David Norrison

Governance, Risk & Compliance Specialist with over 13 years of experience designing and implementing enterprise GRC frameworks aligned with international standards like ISO 27001, SOC 2, and NIST. Proven success in internal audits, risk treatment planning, regulatory advisory, and stakeholder training. Skilled in deploying compliance platforms (OneTrust, Power BI), optimizing audit readiness, and driving measurable improvements in policy resilience. Passionate about enabling organizations to navigate complex risk landscapes securely and ethically.

I'm a seasoned Governance, Risk & Compliance Specialist with over 13 years of experience guiding organizations through complex regulatory landscapes. I’ve built and rolled out enterprise GRC frameworks, aligned operations with ISO 27001, SOC 2, and NIST CSF standards, and led internal audits that produced measurable reductions in policy exceptions. My journey has spanned cybersecurity consulting, blockchain advisory, sales strategy, and administrative leadership — each role sharpening my ability to bridge technical requirements with ethical best practices.

I’ve worked remotely with global teams, conducted smart contract audits, and developed data-driven compliance dashboards using tools like Power BI, SQL, and OneTrust. What drives me is the challenge of making governance scalable, resilient, and adaptable to emerging risks. I take pride in my ability to lead with strategy, communicate with clarity, and stay anchored in integrity.

I hold a Bachelor of Business Administration in Secondary Education and Teaching from Naomi D. Mitchell College, completed between 2015 and 2023. Earlier, I earned an Advanced Certificate in Business Administration from Teachers To The Nations in 2013, and an Associate of Science in Computer & IT Support Services from New Birth Empowerment Center in 2009. To reinforce my career in Governance, Risk, and Compliance, I also obtained a GRC Professional Certificate from OneTrust, which has equipped me with practical knowledge in compliance frameworks, privacy programs, and risk analytics.