companies are in their federal journey.

From navigating FedRAMP and the DoD Cloud Computing Security Requirements Guide (DoD CC SRG) to finding sponsorship, securing IL4/IL5 authorizations, and surviving long ATO timelines, this conversation offers a candid look at the operational, technical, and business realities of entering the federal and defense markets.

The discussion also explores:
• Why sponsorship is one of the biggest barriers to entry
• The difference between FedRAMP and DoD authorization pathways
• Challenges around IL4 and IL5 environments
• The impact of RMF, DISA, BCAP, and eMASS processes
• Why predictability and automation matter for modern compliance
• Hardening requirements, STIGs, and securing cloud environments
• The business realities of getting a second and third government customer
• How FedRAMP 20x and automation could reshape the future of Defense Tech compliance

Whether you're a startup trying to break into Defense Tech, a cloud service provider pursuing federal business, or an established company navigating DoD requirements, this episode provides practical insight from a team actively helping organizations operate in regulated federal environments.

What You’ll Learn:
• The biggest mistakes companies make entering Defense Tech
• Why compliance alone does not guarantee success
• The hidden complexity of IL4/IL5 authorizations
• How authorization delays impact business growth
• Where the Defense Tech market may be headed next

Learn more about InfusionPoints:
https://www.linkedin.com/company/infusionpoints/
Gary Daemer: https://www.linkedin.com/in/infusionpoints/
Jason Shropshire: https://www.linkedin.com/in/shrop/
Request a Demo: https://xbu40.com/
Blogs: 
SWFT, cATO, 20x and the Rev. 4 Drag Still Inside DoW Cloud Authorization:
https://infusionpoints.com/blogs/swft-cato-20x-and-rev-4-drag-still-inside-dow-cloud-authorization
The Quiet Convergence: why DoD DevSecOps, SWFT, and FedRAMP 20x are Starting to Rhyme:
https://infusionpoints.com/blogs/quiet-convergence-why-dod-devsecops-swft-and-fedramp-20x-are-starting-rhyme
Subscribe for more conversations on FedRAMP, Defense Tech, cybersecurity, cloud compliance, and the future of continuous authorization.

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

In this episode of Behind the Shield, InfusionPoints’ Chad Spears and Tanner Bailey break down one of the most important concepts shaping the future of FedRAMP 20x: the Minimum Assessment Scope (MAS).

As organizations begin preparing for the transition toward continuous validation and automated security evidence, understanding what actually belongs in scope has become critical. Chad and Tanner unpack how MAS is designed to help organizations focus on the systems, resources, and validations that truly matter to the security of the environment instead of wasting time, engineering effort, and budget on unnecessary complexity.

The conversation explores how FedRAMP 20x is pushing organizations toward a more operational, automation-first mindset. Rather than treating compliance as a one-time documentation exercise, the discussion highlights how continuous validation, reusable checks, and machine-readable evidence are changing the way cloud providers approach authorization readiness.

Throughout the episode, the team connects the technical realities of Minimum Assessment Scope back to real business outcomes. From reducing engineering overhead and controlling costs to accelerating authorization timelines and improving operational maintainability, MAS is positioned as a foundational starting point for organizations pursuing a modernized FedRAMP strategy.

Whether you’re a security engineer, cloud architect, compliance lead, executive stakeholder, or CSP trying to understand what FedRAMP modernization actually means in practice, this episode provides practical insight into where the ecosystem is heading and how to prepare.

Chapters:
Introduction and Overview - 0:08
Understanding MAS (Minimum Assessment Scope) - 0:56
Importance of MAS in FedRAMP 20X - 4:52
Defining the Scope and Its Impact - 7:29
Challenges and Considerations - 11:33
Business Impact of MAS - 26:46
Conclusion and Resources - 28:21

What You’ll Learn:
• What Minimum Assessment Scope (MAS) actually means in FedRAMP 20x
• How MAS can reduce complexity, cost, and engineering effort
• Why continuous validation changes the way compliance is approached
• How reusable KSI validation checks improve operational efficiency
• Why automation and machine-readable evidence are central to FedRAMP modernization
• The connection between MAS, speed-to-authorization, and long-term maintainability
• Updates on Consolidated Rules 2026 (CR2026) and evolving FedRAMP terminology
• What organizations should be doing now to prepare for the future of FedRAMP

InfusionPoints Links:
FedRAMP 20x Quick Look Assessment: https://xbu40.com/assessment
https://infusionpoints.com/
LinkedIn: https://www.linkedin.com/company/infusionpoints/
Chad Spears: https://www.linkedin.com/in/chad-spears007/
Tanner Bailey: https://www.linkedin.com/in/tanner-b-37a50a132/

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

In this episode of Behind the Shield, we sit down with Phil Hickson alongside InfusionPoints’ Jackson Gorman and Jason Shropshire for a deep dive into the evolving world of Defense Tech and federal compliance.

Phil shares a behind-the-scenes look at navigating a complex FedRAMP ATO journey during a major divestiture, including standing up a new authorization boundary while maintaining compliance and customer continuity. The conversation explores the challenges of scaling secure cloud services across federal and DoD environments, from BCAP connections and IL4/IL5 considerations to managing risk at scale.

We also unpack what modernization looks like today. With FedRAMP 20x gaining momentum, the group discusses how Defense Tech companies can balance legacy requirements with continuous validation and automated evidence. The result is a candid look at where compliance is headed and what it means for companies building for mission-critical environments.

If you’re working in Defense Tech, selling into federal or DoD markets, or trying to make sense of where FedRAMP is going next, this episode offers practical insight from people actively navigating the shift.

Chapters:
00:08 Introduction and Guest Welcome
00:31 Phil's Experience with CSPs
02:34 Divestiture and Omnissa's Origin
05:20 Challenges with FedRAMP and DOD
15:22 Navigating DOD Authorization
33:45 Modernization and 20X Discussion
49:18 Phil's Origin Story in Compliance
55:44 Lighthearted Questions and Wrap-up


Guest Links: 
Phil Hickson- https://www.linkedin.com/in/philhickson/
Omnissa- https://www.linkedin.com/company/omnissa/
Omnissa trust center | Cloud security & compliance- https://www.omnissa.com/trust-center/
Omnissa Products and Platform Services- https://www.omnissa.com/products/ 
https://www.omnissa.com/

About Omnissa: 
Omnissa provides an industry-leading digital workspace platform of services that simplifies the delivery, management, and security of devices, apps, and services to employees and IT teams alike.
Explore Omnissa - the digital work platform leader- https://www.omnissa.com/about-us/


InfusionPoints Links: 
Jason Shropshire- https://www.linkedin.com/in/shrop/
Jackson Gorman- https://www.linkedin.com/in/jacksonagorman/
https://www.linkedin.com/company/infusionpoints/
https://infusionpoints.com/
https://xbu40.com/
FedRAMP 20x Quick Look Assessment for CSPs: https://xbu40.com/assessment
'SWFT, cATO, 20x and Rev 4 Drag Still Inside DoD Cloud Authorization' Blog: https://infusionpoints.com/blogs/swft-cato-20x-and-rev-4-drag-still-inside-dow-cloud-authorization

InfusionPoints & AWS:
InfusionPoints is proud to be an Amazon Web Services Premier Tier Services Partner, supporting organizations in building, managing, and defending secure cloud environments.

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

What happens when your SOC doesn’t just respond to threats but actively thinks, prioritizes, and takes action?

In this episode of Behind the Shield, we break down the rise of the Agentic SOC and what it means for the future of cybersecurity operations. As organizations face an overwhelming volume of alerts, evolving threats, and increasing pressure to move faster, traditional SOC models are being pushed to their limits. Enter agentic systems. These are AI-driven, decision-capable frameworks designed to augment or even transform how security teams operate.

We explore how agentic capabilities are shifting the SOC from reactive monitoring to proactive, intelligent defense. From automated triage to adaptive response workflows, this conversation dives into the real-world impact of bringing autonomy into security operations and what teams need to consider before adopting it.

Whether you're leading a SOC, building security architecture, or trying to understand how AI is reshaping cyber defense, this episode offers a grounded look at where things are headed and what it takes to get there.

What You’ll Learn:
• What an Agentic SOC actually is and how it differs from traditional SOC models
• How AI agents can triage, prioritize, and respond to threats in real time
• The role of human analysts in an increasingly autonomous environment
• Key benefits and risks of adopting agentic security operations
• How organizations can begin preparing their SOC for this shift
• Where agentic approaches align with modern frameworks like continuous monitoring and validation

InfusionPoints Links: 
Alex Erhardt: https://www.linkedin.com/in/charles-e-7a2b8016a/
Nicholas Whitley: https://www.linkedin.com/in/nicholas-whitley-511085213/
https://www.linkedin.com/company/infusionpoints/
https://infusionpoints.com/
Get continuous security without building your own SOC: https://app.hatchbuck.com/OnlineForm/93633624292

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

In this episode of Behind the Shield, we sit down with Gary Guercio, VP of Operations at Fortreum, for a deep dive into the evolution of cybersecurity auditing and what FedRAMP 20x signals for the future of federal cloud security. From the early days of manual audits filled with printed artifacts, screenshots, and physical binders, to today’s push toward automation, APIs, and machine-readable evidence, Gary shares a firsthand perspective on how dramatically the landscape has changed.

Together, we explore how the industry is shifting away from point-in-time assessments toward continuous validation, and what that really means for Cloud Service Providers, assessors, and agencies. This conversation goes beyond theory and gets into the practical realities: how auditors will need to understand code, how engineering and compliance are becoming tightly integrated, and why organizations must rethink how they build, manage, and prove security from the ground up.

We also discuss the broader impact of FedRAMP 20x on the market, including how transparency, competition, and automation could reshape how security is measured and trusted across the ecosystem. Whether you're just starting your FedRAMP journey or actively navigating 20x, this episode offers valuable insight into where things are going and how to stay ahead.

Chapters:
9:08 Introduction and Guest Intro
9:20 Career Path and Education
10:42 Early Career in Cybersecurity
13:36 Auditing and IT Controls
15:37 Booz Allen and Government Projects
20:39 FedRAMP and Fortreum
25:17 FedRAMP 20x and Automation in Auditing
59:26 The Future of Auditing and AI

What You’ll Learn:
• How cybersecurity auditing has evolved over the last 25+ years
• The biggest differences between traditional audits and FedRAMP 20x
• Why automation and machine-readable evidence are changing everything
• How the role of assessors is shifting toward code and engineering understanding
• What continuous validation actually looks like in practice
• The challenges CSPs will face when adopting 20x
• How competition in the marketplace could drive stronger security outcomes
• Where AI and automation are headed in the auditing space
• Why FedRAMP 20x is about more than compliance, it’s about changing the system

Guest Links:
Gary Guercio- https://www.linkedin.com/in/gary-guercio-48622b5b/
Fortreum- https://fortreum.com

InfusionPoints Links: 
Gary Daemer- https://www.linkedin.com/in/infusionpoints/
InfusionPoints- https://www.linkedin.com/company/infusionpoints/
20x Webinar Series | Session 1- https://youtu.be/EoaXjGa-vl0?si=UmnDCXY4dhTKpC6L
20x Webinar Series | Session 2 Registration- https://xbu40.com/20x-cohort/april-28-26

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

In this special announcement episode of Behind the Shield, we’re sharing a major milestone for InfusionPoints and what it signals for the future of federal cloud security.

Chad Spears and Tanner Bailey break down our FedRAMP 20x Moderate (Class C) achievement, what it took to get here, and why this moment matters for cloud service providers, agencies, and the broader FedRAMP ecosystem. This isn’t just another certification, it’s proof that the shift from point-in-time compliance to continuous validation is already happening.

We unpack how FedRAMP 20x is transforming how security is demonstrated, moving away from static documentation and toward real-time, machine-readable evidence through Key Security Indicators (KSIs). We also touch on the journey behind this achievement, from early automation efforts to navigating evolving PMO expectations.

You’ll hear how this approach changes the experience for providers and assessors, creating a more collaborative and efficient path to authorization. We also explore the business impact, including faster time to market and a clearer path for organizations entering the federal space.

Whether you're pursuing FedRAMP, evaluating 20x, or trying to understand where the program is headed, this episode offers practical insights and a clear view into what comes next.

Chapters:
0:10 Introduction and Special Announcement
0:45 Certification Achievement
1:23 Significance of 20X Certification
2:45 Customer Impact and FedRAMP Framework
6:07 Understanding FedRAMP Designations
11:48 Journey to 20X Certification
18:30 Team Effort and Continuous Validation
18:47 Customer Benefits of 20X Certification
19:02 Platform as a Service and FedRAMP
19:29 Security Controls and KSI's
20:25 Speed to Market with XB40
21:53 Webinar and Education Initiatives
22:48 Upcoming Webinar Details
26:22 Team Recognitions and Shoutouts
30:57 Closing Remarks

What You’ll Learn:
• What achieving FedRAMP 20x Moderate (Class C) actually means
• Why this milestone is important for CSPs and federal agencies
• How FedRAMP 20x is shifting compliance to continuous validation
• The real business impact of faster authorization timelines
• How automation and KSIs replace traditional audit processes
• What makes this approach different from Rev. 5 assessments
• How InfusionPoints approached the 20x journey internally
• What this means for customers looking to enter the federal market
• Why this proves the transition from Rev. 5 to 20x is possible

Resource Links:
https://www.fedramp.gov/rfcs/
FedRAMP 20x Community Update- https://youtu.be/eU0i6c3Yk8o?si=_kbfmhax8BD154Q7

InfusionPoints Links: 
https://xbu40.com/
20x Quick Look Assessment- https://xbu40.com/assessment
20x Webinar Series | Session 1- https://youtu.be/EoaXjGa-vl0?si=UmnDCXY4dhTKpC6L
20x Webinar Series | Session 2 Registration- https://riverside.com/webinar/registration/eyJldmVudElkIjoiNjlkZDUzZmNiNWI5MjQ2YTllY2E0YmUwIiwic2x1ZyI6Imphc29uLXNocm9wc2hpcmVzLXN0dWRpbyJ9
Chad Spears-https://www.linkedin.com/in/chad-spears007/
Tanner Bailey- https://www.linkedin.com/in/tanner-b-37a50a132/
https://www.linkedin.com/company/infusionpoints/
https://infusionpoints.com/

About Us:
InfusionPoints is a cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure environments in highly regulated markets.

We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security, supporting customers from authorization through continuous monitoring.

With a security-first approach, we deliver scalable, compliant solutions that help organizations move faster without sacrificing security.

In this episode of Behind the Shield, Jason Shropshire sits down with cybersecurity founder, author, and industry veteran Andrew Plato for a candid, wide-ranging conversation on what it really takes to build and scale a cybersecurity company.

Andrew shares his journey from accidentally discovering one of the earliest SQL injection vulnerabilities in the 90s to founding and growing a cybersecurity company over 26 years and ultimately exiting after building a successful compliance automation platform. Along the way, he breaks down the hard-earned lessons that most founders learn the hard way, covering everything from business model pivots and scaling challenges to sales strategy and the evolution of compliance in cloud environments.

This episode goes beyond technical security talk and dives into the mindset shifts that separate successful companies from the rest. From why “compliance is miserable” and how automation changed the game, to why customers do not buy products but instead buy pain relief, Andrew offers unfiltered insights that apply to startups, established companies, and anyone navigating today’s cybersecurity landscape.

Whether you are a founder, operator, or part of a growing security team, this conversation will challenge how you think about building, selling, and delivering cybersecurity solutions in a rapidly evolving market.

Chapters:
0:09 Introduction and Welcome
0:59 Andrew's Early Career and SQL Injection Discovery
3:01 Starting a Security Company
5:44 Compliance Automation and AWS Collaboration
10:49 Managed Security and Automation Insights
33:15 The Founder's Dilemma and Business Growth
52:31 Sales Strategies and Credibility Selling
61:21 Closing Remarks

What You'll Learn: 
•  How one of the earliest SQL injection discoveries helped spark a cybersecurity career 
•  The reality of building and pivoting a company over decades 
•  Why compliance has historically been “miserable” and how automation is changing that 
•  The origin and evolution of compliance automation platforms 
•  Why moving customers into standardized environments accelerates security and scalability 
•  The shift from hourly consulting to scalable, subscription-based models 
•  Why customers do not buy products but instead buy pain relief 
•  How to position cybersecurity as removing business barriers, not adding them 
•  The concept of opportunity barriers and how compliance impacts revenue 
•  Why traditional sales approaches like cold calling and product pitching no longer work 
•  The importance of credibility over product features in modern cybersecurity sales 
•  How startups can compete against larger, established players 
•  The biggest mistakes founders make and how to avoid them 
•  Why understanding your customer’s pain is the foundation of growth 
•  How automation and AI are accelerating the future of security and compliance

Guest Links: 
Andrew Plato- https://www.linkedin.com/in/andrewplato/
The Founder's User Manual (Book)- https://www.amazon.com/dp/B0CZXP7TNF/ref=tsm_1_fb_lk
Company- https://zenaciti.com/

InfusionPoints Links: 
Jason Shropshire- https://www.linkedin.com/in/shrop/
https://www.linkedin.com/company/infusionpoints/
https://infusionpoints.com/

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every e

n this episode of Behind the Shield, hosted by Mike Strohecker, the Cloud Operations team at InfusionPoints dives into the realities of vulnerability management in FedRAMP environments.

Mike is joined by Ryan Adcock and James Bolton from the Cloud Operations team, where they support customers operating in FedRAMP High and IL5 environments. Together, they break down what it really takes to maintain compliance through continuous monitoring and why strong vulnerability management practices are critical to keeping an authorization in place.

This conversation goes beyond high-level compliance talk and gets into the day-to-day execution. From running scans and managing vulnerabilities to maintaining accurate inventories and communicating with engineering teams, the group shares what actually happens behind the scenes to keep systems secure and compliant.

They also explore how vulnerability management is evolving. What used to be a monthly exercise is shifting into a continuous, always-on process. With the introduction of Vulnerability Detection and Response, organizations are expected to move faster, respond smarter, and understand their environments at a much deeper level.

If you are a Cloud Service Provider, security professional, or part of a team working toward or maintaining FedRAMP authorization, this episode provides practical insight into what works, what does not, and what is coming next.

Chapters:
0:00 Introduction and Guest Backgrounds
2:35 Vulnerability Management and Compliance
5:24 Continuous Monitoring and Best Practices
12:01 Understanding Customer Environments
17:34 VADR and Continuous Monitoring
23:03 Prevention and Security Improvements
27:15 Communication and Closing Remarks

What You’ll Learn

• What continuous monitoring requires in a FedRAMP environment and how it impacts your daily operations
• The different types of vulnerability scans including OS, database, container, and web application scans
• How Plans of Action and Milestones are used to track and report vulnerabilities
• Key remediation timelines and why meeting them is essential to maintaining authorization
• Why authenticated scans are necessary and where many organizations struggle
• Common challenges when scanning containers and web applications
• The importance of maintaining an accurate asset inventory and avoiding blind spots
• How communication between security and engineering teams improves remediation timelines
• What changes are coming with Vulnerability Detection and Response and continuous scanning expectations
• How automation and risk-based decision making are shaping the future of FedRAMP compliance

InfusionPoints Links:
Mike Strohecker, VP of Engineering and Operations: https://www.linkedin.com/in/michael-strohecker-238326172/
Ryan Adcock, Cloud Operations / Senior Consultant:
https://www.linkedin.com/in/ryanaadcock/
James Bolton,  Cloud Operations / Senior Consultant:
https://www.linkedin.com/in/james-bolton-cyber/
https://www.linkedin.com/company/infusionpoints/
https://www.InfusionPoints.com
https://infusionpoints.com/contact-us

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

In this episode of Behind the Shield, we continue our internship series with a real, behind-the-scenes look at what it’s actually like to start a career in cybersecurity.

Host Felisha Daemer sits down with Levi Church and Ben Collins, two former interns turned full-time Security Operations Analysts, to talk through their journeys from local students to working hands-on in a 24/7 SOC environment.

They share how they found InfusionPoints, what surprised them most stepping into a professional environment, and how quickly things shift from theory to real-world application.

From navigating “acronym soup” on day one to building real solutions during live incidents, including a response to the global CrowdStrike outage, this episode highlights just how impactful hands-on experience can be.

You’ll also hear how InfusionPoints’ rotational internship model exposes interns to multiple teams, including security operations, engineering, advisory, cloud ops, and even marketing, helping them find where they thrive.

And maybe most importantly, why culture, curiosity, and being willing to figure things out matter just as much as technical knowledge.

Whether you’re a student exploring cybersecurity, a hiring manager building an internship program, or just curious how talent actually develops in this space, this episode gives you an unfiltered look.

Chapters: 
0:10 Introduction
0:31 Levi's Introduction
1:23 Ben's Introduction
2:12 Inspiration to Enter the Field
3:40 Internship Experiences
6:50 Advice for Future Interns
8:23 Certifications and Learning
10:24 Culture and Work Environment
15:00 Projects and Achievements
21:15 Fun Questions

What You’ll Learn:
What it’s really like transitioning from cybersecurity theory to hands-on work in a SOC
How internships can shape and sometimes completely change career paths
The value of rotational vs. specialized internship experiences
Why “culture shock” is normal and how to push through it
How small teams create faster learning opportunities and require wearing multiple hats
Building an automated emergency communication system during a major outage
Streamlining internal SOC documentation for faster analyst onboarding
Automating employee bio updates for operational efficiency
Why certifications like AWS Cloud Practitioner, CySA+, and tools like CloudQuest can give you a head start
The importance of continuous learning, curiosity, and problem-solving in cybersecurity
How collaboration across teams (SOC, marketing, engineering, leadership) accelerates growth
What makes a strong intern and what advice current analysts would give to future applicants

InfusionPoints Links: 
Apply to the Internship- https://infusionpoints.com/careers/InfusionPoints-Internship
Felisha Daemer- https://www.linkedin.com/in/felisha-daemer/
Levi Church- https://www.linkedin.com/in/levichurch/
Ben Collins- https://www.linkedin.com/in/benjamincollins001/
https://www.linkedin.com/company/infusionpoints/
https://www.InfusionPoints.com
https://infusionpoints.com/contact-us

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

In this episode of Behind the Shield, Jason Shropshire, InfusionPoints COO, sits down with Matt Bruggeman, Director of GTM Federal at A-LIGN, to explore one of the most unique career paths in the compliance space and how it directly shapes the way he approaches FedRAMP today. Starting in engineering, transitioning into improv comedy, and ultimately moving into sales engineering, Matt brings a perspective that blends technical depth with communication, adaptability, and real-world problem solving.

We dive into the realities of FedRAMP, including the friction points that have challenged CSPs over the last several years, from inconsistent interpretations to long timelines and the operational burden of maintaining authorization. Matt shares firsthand insight into how these challenges have impacted both providers and assessors, and where the industry is starting to shift.

The conversation also unpacks FedRAMP 20x and what it actually means beyond the headlines. We talk about automation, machine-readable evidence, and what organizations need to start thinking about now if they want to keep pace with where the program is going. This isn’t just about moving faster, it’s about fundamentally changing how compliance is approached.

We also touch on CMMC and its growing influence across the defense ecosystem, how it compares to FedRAMP, and why organizations need to think strategically about overlapping requirements and long-term compliance investments.

Throughout the episode, Matt highlights the importance of clear communication, storytelling, and being able to translate complex technical requirements into something actionable, especially in a space that often leans too heavily on jargon and process.

Whether you're early in your FedRAMP journey, actively working toward authorization, or rethinking your approach in light of 20x, this episode offers practical insight, honest perspective, and a look at where compliance is headed next.

What You’ll Learn:

• Matt’s journey from engineering to improv and how it shaped his approach to problem-solving
• The realities of FedRAMP challenges and why the process has been so difficult historically
• How FedRAMP is evolving and what changes are underway
• What FedRAMP 20x actually means and what it requires from organizations
• The impact of CMMC on the broader compliance and defense ecosystem
• Why communication, storytelling, and adaptability matter in technical roles
• Key insights for navigating compliance in a rapidly changing environment

Chapters:

0:00 - Introduction to the Podcast
0:29 - Meet Matt Bruggeman
1:16 - Matt's Engineering Background
2:13 - Transition to Improv Comedy
4:04 - Sales Engineering Journey
6:02 - Joining A-LIGN and FedRAMP
11:01 - FedRAMP Challenges and Changes
17:12 - CMMC and Industry Impact
23:33 - FedRAMP 20X Discussion
47:43 - Lighter Fare and Closing

If you’re building, managing, or defending in regulated environments, make sure to subscribe for more conversations like this.
Interested in learning more about FedRAMP 20x? Join our FedRAMP 20x Explained webinar on April 2nd at 1 PM EST: https://xbu40.com/20x-cohort 

Guest Links: 
Matt Bruggeman Linkedin: https://www.linkedin.com/in/matt-bruggeman/
A-LIGN- https://www.a-lign.com/
Mostly Compliant Podcast- https://www.youtube.com/playlist?list=PLLU5Lb_V9iSyFhftOkbrOE_y0DVAvDmO4
Sooper Doods- https://www.youtube.com/@SooperDoods

InfusionPoints Links: 
Jason Shropshire, COO- https://www.linkedin.com/in/shrop/
https://www.linkedin.com/company/infusionpoints/
https://www.InfusionPoints.com
https://infusionpoints.com/contact-us