GRC, Data Privacy & Technical Cybersecurity SME - Senior Manager
- Compensation
- Not disclosed
- Location
- United States
- Work setup
- Hybrid
- Seniority
- Senior
- Employment
- Full time
- Experience
- 8+ years
- Category
- Security
- Posted
Skills
Nice to have
- Certifications such as CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 Lead Implementer/Lead Auditor, CIPM/CIPP (E/US), CDPSE, or relevant cloud security certifications.
- Hands-on experience with, or meaningful exposure to, Microsoft Azure, AWS, Microsoft 365 security, Entra ID, common SIEM and EDR platforms, vulnerability scanning tools, GRC platforms, and privacy man
- Private equity or portfolio company experience, including rapid maturity uplift, integration, carve-out/stand-up, and pragmatic road mapping.
- Experience supporting cybersecurity architecture reviews, incident readiness, tabletop exercises, crisis coordination, audits, and assurance activities such as SOC 2 or ISO certification readiness.
- Understanding of secure software development, application security testing, DevSecOps, or product security.
Full description
Cybersecurity: GRC, Data Privacy & Technical Cybersecurity - Senior Manager
CFGI is a leading advisory firm that partners with private equity sponsors, portfolio companies, and public companies to solve complex challenges across finance, technology, compliance, and business transformation. Our Cybersecurity practice is rapidly growing and supports clients through cybersecurity governance, risk and compliance (GRC), data privacy, regulatory readiness, technical risk assessments, and operational resilience programs.
Role Overview
CFGI is seeking a Cybersecurity GRC, Data Privacy & Technical Cybersecurity Subject Matter Expert to lead and deliver strategic advisory engagements that strengthen clients’ security governance, risk management, compliance posture, privacy programs, and technical security capabilities. This role combines hands-on delivery, executive communication, and practice leadership. The successful candidate will translate technical security risks into business impact, assess whether controls are appropriately designed and implemented, and partner with CISOs, CIOs, CFOs, General Counsel/Privacy Counsel, Risk Leaders, technology teams, and PE deal teams to drive pragmatic, measurable outcomes.
The ideal candidate brings deep GRC and privacy expertise together with sufficient technical depth to challenge control owners, evaluate cybersecurity architectures and operations, validate evidence, and connect technical findings to regulatory, risk, and business requirements.
Key Responsibilities Client Advisory & GRC Delivery
- Lead end-to-end GRC and privacy engagements, including scoping, planning, execution, quality review, and executive reporting.
- Design and operationalize cybersecurity governance models, including policies, standards, risk appetite, committees, reporting, KPIs, and KRIs.
- Build and mature enterprise risk programs, including risk assessments, risk registers, control libraries, control rationalization, and control testing approaches.
- Develop and implement security policies, standards, and procedures aligned to NIST CSF, NIST SP 800-53, ISO 27001/27002, CIS Controls, SOC 2, CMMC, and FedRAMP.
- Support regulatory readiness and compliance initiatives, including SEC cyber disclosure support, NYDFS 500, GDPR/UK GDPR, CCPA/CPRA, HIPAA, PCI DSS, SOX ITGC, CMMC, and FedRAMP alignment where applicable.
- Stand up or enhance privacy programs, including data mapping and inventories, DPIAs/PIAs, DSAR processes, retention, consent management, third-party privacy risk, and privacy by design.
- Perform vendor and third-party risk assessments and implement scalable TPRM operating models.
Technical Cybersecurity Assessment & Advisory
- Assess technical security controls across cloud, network, endpoint, identity, application, data, and security operations environments, and connect control gaps to business and regulatory risk.