David Norman, Ph.D.
Georgia, USA • [email protected]
I'm a platform engineer working hands-on across security, operations, and development. I design and operate the FedRAMP-authorized and HITRUST-certified AWS environment behind medical records storage and retrieval for a majority of United States medical records, and I own FinOps engineering for eight-figure annual cloud and SaaS spend.
I prefer latitude to work across departments, pairing lean delivery practices with security-standards compliance that holds up under customer and regulator scrutiny.
Previously
Application configuration, web application architecture and deployment, IT management, and Drupal development. I'm also the author of the Norman keyboard layout and discoverer of the prime number 366216162^65536+1.
Core Skills
- Cloud: AWS (Organizations, IAM Identity Center, EC2, RDS), Azure, VMware
- Automation: Ansible, Terraform, GitHub Actions, Jenkins, Packer, Bash, Python
- Compliance: FedRAMP and HITRUST audited environments; CIS, NIST-CSF, HIPAA, ISO 27001, PCI-DSS
- FinOps: Cost allocation, rightsizing, and commitment planning across cloud and SaaS spend
- Security: Cloud security posture management, vulnerability management, secrets management, SSO
Experience
Datavant (formerly Ciox Health)
Staff Engineer • June, 2016 — Present
Work in devops, security, and infrastructure roles to design the secure hosting environment of medical records storage and retrieval systems for a majority of United States medical records.
- Unify and de-duplicate corporate IT infrastructure tools from merger and acquisition activity.
- Own FinOps engineering for eight-figure annual cloud and SaaS spend.
- Identified, documented, and remediated multi-million-dollar cloud spend waste.
- Provide cost governance and account-level guardrails across a multi-account AWS Organization.
- Migrated AWS IAM to AWS Identity Center and consolidated billing under a single master payer account.
- Perform datacenter migrations between AWS, Azure, and VMware-based datacenters.
- Engineer and maintain dedicated AWS accounts for FedRAMP-authorized and HITRUST-certified workloads, and support the recurring third-party audits behind both.
- Sustained 99% configuration compliance across CIS, NIST-CSF, AWS Well-Architected, and Azure Architecture frameworks.
- Write proprietary Ansible roles, Terraform plans, GitHub Actions workflows, and Jenkins pipelines for systems management of Microsoft, Java, and Python-based applications.
Pegasystems (formerly OpenSpan)
Security Analyst • June, 2015 — June, 2016
Inspected security measures for the protection of Ruby-based, AWS-hosted web application and IT environments. Monitored and analyzed security controls, reviewed vulnerabilities, maintained and enforced security policies, and performed risk assessments.
- Established vulnerability management program based on Tenable SecurityCenter.
- Wrote policies and technical configuration standards aligned to ISO 27001, HIPAA HITECH, PCI-DSS, CSA-STAR, and European privacy regulations.
- Performed internal audits of cloud and IT infrastructure.
- Drafted major components of the company’s yearly risk assessment.
- Created Ansible playbooks to bootstrap Ubuntu-based Vagrant environments.
Imagine Print Solutions (formerly Classic Graphics)
Principal Software Engineer • Sept, 2007 — Jun, 2015
Developed, tested, deployed, supported and maintained custom Drupal websites for Fortune 50 customers, including banks and retail firms.
- Designed and wrote web-based software to direct collation of printed items and kitting plans for shipping.
- Set up end-to-end continuous integration using Jenkins in an Ubuntu-based environment, reaching code quality that allowed deployments during business hours.
- Trained developers on existing processes and web applications used for print manufacturing.
- Wrote policies and procedures for compliance with ISO 27001, HIPAA HITECH, and PCI-DSS, and responded to security questionnaires and RFPs.
Quality Rater • Dec, 2006 — Dec, 2007
Help train the Google PageRank engine to show timely and accurate results.
Advanced Automation Inc
Director of Instructional Technology • Aug, 2003 — Jul, 2006
Collaborated with executives, sales, and support departments to develop online training curriculum for hundreds of insurance agencies.
- Managed server infrastructure for delivery of virtual sales meetings, dynamic web-based training, and interactive inter-agency information sharing.
- Responsible for remotely diagnosing IT problems and making repairs.
- Trained employees on new IT infrastructure as needed.
Education
University of Central Florida
Doctor of Philosophy, Instructional Technology
Master of Science, Management Information Systems
The University of Texas at Tyler
Bachelor of Business Administration, General Business
Certifications
Certified Information Systems Security Professional (CISSP)
ISC2, Jan 2014 — July 2028
Information Systems Security Architecture Professional (ISSAP)
ISC2, Apr 2014 — Jun 2028
Certified Secure Software Lifecycle Professional (CSSLP)
ISC2, Sep 2013 — July 2028
Certified Information Privacy Technologist (CIPT)
IAPP, Sept 2015 — Aug 2027
Azure Security Engineer Associate
Microsoft, Feb 2020 — Feb 2027
Azure Fundamentals
Microsoft, Feb 2020
Drupal 7 Back-end Specialist
Acquia, Nov 2014
Recognition
Silver Beaver Award
Scouting America • 2026
For distinguished service to youth at the council level.
Scouter of the Year
Scouting America • 2025
For exemplifying the ideals of Scouting at the district level.
The President's Lifetime Achievement Award
AmeriCorps • 2024
In recognition of more than 4000 hours of unpaid acts of volunteer service benefitting others.
Community Organization Award
Scouting America • 2024
Recognition of Scouters for voluntary service and achievement to Scouting youth in the community.
Benjamin O. Davis, Jr. Award
Civil Air Patrol • 2023
The Benjamin O. Davis, Jr. Award is presented to senior members who successfully complete the second level of professional development. Members must complete the technical training required for the Leadership Award and must also attend Squadron Leadership School.
Brigadier General Charles E. “Chuck” Yeager Aerospace Education Achievement Award
Civil Air Patrol • 2023
Crisis Service Award
Civil Air Patrol • 2021
CAP Crisis Service Ribbon was established to recognize the CAP membership during periods when the entire organization was under significant stress responding to a lengthy, nationwide emergency.
District Award of Merit
Scouting America • 2021
For service of an outstanding nature at the district level.
Recognition of Merit for Service
University of Central Florida • 2006
Provided complimentary instructional technology consulting to Hospice of the Comforter in Orlando, FL.
Honorary Sea Aggie
Texas A&M University at Galveston
In recognition of research I performed of common contaminants in various watersheds and their impact on water-borne macro-invertebrate populations.
Eagle Scout
Scouting America
Projects
Norman Keyboard Layout
Primary Designer • 2012 — Present
Creator of the Norman keyboard layout, which is now widely used and included as an alternative in the Linux xkeyboard library.
Guardr
Co-Founder & Developer • 2012 — 2015
Guardr is a Drupal distribution with a combination of modules and settings to enhance a Drupal application's security and availability to meet enterprise security requirements.
Thatware
Founder & Developer • 1998 — 2005
I wrote my own Slashdot clone in PHP, which was superseded by the superior speed and feature-set of Drupal.
Volunteering
Scouting America
Scoutmaster → District Advancement Chair • Jun, 2018 — Present
Plan and chair activities run by volunteers in a 3-county area, including camps, lock-ins, workshops, leadership training, range and target sports, career exploration days, and Eagle rank boards of review.
Georgia Cycling
Assistant Coach • May, 2020 — Present
Composite mountain bike team in the north Georgia league.
NTP Pool Project
NTP pool server host • Apr, 2012 — Feb, 2023
Hosted a stratum 2 time server in the pool for us.pool.ntp.org.
OpenNIC
Tier 2 server host • May, 2012 — Jul, 2013
I hosted an open resolver DNS server on the OpenNIC network until it was abused in DoS reflection attacks.
Drupal
Project contributor • 2001 — 2015
I contributed core patches, modules, installation profiles, themes, documentation, automated testing, and reviewed project applications. I had elevated privileges on https://www.drupal.org to help people with the management of pages, input filter settings, ownership of projects, and approval for people to commit as "vetted" users to the git repositories hosted by Drupal.
Summer of Code mentor • Jan, 2009 — Jan, 2011
Mentor high school-aged kids mentoring and a stipend as incentive to get involved with Open Source project. Included mentoring for the ultimate LaTeX module for Drupal by Daniel Gutekunst and Validation API Module for JS/PHP by Craig Jackson (TapocoL).