Dave M. BrownCybersecurity & operations
Security that holds up under attack, not just under audit
20+ years in infrastructure and security. Compliance reports prove the controls exist. My job was making sure they worked when something real happened. I ran detection and response, vulnerability management, endpoint and identity security, and incident response for a multi site data center company, and before that I ran the data centers and networks themselves.
Defense in depth
The layers I built and ran
No single control stops everything. Each layer assumes the one before it will sometimes fail.
Detection & response
Company wide SOC as a Service with SIEM and XDR coverage, monitored 24x7. Automated threat detection and response contained the impact of more than 100 phishing and human error incidents over five years.
Endpoint & identity
Endpoint protection with SentinelOne and Sophos. Device management and identity through Microsoft Intune and Entra ID. Security architecture and baseline cybersecurity standards written from the first facility on.
Vulnerabilities & testing
Continuous scanning with Tenable, regular penetration testing, and a monthly risk report that showed leadership open findings and fix times. Mean time to remediate stayed under a month.
People
Targeted, automated phishing training based on each person's own mistakes, with easy reporting. Repeat mistakes fell 75% in 10 months, and the requirement applied to leadership too.
Incident response & resilience
Established the Emergency Incident Response Team and Business Continuity Plan. Quarterly incident and disaster recovery scenario tests, tabletop exercises, and crisis management.
Third parties & AI
Security review for vendors and new AI tools before they touch company data: contract terms, data handling, access scope, and usage logging.
Walk through it
One phishing email, five layers
Training lowers the click rate. It never reaches zero. Here is how the layers worked together when an email got through.
A convincing email reaches an inbox
Some always do. A program that depends on every email being blocked, or every person spotting every lure, has already failed. The design question is what happens next.
The person is the first sensor
Training built on each person's own past mistakes means most people recognize the lure and report it in one click. A report is worth more than a delete: it tells the team the campaign exists.
If someone clicks, the endpoint is watching
Managed devices with endpoint protection and XDR flag the behavior that follows a bad click, and managed identity limits what a stolen session can reach.
The SOC contains it
SIEM and XDR signals go to a 24x7 SOC as a Service, which investigates and contains before a mistake becomes a breach.
Close the loop
The person gets targeted follow up training, the incident feeds the monthly risk report, and the pattern shows up in the next quarterly tabletop. Each incident makes the next one less likely.
Practice the decisions yourself: run the phishing tabletop, or the ransomware one.
Data center, physical & OT security
Security designed in before the concrete is poured
Data centers are where cyber and physical security meet. A badge reader, a building controls network, and a vendor's remote session are all paths to customer equipment.
Physical security Basis of Design
I wrote the defense in depth physical security Basis of Design (BOD) that every new site followed, 10 new data centers in all. It became the single standard for:
- Budgeting security into each build from day one
- Construction and equipment RFPs
- Commissioning, so controls were verified before customers moved in
- Site audits across eight production facilities
The result: security that was consistent from site to site and designed in rather than bolted on, which made every SOC 2 audit and customer site visit easier.
Operational technology
Data centers run on power, cooling, and building control systems. I set the security standards for that operational technology:
- Network segmentation between OT and corporate systems
- Secure, controlled remote access for vendors
- Tightly controlled SCADA access
Critical infrastructure
I was accountable for security at a cable landing station under strict government oversight, and walked customers' security teams through its controls and evidence directly.
Try the decisions yourself: the visitor in the data hall or the 2 AM vendor session.
Data center operations
I ran the infrastructure before I secured it
Before leading security, I led the network and data center operations teams. That is why my controls fit how operations actually works: change windows, maintenance, and 3 a.m. outages included.
Built a data center company's operations
As Director of Network & Data Center Operations, I was on the early team that designed and commissioned the company's first purpose built data center, from concept through production, and set its operating model across IT, network, data center, security, and service delivery.
Monitoring and discipline
Added NOC as a Service for 24x7 monitoring and incident management, cutting employee ticket fatigue 80% in six months. Built ITIL service delivery with a formal Change Advisory Board, and wrote SOPs and Methods of Procedure that reduced operator errors during maintenance.
Security from the first facility
In the same role I wrote the baseline cybersecurity standards, the security architecture, and the Disaster Recovery Plan, and launched the first SOC 2 program before a compliance team existed: a Type 1 report in six months, then clean Type II reports every year.
Enterprise data centers at scale
Earlier, I ran infrastructure and operations across four North American data centers and 240+ locations serving 9,000+ users, and led the yearlong transition of data center, network, and security operations to a hosted environment.
Network reliability
Cut MPLS WAN outages more than 35% in a year through vendor performance management, and cut unplanned outages 90% in 10 months at a global SaaS company.
Cloud and recovery
Functioned as CISO for a hybrid cloud SaaS platform, cut AWS spend $25K a month through better configuration and security optimization, and reinvested it in DR as a Service with a 15 minute RTO and RPO.
Incident & change management
Most outages start as a change. Every incident ends with a lesson.
At a global industrial enterprise and a multi site data center provider, I wrote the ITIL incident and change management policies and processes, ran both programs, and was the accountable owner.
Incident command
I was the incident commander. I ran the response, escalation, and every update to customers and to leadership, so one person owned the facts and the message.
IT incidents and security incidents ran as separate processes. I was accountable for both.
Change Advisory Board
A weekly CAB with every department manager. Whoever executed a change attended to walk through its Method of Procedure and backout plan.
The emergency CAB was for urgent fixes, never for a change someone forgot to submit. At the data center provider I reviewed every MOP, from network and IT work to facility power and cooling.
Learning from every incident
Every incident got a post incident review and root cause analysis. The fixes went back into the MOPs and SOPs, so the same failure was less likely next time.
The proof: no change or incident management exceptions across eight consecutive SOC 2 Type II reports.
Sit in the CAB chair yourself: the change with no way back.