Dave M. BrownResults
Outcomes I can defend in a reference call
20+ years across infrastructure, cybersecurity, and compliance. Most recently, I was an early team member (employee number five) at a growth stage data center company, where over nine years I built its security, compliance, incident response, and resilience programs from the first policy on. Open any number to see the story behind it.
The story
I launched the first SOC 2 program before a compliance team existed: controls, evidence collection, and audit readiness. We earned a Type 1 report in six months, then kept the Type II clean every year as sites were added, by tying scope to the services customers bought and moving evidence into a GRC platform.
The story
Government contractor customers needed a CUI ready environment. We implemented the 110 requirements and ran the System Security Plan and POA&M ourselves. An independent assessor scored it 109 of 110, giving those customers a repeatable base for CMMC readiness.
The story
Generic annual training wasn't changing behavior. I moved to a next generation program with targeted, automated training based on each person's own mistakes, plus easier reporting of suspicious email. Requirements applied to leadership too. Repeat mistakes fell 75% over 10 months.
The story
Training lowers the click rate; it never reaches zero. SOC as a Service with SIEM and XDR coverage caught and contained what still got through. Training and detection together are a layered defense: you need both.
The story
No single control gets you there. It took layers: 24x7 detection and response, quarterly incident and disaster recovery scenario tests, monthly automated backup restores, vulnerability management, penetration testing, and an Emergency Incident Response Team that knew its role.
A major incident here means any security incident that required notifying customers, regulators, or law enforcement. There were none.
The story
I led vendor risk assessments and negotiated contracts and service terms, partnering with Legal on vendor and customer agreements. Running the security review and the negotiation together meant better terms and clear security commitments in the same contract.
The story
I built a monthly risk and control report for the COO showing open vulnerabilities, how fast we fixed them, and which compliance areas were underperforming. Once leaders could see the trend, decisions came from facts, and mean time to remediate dropped under a month.
The story
I wrote a defense in depth physical security Basis of Design that every new site followed. It became the standard for budgeting, RFPs, commissioning, and site audits, so security was designed in from the start instead of added later.
What others say
From people I've worked with
Dave is an amazing security and compliance officer with great technical, risk and personal skills. He is down to earth with a good sense of humor and still a strong leader to get the job done the right way. Dave manages risk, business and operations in an efficient way, making it easy to work with, bounce ideas around and identify best strategies. I can highly recommend him for any organization that is looking for someone to make a change in the right direction while balancing business operations, security and compliance.
Leadership stories
Four situations, and what I did
The numbers show what happened. These show how I lead when the right answer isn't the easy one.
Holding the line on security training
- Situation
- Some senior leaders, including the CEO, weren't completing required security awareness training.
- Action
- I didn't relax the requirement or chase people one by one. I added it to the employee handbook everyone signs each year, and automated a report of non completions to HR so managers could follow up.
- Result
- The requirement applied to everyone, including leadership, and the process did the enforcing instead of me.
Rescoping a checkbox ISO 27001 program
- Situation
- At a SaaS company, I joined an ISO 27001 program that applied every control to every department. After certification, basic controls like change management, incident response, and disaster recovery had lapsed.
- Action
- With the CEO's backing, I narrowed the scope to the systems, services, and people that deliver the product, and spent six months rebuilding the program from the top down.
- Result
- Controls with real owners who understood why they mattered. I led the ISO 27001 recertification and cut more than a dozen SOC 1 Type 2 exceptions to zero in the next report.
Saying yes to AI, with conditions
- Situation
- Leadership wanted an enterprise AI tool quickly, before the controls around it were ready.
- Action
- I approved a pilot with restrictions: local files only, no system connections, and no data shared with the provider. I confirmed in the contract that the provider couldn't train on our data, wrote the AI usage policy, and turned on usage logging. When leadership wanted to connect it to Microsoft 365 right away, I held that connection until IT had secured M365.
- Result
- The business got the tool, the data stayed protected, and the pilot expanded company wide with phased system access.
Try the same approach on your own AI tool: AI tool risk triage.
Across the table from a customer's security team
- Situation
- A fiber customer reviewed the security of one of our cable landing stations. Those facilities fall under strict government oversight, and the customer carried compliance obligations of its own, so it had every reason to look closely.
- Action
- As the person accountable for the facility's security, I walked them through our controls and evidence directly instead of handing off a questionnaire. Separately, I automated our questionnaire and RFP responses with our GRC tools to free time for conversations like this one.
- Result
- Customers saw how we actually worked. I led conversations like this with hundreds of customers and investors across RFPs, due diligence, and audits.
Earlier in my career
Results from infrastructure and operations leadership
Before the data center company: global SaaS infrastructure, enterprise data centers, and IT operations across 240+ locations.