Cfgi
From Cfgi's careers page
Status: listed on the employer's own careers page when we last checked (daily). Confirm on their site before applying.
This role combines hands-on delivery, executive communication, and practice leadership.
Cybersecurity: GRC, Data Privacy & Technical Cybersecurity - Senior Manager
CFGI is a leading advisory firm that partners with private equity sponsors, portfolio companies, and public companies to solve complex challenges across finance, technology, compliance, and business transformation. Our Cybersecurity practice is rapidly growing and supports clients through cybersecurity governance, risk and compliance (GRC), data privacy, regulatory readiness, technical risk assessments, and operational resilience programs.
CFGI is seeking a Cybersecurity GRC, Data Privacy & Technical Cybersecurity Subject Matter Expert to lead and deliver strategic advisory engagements that strengthen clients’ security governance, risk management, compliance posture, privacy programs, and technical security capabilities. This role combines hands-on delivery, executive communication, and practice leadership. The successful candidate will translate technical security risks into business impact, assess whether controls are appropriately designed and implemented, and partner with CISOs, CIOs, CFOs, General Counsel/Privacy Counsel, Risk Leaders, technology teams, and PE deal teams to drive pragmatic, measurable outcomes.
The ideal candidate brings deep GRC and privacy expertise together with sufficient technical depth to challenge control owners, evaluate cybersecurity architectures and operations, validate evidence, and connect technical findings to regulatory, risk, and business requirements.
Technical Cybersecurity Assessment & Advisory Assess technical security controls across cloud, network, endpoint, identity, application, data, and security operations environments, and connect control gaps to business and regulatory risk. Evaluate security architecture and configuration evidence for common platforms and services, including Microsoft Azure, AWS, Microsoft 365, identity providers, firewalls, EDR/XDR, SIEM, vulnerability management, backup, and data protection technologies. Review identity and access management capabilities, including privileged access, multifactor authentication, joiner-mover-leaver processes, access reviews, service accounts, and segregation of duties. Assess vulnerability and patch management processes, interpret scan results, validate remediation prioritization, and evaluate exposure management practices. Evaluate logging, monitoring, detection, and incident response capabilities, including alert coverage, escalation workflows, playbooks, tabletop exercises, and lessons learned. Assess secure configuration, network segmentation, encryption, key management, backup and recovery, data loss prevention, and resilience controls. Partner with technical teams to validate control implementation through interviews, documentation, configuration samples, screenshots, reports, tickets, and other evidence. The role is not expected to serve as a full-time engineer but must be able to credibly challenge technical assumptions and distinguish documented controls from operating controls. Support cyber due diligence, post-acquisition integration, carve-outs, and rapid maturity uplift by identifying material technical risks and developing prioritized remediation roadmaps.
8+ years of relevant experience in cybersecurity GRC, technical risk, privacy, compliance, security consulting, or a combination of these areas. Demonstrated experience implementing and operationalizing cybersecurity frameworks and control programs, including NIST CSF, ISO 27001/27002, CIS Controls, SOC 2, CMMC, or comparable frameworks, along with strong privacy fundamentals. Working technical knowledge across at least four of the following domains: cloud security; IAM/PAM; network security; endpoint security; vulnerability management; SIEM/security monitoring; incident response; application security; data protection; or backup and recovery, with the ability to review technical artifacts and configuration evidence and identify control design or operating gaps.
Scores your resume against this job the way resume scanners do: the job's hard and soft skills, searchability, recruiter tips and formatting.
Create a free account to see your score. Your resume stays in this browser until then, and we never store it.
Already a member? Sign in