Behind the Shield

What does an internship at InfusionPoints actually look like, and what can it lead to?

In this episode of Behind the Shield, Tanner Bailey sits down with former interns Rachael Smith and Aidan Fratcher, who are now full-time members of the InfusionPoints team, to talk about their journey from students to professionals in cybersecurity, compliance, and cloud.

They share how they first connected with InfusionPoints, what made the internship experience stand out, and what it was like to move through the rotational internship program across multiple teams. From shadowing engineers and SOC analysts to learning cloud operations and advisory work, this conversation gives an inside look at how interns gain real exposure to the business, technology, and culture behind the work.

Rachael and Aidan also discuss the projects their internship cohorts completed, including real-world automation concepts inspired by operational needs, and reflect on how those experiences helped shape their careers. The episode also dives into advice for students, career changers, and future interns on staying curious, continuing to learn, using AI tools wisely, and standing out in a fast-changing industry.

Whether you are exploring cybersecurity careers, interested in the InfusionPoints internship program, or just want a candid look at how early career talent can grow into impactful team members, this episode is packed with helpful perspective.

Chapters: 

00:08 Welcome and Episode Overview
00:37 Interns' Backgrounds and Interests
02:54 Application Process and Networking Tips
05:26 Infusion Points' Culture and Learning Focus
08:21 Day in the Life of an Intern
09:58 Rotational Program and Team Exposure
12:34 Real-World Projects and Automation Solutions
18:30 Cross-Department Collaboration and Crisis Handling
33:31 Advice for Aspiring Cybersecurity Professionals
42:52 Fun Questions and Closing Thoughts

What You'll Learn:

• How Rachael and Aidan found the InfusionPoints internship program
• What the application and interview process was like
• What a day in the life of an InfusionPoints intern looks like
• How the rotational program exposes interns to engineering, cloud operations, advisory, and security operations
• Real internship project examples and how they created value for the company
• Why culture, curiosity, and initiative matter in cybersecurity careers
• Advice for students and early career professionals entering the field
• A few fun closing questions, including favorite snacks, movies, and shows

InfusionPoints Links: 
https://infusionpoints.com/careers/InfusionPoints-Internship
Tanner Bailey, Senior Consultant: https://www.linkedin.com/in/tanner-b-37a50a132/
Rachael Smith, Consultant: https://www.linkedin.com/in/rachael-n-smith/
Aidan Fratcher, Consultant: https://www.linkedin.com/in/aidanfratcher/

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

FedRAMP modernization is moving quickly, and one of the newest developments is the introduction of FedRAMP Public Notices. In this episode of Behind the Shield, the team explains what these notices are, why the FedRAMP PMO created them, and what they reveal about the future direction of FedRAMP 20x.

Public Notices serve as a formal communication channel that provides transparency and a chronological record of key program updates. Instead of relying on blogs or scattered announcements, the FedRAMP Public Notices page offers a centralized place where industry stakeholders can track developments, including outcomes from Requests for Comment (RFCs), operational updates, and emergency directives.

During the conversation, the team walks through the first seven FedRAMP Public Notices and discusses what they mean for Cloud Service Providers (CSPs), assessors, and advisors navigating the evolving FedRAMP ecosystem. They highlight outcomes from recent RFCs, including updates to authorization terminology, changes to the FedRAMP Marketplace, and how the program is responding to industry feedback.

The episode also explores operational updates such as quarterly security inbox testing requirements and the role of emergency directives that may require CSPs to respond quickly to vulnerabilities.

The conversation also touches on the broader FedRAMP 20x modernization effort, including the push toward automation, machine-readable evidence, and reducing barriers to entry for cloud providers supporting federal customers.

Chapters:
00:08 Understanding FedRAMP Notices and Their Importance
03:09 Navigating FedRAMP Notices
05:55 Understanding Security Assessments
08:12 Changes in Authorization Designations
10:59 Marketplace Updates and CSP Pathways
13:50 Emergency Directives and Testing Procedures
17:24 Leveraging External Frameworks for Certification
28:35 Conclusion and Future Outlook
30:09 Update: RFC-0023 Notice added
34:14 Alternate Intro Outtake


What You’ll Learn:

• What FedRAMP Public Notices are and why the FedRAMP PMO introduced them
• Key updates and initial outcomes from RFC 19, RFC 20, RFC 21, and RFC 22
• The shift toward FedRAMP Certified designations and new class-based certification levels (A–D)
• New security inbox monitoring and quarterly testing expectations for Cloud Service Providers (CSPs)
• How FedRAMP may begin leveraging external frameworks like SOC 2 Type II
• What these changes signal about the future direction of FedRAMP 20x and cloud authorization modernization

Links to visit: 
https://www.fedramp.gov/notices/

InfusionPoints Links: 

Jason Shropshire, COO- https://www.linkedin.com/in/shrop/
Mike Strohecker, VP of Engineering and Operations: https://www.linkedin.com/in/michael-strohecker-238326172/
Tanner Bailey, Senior Consultant/FedRAMP 20x Lead: https://www.linkedin.com/in/tanner-b-37a50a132/

https://www.linkedin.com/company/infusionpoints/
https://www.InfusionPoints.com
https://infusionpoints.com/contact-us

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

Government contracting can feel overwhelming, with complex regulations, countless tools, and uncertainty about where to begin. In this episode of Behind the Shield, host Felisha Daemer is joined by Jeff Bivens of InfusionPoints and Nick Bernardo, President of MyGovWatch.com, to explore how businesses can enter and succeed in the government marketplace without overcomplicating the process.

Nick shares how MyGovWatch bridges the gap between low-cost but ineffective lead tools and expensive enterprise platforms, helping organizations identify the right opportunities without unnecessary complexity. The conversation covers how contracting works across federal, state, and local levels, how to build sustainable pipelines, and why reverse engineering your business development strategy is key.

They also discuss the real value of AI in opportunity matching, how subcontracting opens doors for new entrants, and common myths that hold companies back. Whether contracts are your primary focus or a supplemental revenue stream, this episode offers practical guidance to help you pursue opportunities strategically and confidently.

Chapters:
[0:00] Introduction and Guest Introduction
[0:26] How We Met and Introduction to MyGovWatch
[1:42] The Goldilocks Analogy and Target Users
[3:42] Comparison with Competitors and Bid Notification
[6:08] Customer Success Story
[7:44] Advice for Contractors
[10:12] GovWatch Coverage and AI Utilization
[16:16] Government Contracting Lifecycle
[20:08] Subcontracting Opportunities
[25:11] Common Myths in Government Contracting
[28:54] Fun Questions and Closing Remarks


What You’ll Learn:

• How to identify the right government opportunities without expensive enterprise tools
• Why reverse engineering your BD strategy saves time and resources
• The difference between federal, state, and local contracting pipelines
• When subcontracting is a smarter entry point than prime contracting
• How AI and smart data curation improve opportunity matching
• Common government contracting myths and what is actually true
• Ways to build relationships and position your company before an RFP is released
• How open records requests can reveal teaming and subcontracting opportunities
• Practical advice for companies adding government work as a supplemental revenue stream

Book Recommendations: 
The Millionaire Next Door -  Thomas J. Stanley, Ph.D. and William D. Danko, Ph.D.
The First 90 Days - Michael D. Watkins
The Grit Factor: Courage, Resilience, and Leadership in the Most Male-Dominated Organization in the World - Shannon Huffman Polson 
Lean In: Women, Work, and the Will to Lead -  Sheryl Sandberg

Guest Links: 
Nick Bernardo: https://www.linkedin.com/in/nickthegovconguy/
https://www.mygovwatch.com/

InfusionPoints Links: 
Felisha Daemer: https://www.linkedin.com/in/felisha-daemer/
Jeff Bivens: https://www.linkedin.com/in/jeffbivens/
https://www.linkedin.com/company/infusionpoints/
https://www.InfusionPoints.com
https://infusionpoints.com/contact-us

About Us:
InfusionPoints is a trusted cybersecurity, cloud engineering, and compliance partner helping organizations Build, Manage, and Defend secure, mission-ready environments in highly regulated markets.
We specialize in FedRAMP, FedRAMP 20x, DoD, and enterprise security frameworks, supporting organizations from initial authorization through continuous monitoring and optimization. Our team brings deep technical expertise and real-world operational insight to every engagement.
Through our independent, security-first approach, we integrate people, processes, and technology to deliver scalable, compliant, and resilient solutions. From strategy and architecture to operations and defense, we help customers move faster without sacrificing security.

In this episode of Behind the Shield, Chad Spears (Director of Security Operations at InfusionPoints) sits down with Michael Wingler, VP of IT & Operations / CIO at Wilkes Community College, to talk about a reality more schools are facing: community colleges are targets now.

Michael shares what’s changed in the threat landscape, why attacks love nights, weekends, and holidays, and how limited budgets and staffing make higher-ed security uniquely challenging. They dig into real-world lessons learned from close calls, vendor/partner risk, and why you can’t rely on “8–5 security” when threat actors work 24/7.

You’ll also hear what’s working: building a strategic IT program that earns a seat at the leadership table, leveraging security awareness training (including measurable phishing-rate improvements), and partnering locally for 24/7 monitoring and response.

If you work in higher ed, SLED, or IT/security leadership, this one hits home.

🔔 Subscribe for more conversations on cybersecurity, leadership, and real-world security operations.

Links / resources

InfusionPoints: www.InfusionPoints.com

Wilkes Community College: www.WilkesCC.edu

#Cybersecurity #HigherEd #HigherEdIT #SLED #ITLeadership #SecurityAwareness #Phishing #SOC #MDR #BehindTheShield #InfusionPoints #WilkesCommunityCollege

Go Behind the Shield with a special 3-segment episode, hosted by Jason Shropshire, featuring members of the InfusionPoints engineering team as they break down what they’re building, how they’re building it, and the lessons learned along the way. Recorded after hours during Hackathon week, this one’s a little less buttoned-up in the best way. Expect real talk, real lessons, and a few laughs as the engineers unwind.

Segment 1: Meet Chris Eaves and Gavin Blankenship from R&D as they share how they found InfusionPoints, what it’s like building in a “jack-of-all-trades” environment, and how Command Center became a purpose-built, opinionated GRC platform designed to make complex compliance (FedRAMP, DoD, and more)- manageable without relying on someone else’s roadmap.
They also talk roadmap highlights like automated user onboarding, incident response tracking, and a behind-the-scenes look at building a deployment pipeline to scale Command Center across environments.

Segment 2: Kay and Mike Strohecker join to talk life on the dev team, what Kay’s working on now (vulnerability + asset management), and what it’s like ramping up in the world of acronym soup—especially in the era of FedRAMP 20x. Plus: Hackathon reality check (no sleeping bags required).

Segment 3: Caleb Brinkley (backend) and Matthew Melang (frontend) share what they focus on day-to-day in Command Center, how cross-functional hackathon teams spark better ideas, and how automation (including tools like Power Automate + Teams workflows) can eliminate repetitive work across the business.

And yes… there’s a legendary story about AWS Bedrock, throttling, and an accidental “stress test” you don’t want to recreate.

🎧 Topics covered:

Command Center as a “one pane of glass” for compliance + security operations

FedRAMP 20x and the growing importance of KSIs

Continuous monitoring automation + customer feedback loops

Infrastructure + serverless architecture (Python, AWS services, Terraform)

Hackathon builds: onboarding automation, back-office workflows, and more

Lightning round essentials: dark mode, tabs vs spaces, and dev playlists

👍 Like, subscribe, and follow along for more real-world engineering + security conversations from the InfusionPoints team.

#BehindTheShield #InfusionPoints #Cybersecurity #Engineering #FedRAMP #FedRAMP20x #GRC #CloudSecurity #DevOps #AWS

What happens when you treat AWS Marketplace like real commerce, not a static listing page?

In this episode of Behind the Shield, Gary Daemer and Jason Shropshire sit down in North Wilkesboro with Trés “Trey” Vance, Executive Chairman of CloudSmart, to talk about the business mechanics behind modern cloud go-to-market: marketplace analytics, private offers, channel partner private offers, and why co-sell is the difference between “we built something” and “we built a business.”

Trey shares the origin story behind CloudSmart (starting with AMIs and “steak dinner money”), why marketplace reporting has historically been harder than it should be, and how CloudSmart Insights helps sellers understand who’s buying, why they’re buying, and what’s actually working. The conversation also dives into newer marketplace realities, including multi-product solutions and bundles, marketplace APIs, CRM integrations (Salesforce and HubSpot), and the coming wave of AI listings that may force everyone to rely on smarter search and better data.

You’ll also hear how InfusionPoints and Trey first connected through the early ATO on AWS days, why focus versus “we do every cloud” matters, and how rural North Carolina tech teams can absolutely compete with the biggest hubs without inheriting the traffic.

Topics covered:

Marketplace intelligence: payouts, customers, intent, trends

Public offers vs. private offers and why 95%+ of transactions are private offers

Co-sell vs. go-to-market and why it changes customer acquisition cost

Marketplace APIs and CRM connectors to eliminate swivel chair operations

Multi-product solutions: bundling software, services, and security tools

Usage-based pricing and making buying frictionless

Building tech talent pipelines in rural communities

🎧 Watch and listen to the full episode and drop your questions in the comments.

In this episode of Behind the Shield, host Gary Daemer sits down with Andrea Livero-Scott, Director for Cybersecurity at Kratos Defense & Security Solutions, to unpack what is changing across FedRAMP and why the shift to FedRAMP 20x is more than a process update.

We cover:

The biggest FedRAMP pain points from the last 4–5 years (timelines, reviewer interpretation, package churn)

The real differences between civilian and DoD authorization paths

FedRAMP 20x: automation readiness, KSIs, and what “faster” really requires

Machine-readable evidence and the questions agencies and assessors still need answered

The sponsorless pathway and what it could unlock for commercial providers

Where AI fits, including why agentic AI starts to look like an insider threat

Subscribe for more conversations on compliance, cloud security, automation, and what it takes to build, manage, and defend in regulated environments.

www.InfusionPoints.com

FedRAMP 20x is moving fast and in this episode of Behind the Shield, host Gary Daemer  and co-host Chad Spears break down what it actually looks like to go from Phase 1 pilot to Phase 2 production-ready thinking.
We cover the real shift happening right now from “is the thing there?” to “is the control effective?” plus how KSIs, continuous and persistent validation, and machine-readable evidence are changing the game for CSPs, 3PAOs, and agencies.
In this episode, we discuss:
What FedRAMP 20x Phase 2 changes and why it feels like crawl, walk, run
How trust is built by showing how evidence is pulled, not just what it is
Why continuous and persistent checking matters and how it prevents configuration drift
Machine-readable evidence, faster audits, and faster time to market
Transparency through Trust Centers and public-facing security status
What CSPs should do next including cloud-native readiness and API integration
The evolving role of 3PAOs and verifying automated compliance
How a Build | Manage | Defend mindset supports the future of FedRAMP
If you are navigating FedRAMP, modern compliance automation, or want a clearer picture of where 20x is headed, this episode is for you.
Links and Resources
Learn more about InfusionPoints: www.InfusionPoints.com
FedRAMP 20x resources: https://www.fedramp.gov
Contact us: https://app.hatchbuck.com/OnlineForm/53273431050
 
#FedRAMP #FedRAMP20x #ComplianceAutomation #ContinuousMonitoring #CloudSecurity #GRC #ATO #3PAO #GovCloud

Building talent is part of building secure systems.
In Episode 1 of our 3-part Internship Series, host Felisha Daemer sits down with Tanner Bailey (former InfusionPoints intern turned Internship Coordinator) to unpack how we develop the next generation of cybersecurity and cloud professionals through a rotational program across Advisory, Cloud Ops/Engineering, and a 24x7 SOC.
If you are not looking for an internship, this episode is still for you. You will hear:
How we scale delivery without sacrificing quality or customer outcomes
Why fresh eyes and repeatable processes improve security and operations
What it takes to cross-train teams in a real-world cloud security services org
How we assess “Hungry, Humble, Smart” and why that matters in high-trust environments
Lessons learned from turning interns into contributors who ship meaningful work
You will also learn:
How the rotational program is structured and what interns do day to day
The certification and training paths we support (AWS Cloud Practitioner, Solutions Architect, Security Ops)
How evaluations work and what the path to full-time can look like
Interested in applying or sharing with someone who should?
Website: InfusionPoints.com/careers (internships link at the bottom)
Email: [email protected]
Meet us in person:
App State Career Fair: January 28, 2026
App State Cyber Summit: April 9 to 10, 2026 (booth + sponsoring the social hour)
Subscribe for Part 2 and Part 3, where we hear directly from past interns about what they built, learned, and how they leveled up.
#CloudSecurity #Cybersecurity #SOC #AWS #GovCloud #FedRAMP20X #Leadership #TalentDevelopment #BehindTheShield #InfusionPoints

In this episode, hosts Mike Strohecker and Jason Shropshire sit down with Rob Hughes, CISO of RSA, for a deep dive into identity security, FedRAMP Rev 5, and emerging AI risk.

Rob shares his journey into the CISO role and how RSA has evolved from its early days of hardware tokens into a modern, cloud focused identity provider. The conversation covers real world lessons from RSA’s FedRAMP authorization experience, including navigating the JAB process, operating during the shift to remote work, and balancing compliance requirements with meaningful security outcomes.

The group also explores what FedRAMP Rev 5 changes actually mean for identity, phishing resistant authentication, and passwordless approaches, as well as how FedRAMP is moving toward more outcome driven security models. Rob offers candid insight into how these changes affect both federal and commercial environments.

The discussion wraps with a practical look at AI risk, including data leakage, shadow AI usage, and why identity and zero trust principles are becoming even more critical as AI tools become part of everyday workflows. A lightning round at the end adds a lighter close to the conversation.

Topics covered include:

Rob Hughes’ path to CISO and RSA’s identity evolution

FedRAMP Rev 5 and phishing resistant authentication

Lessons learned from the FedRAMP JAB process

Identity as the modern security perimeter

AI risk, data exposure, and shadow AI concerns

Lightning round questions

Subscribe for more conversations on cloud security, compliance, and the people behind the programs shaping federal and enterprise cybersecurity.

#FedRAMP  #CloudSecurity #FedRAMPRev5 #identitysecurity