GRC, Data Privacy & Technical Cybersecurity SME - Senior Manager

Client Advisory & GRC Delivery

• Lead end-to-end GRC and privacy engagements, including scoping, planning, execution, quality review, and executive reporting.
• Design and operationalize cybersecurity governance models, including policies, standards, risk appetite, committees, reporting, KPIs, and KRIs.
• Build and mature enterprise risk programs, including risk assessments, risk registers, control libraries, control rationalization, and control testing approaches.
• Develop and implement security policies, standards, and procedures aligned to NIST CSF, NIST SP 800-53, ISO 27001/27002, CIS Controls, SOC 2, CMMC, and FedRAMP.
• Support regulatory readiness and compliance initiatives, including SEC cyber disclosure support, NYDFS 500, GDPR/UK GDPR, CCPA/CPRA, HIPAA, PCI DSS, SOX ITGC, CMMC, and FedRAMP alignment where applicable.
• Stand up or enhance privacy programs, including data mapping and inventories, DPIAs/PIAs, DSAR processes, retention, consent management, third-party privacy risk, and privacy by design.
• Perform vendor and third-party risk assessments and implement scalable TPRM operating models.

Technical Cybersecurity Assessment & Advisory

• Assess technical security controls across cloud, network, endpoint, identity, application, data, and security operations environments, and connect control gaps to business and regulatory risk.
• Evaluate security architecture and configuration evidence for common platforms and services, including Microsoft Azure, AWS, Microsoft 365, identity providers, firewalls, EDR/XDR, SIEM, vulnerability management, backup, and data protection technologies.
• Review identity and access management capabilities, including privileged access, multifactor authentication, joiner-mover-leaver processes, access reviews, service accounts, and segregation of duties.
• Assess vulnerability and patch management processes, interpret scan results, validate remediation prioritization, and evaluate exposure management practices.
• Evaluate logging, monitoring, detection, and incident response capabilities, including alert coverage, escalation workflows, playbooks, tabletop exercises, and lessons learned.
• Assess secure configuration, network segmentation, encryption, key management, backup and recovery, data loss prevention, and resilience controls.
• Partner with technical teams to validate control implementation through interviews, documentation, configuration samples, screenshots, reports, tickets, and other evidence. The role is not expected to serve as a full-time engineer but must be able to credibly challenge technical assumptions and distinguish documented controls from operating controls.
• Support cyber due diligence, post-acquisition integration, carve-outs, and rapid maturity uplift by identifying material technical risks and developing prioritized remediation roadmaps.

Executive Communication & Stakeholder Management

• Translate complex technical, regulatory, and privacy requirements into clear, business-oriented recommendations.
• Deliver executive-ready artifacts, including board and audit committee materials, risk heatmaps, maturity assessments, target operating models, roadmaps, and dashboards.
• Serve as a trusted advisor to senior leadership; present findings confidently, facilitate difficult risk decisions, and influence action across business and technology stakeholders.
• Coordinate Legal, IT, Security, Compliance, Product, HR, Internal Audit, and business teams to drive adoption and sustainable outcomes.

Practice Development & Leadership

• Contribute to go-to-market development through offerings, templates, accelerators, methodologies, and points of view that integrate GRC and technical cybersecurity.
• Support business development through proposal writing, SOW development, client presentations, solution shaping, and effort estimation.
• Mentor and develop consultants and managers; lead teams across multiple engagements while maintaining quality, delivery rigor, and commercial discipline.
• Partner with other CFGI service lines, including Accounting Advisory, CFO Advisory, and Technology Enablement, to deliver integrated solutions.