Dave M. Brown

Experience

20+ years across infrastructure, cybersecurity, and compliance

A builder, from early stage startups to global enterprises. I have built cybersecurity, compliance, and risk programs from the ground up twice. Before that, I ran data center and network operations and led infrastructure teams of 20 to 50 engineers through mergers, outsourcing, and offshore restructuring. I speak both languages, which is why engineers, operators, and auditors all trust the programs I build.

Download my resume (PDF) View resume For recruiters

Employer names and references available on request.

  1. Multi site data center provider 2017 to 2026

    A growth stage data center company in the Southeast. I joined as an early team member and stayed through nine years of growth.

    Director, Security & Compliance

    2019 to 2026 · Greater Atlanta Area

    Reported to the COO. Accountable for cybersecurity, physical security, compliance, risk, and a multimillion dollar annual security spend across a growing multi site data center portfolio.

    Security operations & resilience

    • Led cybersecurity with zero major security incidents across nine years of program ownership.
    • Implemented company wide SOC as a Service with XDR and SIEM coverage that contained the impact of 100+ phishing and human error incidents over five years.
    • Cut repeat phishing prone behavior 75% in 10 months with targeted, automated awareness training and stronger reporting.
    • Established the Emergency Incident Response Team and Business Continuity Plan, leading crisis management, IR, DR, vulnerability management, penetration testing, and tabletop exercises.

    Incident & change management

    • Owned the incident and change management policies and processes, and served as incident commander for all customer facing incidents, running escalation plus customer and internal communication.
    • Accountable for both IT incident management and security incident response, which ran as separate processes.
    • Ran the weekly Change Advisory Board with every department manager. Whoever executed a change attended to walk through its Method of Procedure and backout plan. An emergency CAB handled urgent fixes, never a missed change request.
    • Reviewed every Method of Procedure across IT, network, and facility power and cooling work, including every change affecting customers.
    • Ran a post incident review and root cause analysis for every incident, with fixes fed back into MOPs and SOPs.
    • No change or incident management exceptions across eight consecutive SOC 2 Type II reports.

    Data center, physical & OT security

    • Designed a defense in depth physical security Basis of Design for 10 new data centers, the standard for budgeting, RFPs, commissioning, and site audits across eight production facilities.
    • Set security standards for data center operational technology: network segmentation, secure vendor access, and tightly controlled SCADA access.

    Audit & compliance

    • Built and scaled the security and compliance program, sustaining eight consecutive years of clean SOC 2 Type II reports.
    • Implemented NIST SP 800-171 controls, scoring 109 of 110 in an independent assessment, with the SSP and POA&M managed in house. This created a repeatable base for CMMC readiness in CUI environments.
    • Supported enterprise, healthcare, and government contractor customers through SOC 2 Type II, HITRUST e1 certification, HIPAA BAA, and NIST 800-171 capabilities.
    • Moved compliance from manual evidence collection to an automated GRC platform, saving about 90 hours of audit prep.

    Risk, data & AI governance

    • Built monthly risk and control reporting for the COO and cut vulnerability mean time to remediate to under one month.
    • Wrote and managed the records retention policy and schedules with outside counsel, ran legal holds and searches, and owned data classification for DLP.
    • Wrote the AI usage policy and AI security risk review process, and led a restricted enterprise LLM pilot with contract and data handling review, usage logging, and phased system access. It later expanded company wide.

    Customers & commercial

    • Served as the customer facing security and compliance leader across RFPs, due diligence, audits, sales cycles, and major contracts, meeting with hundreds of customers and investors.
    • Negotiated contracts and service terms worth about $800K in vendor savings over three years, partnering with Legal on vendor and customer agreements.

    Director, Network & Data Center Operations

    2017 to 2019 · Greater Atlanta Area

    Early team member who ran network and data center operations while the company built its first purpose built facility and set its operating model across IT, network, data center, security, and service delivery.

    • Designed the company's initial operating processes across corporate IT, network, data center, security, and service delivery.
    • Launched the company's first SOC 2 program, with controls, evidence collection, and audit readiness, before a compliance team existed. Earned a Type 1 report in six months, then clean Type II reports every year.
    • Authored baseline cybersecurity standards, the security architecture, and the Disaster Recovery Plan. Built ITIL service delivery, writing the incident and change management policies and processes and standing up a formal Change Advisory Board.
    • Added NOC as a Service for 24x7 monitoring and incident management, cutting employee ticket fatigue 80% in six months.
    • Wrote SOPs and Methods of Procedure that reduced operator errors during maintenance and created auditable records.
    • Helped design and commission the company's first purpose built data center, from concept through production.
  2. Global SaaS and software services company 2016 to 2017

    Vice President, Global IT Infrastructure

    Atlanta, GA

    Reported to the CEO. Led geographically distributed hybrid cloud SaaS infrastructure through post merger consolidation, with 50+ engineers and a budget over $2.5M.

    • Functioned as CISO, led ISO 27001 recertification, and cut more than a dozen SOC 1 Type 2 exceptions to zero in the next report.
    • Reduced AWS spend about $25K a month through better cloud configuration and security optimization.
    • Reinvested the savings in Disaster Recovery as a Service with a 15 minute RTO and RPO at no added cost.
    • Restructured offshore teams and ITSM processes, raising customer satisfaction 80% and cutting unplanned outages 90% in 10 months.
  3. Global IT outsourcing provider 2015 to 2016

    Director, IT Infrastructure & Operations

    Atlanta Metropolitan Area

    Operational lead for IT operations and service management after the industrial enterprise below outsourced its IT and rebadged the team. Led 35+ subject matter experts and technical specialists.

    • Directed the yearlong transition of data center, network, security, Service Desk, and ITSM operations to the provider's hosted IaaS and PaaS environments.
    • Turned around an underperforming Service Desk, raising SLA compliance and first call resolution 35%+ in two months and holding the gains for 10 months.
    • Moved change, incident, and problem management to the provider's standards across four data centers and 240 remote locations.
  4. Global industrial enterprise, North American IT 2011 to 2015

    Director, IT Infrastructure & Operations

    Alpharetta, GA

    Accountable for IT service operations, infrastructure, and transformation planning across four North American data centers. Led 2 managers and 18 senior engineers supporting 9,000+ users at 240+ locations.

    • Built and led ITIL incident and change management as the accountable owner across four data centers, 240+ locations, and 9,000+ users, writing the policies and processes.
    • Served as incident commander for major incidents, running escalation plus customer and internal communication, with a post incident review and root cause analysis for every incident.
    • Ran the weekly Change Advisory Board and the emergency CAB. Every change was presented with its Method of Procedure and backout plan by the person executing it.
    • Reduced MPLS WAN outages across 240 locations 35%+ in one year through vendor performance management and service improvement plans.
    • Implemented a cloud based resource and project management tool that raised project and service request revenue 25%.
    • Partnered with North American and global leadership to adopt a service based IT operating model across several operating companies.
    • Led infrastructure and operations through a global outsourcing transformation and the design of a future state shared services organization.
  5. Earlier career Before 2011

    Hands on IT infrastructure, network, and operations roles that built the technical foundation for everything above.

If you hire me

My first 90 days as your security leader

Learn the business first, then measure a security baseline and agree a short list of priorities with leadership, then deliver visibly against that baseline. Sequence matters more than a long list of fixes.

Understand the business

You can't protect what you don't understand, so I start where my scoping approach starts.

  • Follow the revenue: which products generate revenue, how they're delivered, and which systems keep them running.
  • Follow the data: what critical data the company holds, where it's stored, how it moves, and who can access it.
  • Know what's been promised: the security commitments in customer contracts and the regulations that apply.

Listen and assess

  • Meet each security team lead, engineering and product leaders, and a sample of customers.
  • Review audit reports, open risks, recent incidents, the vendor list, and the AI tool inventory.
  • Learn how engineering ships and how operations runs before changing anything.
Deliverable: a map of revenue systems and critical data, plus what's working, what's at risk, and the questions still open.

Set the baseline

Measure where things stand before promising improvements, so every later result has a starting point.

  • Third party risk assessment: inventory critical vendors, review their security reports and contracts, and rank them by the data and access they hold.
  • Vulnerability testing: authenticated scans across endpoints, servers, cloud, and internet facing systems, with findings ranked by risk.
  • Internal and external penetration testing: an independent test of what an outside attacker can reach, and how far someone already inside the network could move.

Set priorities

  • Share a short, honest risk picture with the CEO and leadership team, built on the baseline findings.
  • Agree on the top three or four priorities, their owners, and how progress will be measured.
  • Confirm the audit calendar and the scope boundary for each framework.
Deliverable: a measured security baseline (vendor risk rankings, vulnerability counts and fix times, and penetration test findings), a one page risk picture, and agreed priorities.

Start delivering

  • Launch the first priorities with clear owners.
  • Put an AI governance process in place covering data handling, human oversight, and auditability.
  • Start a regular risk report for leadership that tracks vendor risk, vulnerability fix times, and pen test remediation against the baseline, so progress is visible every month.
Deliverable: the first monthly risk report, showing progress against the baseline and on agreed priorities.

Security operations scope

SOC as a Service with SIEM and XDR, quarterly IR and DR testing, vulnerability management, penetration testing, identity and endpoint security, cloud security optimization.

OT & physical security

Security standards for data center operational technology: network segmentation, secure vendor access, and tightly controlled SCADA access.

Tools and platforms

Drata, SentinelOne, Sophos, Tenable, Microsoft Intune, Microsoft Entra ID, Hoxhunt, ArmorPoint SIEM, Cynet XDR, Jira, ITIL.

Education & credentials

Coursework in Technology Management and Computer Engineering, Southern Polytechnic State University. ITIL v3 Foundation certified. CISSP and CISM exams targeted for Q1 2027.

NextGet in touch →