Camara

Strategic and results-driven Security Governance, Risk, and Compliance (GRC) leader with over 14 years of experience designing, implementing, and maturing enterprise GRC programs across global technology, utility, and government sectors. Proven expertise in aligning cybersecurity risk frameworks (NIST, ISO 27001, SOC 2, PCI DSS, HIPAA) with business goals and regulatory obligations, ensuring enterprise-wide compliance and risk reduction. Track record of leading enterprise-wide risk assessments, third-party risk programs, internal audits, and security policy development while presenting actionable insights to leadership.

Recognized for building teams, streamlining compliance operations, and influencing secure-by-design cultures in rapidly evolving, regulated environments.

COMPLIANCE MANAGER - StatusPros / Archetype AI - Remote

• Lead governance, risk, and compliance activities supporting cybersecurity control validation, assessment, and authorization, aligning security requirements with NIST CSF, NIST 800-53, COBIT, ISO 27001, SOC 1/SOC 2, HIPAA, and enterprise policies.
• Maintain and strengthen control libraries, governance documentation, policies, standards, processes, and procedures, coordinating periodic reviews with control owners and ensuring traceability between requirements, controls, and supporting artifacts.
• Perform cybersecurity risk assessments across technology and business environments, evaluating inherent, target, and residual risk, documenting control gaps, and coordinating remediation plans aligned with organizational risk appetite and tolerance.
• Develop and oversee continuous control monitoring and security control assessment activities to validate control effectiveness, identify exceptions, track findings, and support timely remediation with accountable stakeholders.
• Map legal, regulatory, contractual, and security requirements to enterprise control frameworks, improving reuse of control evidence and supporting consistent compliance across audit, customer assurance, and internal governance activities.
• Serve as a GRC liaison to auditors, consultants, Security, IT, Engineering, Legal, and business teams, coordinating evidence requests, control walkthroughs, audit findings, remediation status, and compliance documentation.
• Build and maintain governance, risk, and compliance metrics, dashboards, and executive reporting that communicate control performance, risk posture, audit issues, remediation progress, and emerging priorities to senior leadership and governance forums.
• Lead process analysis and continuous-improvement efforts across Technology GRC while mentoring junior team members, documenting repeatable practices, and providing subject-matter guidance on risk management, controls, governance, and compliance responsibilities.

GLOBAL CYBER SECURITY, ENTERPRISE RISK MANAGER - Forcepoint - Remote

(2023-01)

• Lead risk assessments identifying threats across cloud, infrastructure, and product environments globally.
• Direct control assurance aligned with ISO 27001, SOC 2, and SOX compliance audit standards organization-wide.
• Implement Drata GRC platform, improving visibility into compliance posture and real-time cyber risk dashboards.
• Act as subject matter expert during security-related audit engagements to ensure proper compliance and controls.
• Participate in audit walkthrough meetings, representing the Security team to align expectations and provide insights.
• Liaise between Technology GRC and Security teams to ensure audit activities are coordinated and effective.
• Conduct risk and control assessments against industry frameworks to validate alignment with internal security standards.
• Maintain centralized audit evidence repository supporting compliance with SOC 2, PCI DSS, SOX, and others.
• Oversee third-party risk reviews, ensuring vendor compliance with PCI, ISO, and security standards.
• Deliver executive dashboards and briefings highlighting risks, remediation status, and performance indicators.
• Deploy FAIR-based cyber risk modeling to support investment prioritization and security decision-making.
• Manage remediation plans with stakeholders, tracking closure of cyber risk items across departments.
• Lead ISO and SOC 2 control testing with Security, Engineering, and Legal to ensure compliance.
• Review vendor contracts to ensure cybersecurity clauses align with regulatory and enterprise standards.

CYBER SECURITY, ENTERPRISE RISK & COMPLIANCE, PRINCIPAL - PG&E - San Francisco, CA

(2013-01 - 2023-12)

• Led enterprise risk assessments and quantification using NIST CSF and FAIR, securing CPUC approval for mitigations.
• Directed third-party risk reviews, embedding ISO 27001 and NIST 800-53 controls into vendor onboarding and contracts.
• Managed SOX, PCI DSS, and CPUC audit readiness, aligning controls with regulatory and enterprise requirements.
• Developed and maintained security policies, ensuring alignment with operations and compliance expectations.
• Maintained cyber risk registers to track and report mitigation status across all operating units.
• Managed enterprise risk register, KRIs, and dashboards for executive reporting and program oversight.
• Partnered with IT and business units to embed risk governance into infrastructure projects.
• Supported acquisition activities with GRC program implementation and integration of security requirements.
• Contributed to GRC initiatives, including drafting policies, security awareness, and third-party risk assessment processes.
• Interfaced with CPUC regulators to deliver formal risk assessments and support audit readiness.
• Developed and enforced policies aligned with NIST, ISO 27001, and CPUC compliance standards.

BUSINESS CONTINUITY & DISASTER RECOVERY PROJECT MANAGER - Florida Power & Light - Fort Lauderdale, FL

(2012-01 - 2013-12)

• Designed recovery plans to protect operations from disruptions and ensure system uptime during outages.
• Delivered continuity training for staff and executives to enhance enterprise-wide preparedness.
• Led data backup testing to comply with federal and internal disaster recovery standards.
• Conducted post-drill evaluations to identify resilience gaps and refine recovery strategies.
• Maintained emergency contact directories to support vendor and team coordination during crises.
• Oversaw relocation of alternate data center to strengthen recovery capabilities and reduce downtime.
• Created business continuity resources aligned with emergency communication and escalation protocols.
• Validated IT disaster recovery performance against recovery time objectives to ensure readiness.

BUSINESS CONTINUITY & DISASTER RECOVERY MANAGER - DISYS - McLean, VA

(2011-01 - 2012-12)

• Led U.S. House continuity programs to protect operations from cyber, physical, and environmental disruptions.
• Managed recovery testing and planning for headquarters, field offices, and global dependencies.
• Maintained audit-ready documentation in accordance with Internal Audit Group DR requirements.
• Developed plans for pandemics, cyberattacks, terrorism, and other catastrophic disruption scenarios.
• Oversaw $5M recovery site migration, reducing external reliance and enhancing internal capacity.
• Collaborated with vendors and teams to standardize and validate business recovery strategies.
• Maintained DR documentation and vendor agreements to support compliant and timely recovery.
• Conducted full-system simulations to test operational continuity and identify plan deficiencies.

JD

MPA