DAVID O. CRAIGEN – Fractional Expert for Hire

DAVID O. CRAIGEN – Fractional Expert for Hire | Hivemindd

DAVID O. CRAIGEN

Verified

@davidcraigen

Georgia, United States

Experience

Director of Infrastructure & Security (CISO Function)

The Wound Pros LLC Group - January 2025 - Current

Serve as the executive owner of enterprise cybersecurity strategy, governance, and operations for a nationwide healthcare services organization, reporting directly to executive leadership on cyber risk posture and control effectiveness. Architected and operationalized an end-to-end HIPAA/HITECH-compliant security program spanning Microsoft Azure cloud, identity, endpoint, encryption, and segmented network architecture for regulated healthcare workloads. Designed and presented board-ready cyber risk dashboards delivering real-time visibility into infrastructure health, control gaps, and remediation velocity; personally briefed executive leadership and board stakeholders on enterprise risk posture. Established a risk-based vulnerability management program leveraging Rapid7 InsightVM, defining scanning cadence, severity thresholds, remediation SLAs, and executive KPIs that materially reduced enterprise exposure. Led incident response as technical commander during active security events, directing forensic investigation, containment, stakeholder communications, and post-incident root cause review. Recruited, mentored, and upskilled a 10-person security and infrastructure team; established career ladders, performance standards, and technical enablement frameworks. Prevented an estimated $3M in regulatory fines through direct execution of compliance controls, audit evidence management, and security program governance.

Senior Systems Engineer

The Wound Pros LLC Group - September 2024 - January 2025

Led technical hardening of Microsoft Azure infrastructure supporting regulated healthcare workloads; deployed Microsoft Defender for Cloud, NSGs, Conditional Access, and PIM to enforce least-privilege and Zero Trust principles. Designed enterprise Microsoft Intune MDM/MAM program across Windows, macOS, iOS, and Android; authored compliance profiles, baseline configurations, and application protection policies. Integrated Microsoft 365 governance controls including DLP policies, sensitivity labels, and Microsoft Purview configurations to protect sensitive data across a rapidly scaling organization. Directed network segmentation and access control remediation efforts aligning infrastructure to HIPAA Security Rule requirements.

Information Security Officer (Interim)

Employees Retirement System of Georgia - FractionalApril 2024 - July 2024

Engaged as interim security executive to stand up a NIST 800-53 Rev 4-aligned information security program for a state-level public pension system, authoring policies, control documentation, and audit evidence packages for regulatory oversight. Directed SIEM strategy and operations, tuning alerting rules, correlation logic, and response playbooks to deliver real-time threat detection across public-sector infrastructure. Operationalized Tenable vulnerability scanning; defined scan policies, severity thresholds, and remediation tracking to reduce risk across critical state assets. Advised executive leadership on cyber risk posture, program maturity, and strategic investment priorities.

Business Unit Information Security Officer

TK Elevator - June 2022 - December 2023

Owned business-unit information security strategy and execution across North American operations during global IPO readiness, aligning controls to enterprise governance and regulatory obligations. Led vulnerability and patch management programs, deploying automated tooling with defined deployment rings and baselines that eliminated 15% of organizational vulnerabilities within 90 days. Directed application security reviews and vendor risk assessments, performing technical due diligence on third-party platforms and informing executive risk decisions. Built and delivered a security awareness and technical training curriculum for engineering and operations teams, translating complex threat scenarios into actionable defensive behaviors.

Information Security Manager

The Quikrete Companies - October 2021 - June 2022

Led a 20-person security team and owned a $2M security budget delivering enterprise-wide security projects on time and on budget. Directed enterprise deployment of Rapid7 EDR/XDR, driving vendor evaluation, product configuration, agent rollout, and SIEM integration across the environment. Architected and implemented an enterprise Privileged Access Management (PAM) program with vaulting, session recording, just-in-time access, and privileged account discovery across critical systems. Led security integration across M&A activity, unifying SIEM, IDS/IPS, DLP, firewall policy, and vulnerability management tooling across acquired entities. Designed and facilitated tabletop exercises and incident response drills with executive leadership to mature the organization's crisis response capability.

Director of Information Security

BioIQ Inc. - November 2019 - July 2021

Served as the enterprise security executive for a healthcare technology firm, owning strategy, governance, and operations for a rapidly scaling organization. Built a NIST CSF-aligned security program from the ground up; authored policy, implemented technical controls, and led internal audit readiness. Acted as primary technical executive in pre-sales due diligence engagements, demonstrating security architecture maturity and directly contributing to $2M+ in new enterprise contracts with Google and Netflix. Deployed Microsoft Intune to 2,000+ users, enforcing endpoint security and Conditional Access at scale. Architected and operationalized an enterprise Data Loss Prevention (DLP) program with content inspection, policy rules, and incident workflows. Served as technical incident commander during breach response, directing forensic investigation, containment, and stakeholder and regulator communications.

Information Security Manager

MiMedx Inc. - September 2016 - November 2019

Advanced enterprise security maturity from CMMI Level 1 to Level 2.5 through governance improvements, process formalization, and hands-on control implementation. Led in-house deployment of Cisco ISE, Cisco AMP, and Cisco Umbrella, owning the full implementation lifecycle and delivering $150K in cost savings versus external engagement. Engineered SIEM capability including log source onboarding, correlation rules, dashboards, and alert tuning across IDS/IPS, HIDS, and endpoint telemetry.

Senior Information Assurance Engineer

Aaron's Inc. - September 2015 - September 2016

Re-engineered the enterprise Splunk SIEM platform, rebuilding data inputs, index configurations, correlation searches, and dashboards to deliver actionable security intelligence while reducing operational cost. Optimized Qualys vulnerability scanning configuration, expanding coverage and tuning scan policies to achieve a 10% reduction in organizational vulnerabilities. Delivered featured keynote presentation at Splunk Live Atlanta on enterprise security transformation and SIEM re-engineering to an audience of security professionals.

Experience

Education

University of Phoenix

Master of Information Systems - MIS

University of Phoenix

Bachelor of Science - Information Technology / Information Systems Security

Education

Certifications & Accolades

Certified Information Security Manager

CISM

Certified Data Privacy Solutions Engineer

CDPSE

Associate Certified Chief Information Security Officer

Associate C|CISO

Certifications & Accolades

About

Results-oriented Information Security Executive with an exceptional record building and leading world-class security programs across healthcare, financial services, and regulated enterprise environments. Excels in high-stakes settings demanding focused analysis, strategic thinking, crisis management, and tactical execution. A proven change agent who elevates security culture through strong leadership, accountability, and team development, while maintaining trusted relationships with boards, executives, and key stakeholders. Undertaken key leadership roles spanning incident response, M&A security integration, and enterprise-wide security transformations. Experience spans security strategy, risk management, compliance, governance, GRC, business continuity, and crisis management. Sponsored, led, and delivered significant security programs incorporating policy design, technology implementation, and ongoing operational management across complex, multi-site organizations. Holds CISM, CDPSE, and C|CISO certifications with deep expertise in Cloud Security (Azure, Okta, Zscaler), Identity & Access Management, Vulnerability Management, and compliance frameworks including HIPAA, NIST, ISO 27001, and PCI-DSS. Broad capability in identifying emerging threats, providing strategic direction, and aligning cybersecurity investments with business objectives to drive resilience and growth. Available for vCISO engagements, contract roles, and senior security leadership opportunities.

Skills