Open to opportunities

Joi Frederick

@joifrederick

Message

Security, privacy, and GRC leader scaling enterprise controls across regulated, cloud-native platforms.

United States

Message

What I'm looking for

I’m looking for a role where I can own security, privacy, and GRC governance end-to-end—guiding teams through audits, third-party risk, and incident response—while building scalable controls for modern cloud-native architectures and executive-ready risk reporting.

I’m a Security, Privacy, and Compliance Manager who builds, owns, and scales enterprise security, risk, and compliance programs in regulated, high-growth environments. I lead hands-on ISO 27001:2022, SOC 2 Type II, CMMC Level 2, FedRAMP Low/Moderate, UK Cyber Essentials+, and FIPS 140-3 audit preparation, evidence management, remediation tracking, and ongoing compliance maintenance.

I partner deeply with engineering, product, legal, finance, and operations to translate regulatory and customer requirements into pragmatic controls—designing security, privacy, risk, and AI governance frameworks with policies, standards, risk assessments, and control testing methodologies. From threat models and impact assessments to third-party risk management (including BIAs/PIAs), executive & board-level risk reporting, and incident response governance, I help teams stay audit-ready and improve residual risk with clarity and operational focus.

Experience

Work history, roles, and key accomplishments

Current

Security, Privacy & Compliance Manager

Current

Spectro Cloud, Inc.

Dec 2023 - Present (2 years 6 months)

Owned enterprise security governance, risk, privacy, and AI governance for a cloud-native Kubernetes management platform; led ISO 27001:2022, SOC 2 Type II, CMMC Level 2, FedRAMP Low/Moderate, UK Cyber Essentials+, and FIPS 140-3 audit preparation, evidence management, and remediation tracking. Partnered with engineering and product to perform threat modeling and translate regulatory requirements

ISO 27001 SOC II FedRAMP Threat Modeling Third Party Risk Management

Governance Risk & Compliance Director

Drake Software, LLC

May 2022 - Nov 2023 (1 year 6 months)

Built and led the company’s first enterprise GRC and privacy programs for regulated financial and tax software, serving as executive owner for SOC 2 Type II audit readiness and successful outcomes. Designed governance frameworks for policies, risk management, and third-party oversight; managed customer security questionnaires and contract reviews, addressing GLBA, FTC, and CCPA/CPRA requirements.

SOC II Privacy Governance Enterprise Risk Management Security Reviews Contract Review GLBA CCPA CPRA Compliance Reporting

Corporate Paralegal

Drake Software, LLC

Feb 2019 - May 2022 (3 years 3 months)

Led CCPA-to-CPRA implementation initiatives and developed the first DSAR and privacy program for regulated financial and tax software. Managed PCI and GDPR compliance, assisted with incident response from a policy/legal perspective, and supported supply-chain and customer contract reviews.

CCPA CPRA DSAR Management Privacy Programs PCI Compliance GDPR Compliance Incident Response Contract Review