Open to opportunities

David Gorgas

@davidgorgas

Message

Dynamic Chief Information Security Officer with extensive risk management expertise.

United States

Message

What I'm looking for

I am seeking a role that allows me to leverage my expertise in information security and compliance while fostering a culture of risk management and operational excellence.

I am a dynamic and results-oriented Chief Information Security Officer with extensive experience in directing global compliance, IT audit, information risk management, and privacy initiatives. My proven expertise lies in developing and executing comprehensive audit and compliance strategies for regulatory requirements and standards, including DOJ, FTC, PCI-DSS, SOX, HIPAA, HITRUST, SOC-1, SOC-2, GDPR, CCPA, NIST, and ISO 27001. I am proficient at enhancing global ethics programs and driving compliance and incident response efficiencies.

Throughout my career, I have been recognized for mitigating risks and optimizing storage costs through innovative information security and privacy training programs. I have established and led security operations centers (SOCs) and transformed IT compliance programs to meet regulatory standards. My ability to navigate complex legal and regulatory landscapes while fostering cross-functional collaboration has been key to achieving operational excellence and mitigating cybersecurity threats.

Experience

Work history, roles, and key accomplishments

Current

CISO and GRC Executive Consultant

Current

Independent Contractor

Jul 2024 - Present (10 months)

Provided world-class information security, CISO, IT Compliance and GRC services to organizations. Services included best practice services and leadership to meet industry best practices and state/federal/international compliance and privacy requirements. Implemented information security and privacy program and policy development, control design and implementation services, security control, vulner

Information Security IT Compliance GRC Risk Management Policy Development Vulnerability Assessment Compliance Assessments Security And Privacy Requirements

VP, Information Risk Management & Compliance Director

The TJX Companies, Inc.

Jan 2009 - Jul 2024 (15 years 6 months)

Directed global compliance program initiatives and led information risk executive committee, governing privacy, information security, and records management policies. Spearheaded GDPR & CCPA compliance initiatives, developing and executing a comprehensive privacy function. Managed corporate compliance program elements, including information security and privacy training.

GDPR CCPA Privacy Information Security Risk Management Compliance Training Records Management

AVP, CISO & IT Compliance Director

The TJX Companies, Inc.

Jan 2006 - Jan 2009 (3 years)

Led security, control, and technology implementations, including single sign-on, Oracle EBS, OpenText (Arcsight) SIEM, IBM Tivoli identity manager, Sourcefire & IBM/ISS Proventia IDS/IPS, RSA SecurID, Symantec CCS, Rapid7, and Nessus. Oversaw global IT compliance program, ensuring alignment with regulatory requirements. Led and conducted IT audits and control assessments across global technology e

Information Security IT Compliance IT Audit SOC Identity Management PCI Compliance SOX Compliance

Manager, Information Security Risk & Compliance Management

Humana Inc.

Managed information security risk and compliance, and served as Assistant IT Audit Manager. This role involved overseeing various aspects of IT security and ensuring adherence to compliance standards. Contributed to the overall risk management strategy and conducted internal audits.

Information Security Risk Management Compliance IT Audit Internal Audit Regulatory Compliance

Senior IT Auditor

Trinity Health

Served as a Senior IT Auditor, responsible for conducting comprehensive IT audits to ensure compliance with internal policies and external regulations. Identified control weaknesses and recommended improvements to enhance the security posture. Collaborated with various departments to implement audit findings.

IT Audit Compliance Risk Assessment Audit Reporting Data Analysis

IT Audit Specialist

Comerica Bank

Worked as an IT Audit Specialist, focusing on specialized IT audit engagements. Performed detailed assessments of IT systems and processes to identify potential risks and ensure data integrity. Contributed to the development of audit programs and methodologies.

IT Audit Data Integrity Compliance Financial Systems

Systems Audit Project Analyst

California Federal Bank

Functioned as a Systems Audit Project Analyst, involved in various audit projects related to banking systems. Analyzed system controls and processes to ensure efficiency and compliance. Supported the audit team in data collection and report generation.

Project Analysis Data Collection Compliance Process Improvement

Internal Auditor

Fort Wayne National Corporation

Held the position of Internal Auditor, responsible for conducting internal audits across various departments. Assessed operational efficiency and compliance with company policies and procedures. Provided recommendations for process improvements and risk mitigation.

Internal Audit Efficiency Improvement Compliance Risk Mitigation Process Improvement Auditing