{"id":1481238,"url":"https://alion.io/job/cfgi-grc-data-privacy-technical-cybersecurity-sme-senior-manager","title":"GRC, Data Privacy & Technical Cybersecurity SME - Senior Manager","company":{"id":672933,"name":"CFGI","domain":"cfgi.com","url":"https://alion.io/company/cfgi","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"A","score":86,"open_postings":82,"ghost_share":0.146,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":555,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":114000,"max_usd":221000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1306},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"FedRAMP","optional":false},{"name":"GDPR","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"PCI DSS","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Microsoft Entra ID","optional":true}],"status":"live","first_seen_at":"2026-09-28T17:29:45Z","employer_posted_date":"2026-09-28","last_verified_at":"2026-10-22T08:21:15Z","board_verified":true,"closed_at":null,"days_open":23,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":23},"description":"Cybersecurity: GRC, Data Privacy & Technical Cybersecurity - Senior Manager\nCFGI is a leading advisory firm that partners with private equity sponsors, portfolio companies, and public companies to solve complex challenges across finance, technology, compliance, and business transformation. Our Cybersecurity practice is rapidly growing and supports clients through cybersecurity governance, risk and compliance (GRC), data privacy, regulatory readiness, technical risk assessments, and operational resilience programs.\nRole Overview\nCFGI is seeking a Cybersecurity GRC, Data Privacy & Technical Cybersecurity Subject Matter Expert to lead and deliver strategic advisory engagements that strengthen clients’ security governance, risk management, compliance posture, privacy programs, and technical security capabilities. This role combines hands-on delivery, executive communication, and practice leadership. The successful candidate will translate technical security risks into business impact, assess whether controls are appropriately designed and implemented, and partner with CISOs, CIOs, CFOs, General Counsel/Privacy Counsel, Risk Leaders, technology teams, and PE deal teams to drive pragmatic, measurable outcomes.\nThe ideal candidate brings deep GRC and privacy expertise together with sufficient technical depth to challenge control owners, evaluate cybersecurity architectures and operations, validate evidence, and connect technical findings to regulatory, risk, and business requirements.\nKey Responsibilities\nClient Advisory & GRC Delivery\nLead end-to-end GRC and privacy engagements, including scoping, planning, execution, quality review, and executive reporting.\nDesign and operationalize cybersecurity governance models, including policies, standards, risk appetite, committees, reporting, KPIs, and KRIs.\nBuild and mature enterprise risk programs, including risk assessments, risk registers, control libraries, control rationalization, and control testing approaches.\nDevelop and implement security policies, standards, and procedures aligned to NIST CSF, NIST SP 800-53, ISO 27001/27002, CIS Controls, SOC 2, CMMC, and FedRAMP.\nSupport regulatory readiness and compliance initiatives, including SEC cyber disclosure support, NYDFS 500, GDPR/UK GDPR, CCPA/CPRA, HIPAA, PCI DSS, SOX ITGC, CMMC, and FedRAMP alignment where applicable.\nStand up or enhance privacy programs, including data mapping and inventories, DPIAs/PIAs, DSAR processes, retention, consent management, third-party privacy risk, and privacy by design.\nPerform vendor and third-party risk assessments and implement scalable TPRM operating models.\nTechnical Cybersecurity Assessment & Advisory\nAssess technical security controls across cloud, network, endpoint, identity, application, data, and security operations environments, and connect control gaps to business and regulatory risk.\nEvaluate security architecture and configuration evidence for common platforms and services, including Microsoft Azure, AWS, Microsoft 365, identity providers, firewalls, EDR/XDR, SIEM, vulnerability management, backup, and data protection technologies.\nReview identity and access management capabilities, including privileged access, multifactor authentication, joiner-mover-leaver processes, access reviews, service accounts, and segregation of duties.\nAssess vulnerability and patch management processes, interpret scan results, validate remediation prioritization, and evaluate exposure management practices.\nEvaluate logging, monitoring, detection, and incident response capabilities, including alert coverage, escalation workflows, playbooks, tabletop exercises, and lessons learned.\nAssess secure configuration, network segmentation, encryption, key management, backup and recovery, data loss prevention, and resilience controls.\nPartner with technical teams to validate control implementation through interviews, documentation, configuration samples, screenshots, reports, tickets, and other evidence. The role is not expected to serve as a full-time engineer but must be able to credibly challenge technical assumptions and distinguish documented controls from operating controls.\nSupport cyber due diligence, post-acquisition integration, carve-outs, and rapid maturity uplift by identifying material technical risks and developing prioritized remediation roadmaps.\nExecutive Communication & Stakeholder Management\nTranslate complex technical, regulatory, and privacy requirements into clear, business-oriented recommendations.\nDeliver executive-ready artifacts, including board and audit committee materials, risk heatmaps, maturity assessments, target operating models, roadmaps, and dashboards.\nServe as a trusted advisor to senior leadership; present findings confidently, facilitate difficult risk decisions, and influence action across business and technology stakeholders.\nCoordinate Legal, IT, Security, Compliance, Product, HR, Internal Audit, and business teams to drive adoption and sustainable outcomes.\nPractice Development & Leadership\nContribute to go-to-market development through offerings, templates, accelerators, methodologies, and points of view that integrate GRC and technical cybersecurity.\nSupport business development through proposal writing, SOW development, client presentations, solution shaping, and effort estimation.\nMentor and develop consultants and managers; lead teams across multiple engagements while maintaining quality, delivery rigor, and commercial discipline.\nPartner with other CFGI service lines, including Accounting Advisory, CFO Advisory, and Technology Enablement, to deliver integrated solutions.\nWhat You Must Have\n8+ years of relevant experience in cybersecurity GRC, technical risk, privacy, compliance, security consulting, or a combination of these areas.\nDemonstrated experience implementing and operationalizing cybersecurity frameworks and control programs, including NIST CSF, ISO 27001/27002, CIS Controls, SOC 2, CMMC, or comparable frameworks, along with strong privacy fundamentals.\nWorking technical knowledge across at least four of the following domains: cloud security; IAM/PAM; network security; endpoint security; vulnerability management; SIEM/security monitoring; incident response; application security; data protection; or backup and recovery, with the ability to review technical artifacts and configuration evidence and identify control design or operating gaps.\nWhat Sets You Apart\nExperience performing or leading enterprise/security risk assessments, technical control assessments, control design and testing, policy and standards development, TPRM, and regulatory readiness programs.\nExperience with GDPR/UK GDPR and CCPA/CPRA, with exposure to HIPAA, GLBA, or other sector-specific privacy requirements.\nAbility to translate technical control gaps into clear business and regulatory risk rather than relying solely on checklist-based assessments.\nExceptional written and verbal communication skills, with a track record of producing concise, executive-level deliverables.\nProven ability to lead teams, manage multiple workstreams, timelines, and budgets, and deliver effectively in a client-facing consulting environment.\nNice to Have\nCertifications such as CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 Lead Implementer/Lead Auditor, CIPM/CIPP (E/US), CDPSE, or relevant cloud security certifications.\nHands-on experience with, or meaningful exposure to, Microsoft Azure, AWS, Microsoft 365 security, Entra ID, common SIEM and EDR platforms, vulnerability scanning tools, GRC platforms, and privacy management tools.\nPrivate equity or portfolio company experience, including rapid maturity uplift, integration, carve-out/stand-up, and pragmatic road mapping.\nExperience supporting cybersecurity architecture reviews, incident readiness, tabletop exercises, crisis coordination, audits, and assurance activities such as SOC 2 or ISO certification readiness.\nUnderstanding of secure software development, application security testing, DevSecOps, or product security.\nWhy CFGI\nHigh-impact work with sophisticated clients and private equity portfolio companies.\nOpportunity to shape and scale a fast-growing Cybersecurity practice that integrates governance, privacy, and technical risk expertise.\nCollaborative culture with autonomy, flexibility, and strong leadership support.\nCompetitive compensation, benefits, and career growth trajectory.","description_format":"text","description_chars":8401,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Security Compliance","Financial Advisory, Valuation & Restructuring"],"lifecycle":[{"event":"open","at":"2026-09-29T21:14:28Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":23,"expected_fill_days":555,"reasons":["conf:1","win:early"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/cfgi-grc-data-privacy-technical-cybersecurity-sme-senior-manager","json_url":"https://alion.io/job/cfgi-grc-data-privacy-technical-cybersecurity-sme-senior-manager.json","meta":{"generated_at":"2026-10-22T10:29:08Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7707,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":672933},"rest":"https://alion.io/mcp/rest/get_company?id=672933"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcfgi-grc-data-privacy-technical-cybersecurity-sme-senior-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcfgi-grc-data-privacy-technical-cybersecurity-sme-senior-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcfgi-grc-data-privacy-technical-cybersecurity-sme-senior-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cfgi-grc-data-privacy-technical-cybersecurity-sme-senior-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcfgi-grc-data-privacy-technical-cybersecurity-sme-senior-manager"}]}