GRC and AI Governance - Senior Manager
- Compensation
- Not disclosed
- Location
- United States
- Work setup
- Hybrid
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 8+ years
- Category
- Security
- Posted
Skills
Nice to have
- Certifications such as CISM, CISSP, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor, CIPM/CIPP (E/US), CDPSE, AI/ML-related certifications such as CAIAP or ISO 42001 Lead Implementer, or CMMC RP/
- Exposure to CMMC or FedRAMP readiness activities.
- Private equity or portfolio company experience, including rapid maturity uplift, integration, carve-out/stand-up, and pragmatic road mapping.
- Exposure to incident readiness, tabletop exercises, and crisis communications coordination with Legal/Communications.
- Experience supporting audits and assurance activities, including SOC 2 readiness, ISO certification readiness, CMMC certification readiness, or internal audit coordination.
Full description
Cybersecurity: GRC & AI Governance – Senior Manager
CFGI is a leading advisory firm that partners with private equity sponsors, portfolio companies, and public companies to solve complex challenges across finance, technology, compliance, and business transformation. Our Cybersecurity practice is rapidly growing and supports clients through cybersecurity governance, risk and compliance (GRC), data privacy, AI governance and compliance, regulatory readiness, and operational resilience programs.
Role Overview
CFGI is seeking a Cybersecurity GRC & AI Governance Subject Matter Expert to lead and deliver strategic advisory engagements that strengthen clients’ security governance, risk management, compliance posture, AI governance programs, and privacy programs. This role blends hands-on delivery, executive communication, and practice leadership. You will work directly with CISOs, CIOs, CFOs, General Counsel/Privacy Counsel, Risk Leaders, and PE deal teams to design pragmatic programs, build operating models, and drive measurable outcomes.
The ideal candidate brings deep expertise in GRC frameworks, regulatory compliance, privacy, and AI governance and compliance (e.g., NIST AI RMF, EU AI Act), strong consulting instincts, and a proven ability to lead teams and manage multiple client workstreams.
Key Responsibilities Client Advisory & Delivery
- Lead end-to-end GRC and privacy engagements, including scoping, planning, execution, and executive reporting.
- Design and operationalize cybersecurity governance models, including policies, standards, risk appetite, committees, and reporting KPIs/KRIs.
- Build and mature enterprise risk programs, including risk assessments, risk registers, control libraries, and control testing approaches.
- Lead AI governance and compliance engagements — design and operationalize AI governance frameworks, conduct AI risk and impact assessments, build model inventories, establish AI use-case classification and tiering, advise on responsible AI principles, and guide clients through compliance with the EU AI Act, NIST AI RMF, and ISO 42001.
- Develop and implement security policies, standards, and procedures aligned to common frameworks, including NIST CSF, ISO 27001/27002, CIS, SOC 2, CMMC, FedRAMP, NIST AI RMF, and ISO 42001.
- Support regulatory readiness and compliance initiatives, including SEC cyber disclosure support, NYDFS 500, GDPR/UK GDPR, CCPA/CPRA, HIPAA, PCI DSS, SOX ITGC, EU AI Act, CMMC, and FedRAMP alignment where applicable.
- Stand up or enhance privacy programs, including data mapping/inventories, DPIAs/PIAs, DSAR processes, retention, consent management, third-party privacy risk, and privacy by design.
- Support CMMC readiness activities where applicable, including gap analyses and compliance alignment to NIST SP 800-171.