GRC, Data Privacy & Technical Cybersecurity SME - Senior Manager

A senior manager in CFGI's Cybersecurity practice who leads advisory engagements combining security GRC, data privacy and technical control assessment for private equity sponsors, portfolio companies and public companies. The role pairs governance expertise with enough technical depth to challenge control owners and test whether controls really work.

On the GRC side the senior manager runs engagements end to end, designs governance models, risk programs and control libraries, writes policies aligned to NIST CSF, ISO 27001, CIS, SOC 2, CMMC and FedRAMP, supports readiness for rules such as NYDFS 500 and HIPAA, builds privacy programs and runs third-party risk. On the technical side they review cloud, identity, network, endpoint, logging and incident response controls on platforms such as Azure, AWS and Microsoft 365, interpret vulnerability scans, judge evidence through interviews and configuration samples, and support cyber due diligence, post-acquisition integration and carve-outs with prioritised remediation roadmaps. The role is not a full-time engineering post. It also produces board materials, mentors consultants and managers, and contributes to proposals and new offerings.

CFGI wants eight or more years across cybersecurity GRC, technical risk, privacy, compliance or security consulting, experience operationalising frameworks such as NIST CSF and ISO 27001, strong privacy fundamentals, and working technical knowledge in at least four security domains such as cloud, IAM and PAM, vulnerability management or SIEM. CISSP, CISA, CCSP or CIPP and exposure to Entra ID, SIEM and EDR tools are pluses.