---
title: 'GRC, Data Privacy & Technical Cybersecurity SME - Senior Manager at CFGI'
canonical: 'https://feeny.ai/job/grc-data-privacy-technical-cybersecurity-sme-senior-manager-cfgi-united-states-ee18ckw0hyq0'
type: 'job'
last_seen: '2026-10-14'
---

# GRC, Data Privacy & Technical Cybersecurity SME - Senior Manager at CFGI

- **Company:** CFGI
- **Location:** United States
- **Employment:** full-time
- **Work type:** hybrid
- **Posted:** 2026-09-28
- **Last confirmed live:** 2026-10-14
- **Apply:** https://jobs.lever.co/cfgi/9486c0e2-d4d3-4746-aa5a-6d6367ee7c7d

## Job description

Cybersecurity: GRC, Data Privacy & Technical Cybersecurity - Senior Manager

CFGI is a leading advisory firm that partners with private equity sponsors, portfolio companies, and public companies to solve complex challenges across finance, technology, compliance, and business transformation. Our Cybersecurity practice is rapidly growing and supports clients through cybersecurity governance, risk and compliance (GRC), data privacy, regulatory readiness, technical risk assessments, and operational resilience programs.

## Role Overview

CFGI is seeking a Cybersecurity GRC, Data Privacy & Technical Cybersecurity Subject Matter Expert to lead and deliver strategic advisory engagements that strengthen clients’ security governance, risk management, compliance posture, privacy programs, and technical security capabilities. This role combines hands-on delivery, executive communication, and practice leadership. The successful candidate will translate technical security risks into business impact, assess whether controls are appropriately designed and implemented, and partner with CISOs, CIOs, CFOs, General Counsel/Privacy Counsel, Risk Leaders, technology teams, and PE deal teams to drive pragmatic, measurable outcomes.

The ideal candidate brings deep GRC and privacy expertise together with sufficient technical depth to challenge control owners, evaluate cybersecurity architectures and operations, validate evidence, and connect technical findings to regulatory, risk, and business requirements.

## Key Responsibilities

Client Advisory & GRC Delivery Lead end-to-end GRC and privacy engagements, including scoping, planning, execution, quality review, and executive reporting. Design and operationalize cybersecurity governance models, including policies, standards, risk appetite, committees, reporting, KPIs, and KRIs. Build and mature enterprise risk programs, including risk assessments, risk registers, control libraries, control rationalization, and control testing approaches. Develop and implement security policies, standards, and procedures aligned to NIST CSF, NIST SP 800-53, ISO 27001/27002, CIS Controls, SOC 2, CMMC, and FedRAMP. Support regulatory readiness and compliance initiatives, including SEC cyber disclosure support, NYDFS 500, GDPR/UK GDPR, CCPA/CPRA, HIPAA, PCI DSS, SOX ITGC, CMMC, and FedRAMP alignment where applicable. Stand up or enhance privacy programs, including data mapping and inventories, DPIAs/PIAs, DSAR processes, retention, consent management, third-party privacy risk, and privacy by design. Perform vendor and third-party risk assessments and implement scalable TPRM operating models.

Technical Cybersecurity Assessment & Advisory Assess technical security controls across cloud, network, endpoint, identity, application, data, and security operations environments, and connect control gaps to business and regulatory risk. Evaluate security architecture and configuration evidence for common platforms and services, including Microsoft Azure, AWS, Microsoft 365, identity providers, firewalls, EDR/XDR, SIEM, vulnerability management, backup, and data protection technologies. Review identity and access management capabilities, including privileged access, multifactor authentication, joiner-mover-leaver processes, access reviews, service accounts, and segregation of duties. Assess vulnerability and patch management processes, interpret scan results, validate remediation prioritization, and evaluate exposure management practices. Evaluate logging, monitoring, detection, and incident response capabilities, including alert coverage, escalation workflows, playbooks, tabletop exercises, and lessons learned. Assess secure configuration, network segmentation, encryption, key management, backup and recovery, data loss prevention, and resilience controls. Partner with technical teams to validate control implementation through interviews, documentation, configuration samples, screenshots, reports, tickets, and other evidence. The role is not expected to serve as a full-time engineer but must be able to credibly challenge technical assumptions and distinguish documented controls from operating controls. Support cyber due diligence, post-acquisition integration, carve-outs, and rapid maturity uplift by identifying material technical risks and developing prioritized remediation roadmaps.

Executive Communication & Stakeholder Management Translate complex technical, regulatory, and privacy requirements into clear, business-oriented recommendations. Deliver executive-ready artifacts, including board and audit committee materials, risk heatmaps, maturity assessments, target operating models, roadmaps, and dashboards. Serve as a trusted advisor to senior leadership; present findings confidently, facilitate difficult risk decisions, and influence action across business and technology stakeholders. Coordinate Legal, IT, Security, Compliance, Product, HR, Internal Audit, and business teams to drive adoption and sustainable outcomes.

Practice Development & Leadership Contribute to go-to-market development through offerings, templates, accelerators, methodologies, and points of view that integrate GRC and technical cybersecurity. Support business development through proposal writing, SOW development, client presentations, solution shaping, and effort estimation. Mentor and develop consultants and managers; lead teams across multiple engagements while maintaining quality, delivery rigor, and commercial discipline. Partner with other CFGI service lines, including Accounting Advisory, CFO Advisory, and Technology Enablement, to deliver integrated solutions.

## What You Must Have

8+ years of relevant experience in cybersecurity GRC, technical risk, privacy, compliance, security consulting, or a combination of these areas. Demonstrated experience implementing and operationalizing cybersecurity frameworks and control programs, including NIST CSF, ISO 27001/27002, CIS Controls, SOC 2, CMMC, or comparable frameworks, along with strong privacy fundamentals. Working technical knowledge across at least four of the following domains: cloud security; IAM/PAM; network security; endpoint security; vulnerability management; SIEM/security monitoring; incident response; application security; data protection; or backup and recovery, with the ability to review technical artifacts and configuration evidence and identify control design or operating gaps.

What Sets You Apart Experience performing or leading enterprise/security risk assessments, technical control assessments, control design and testing, policy and standards development, TPRM, and regulatory readiness programs. Experience with GDPR/UK GDPR and CCPA/CPRA, with exposure to HIPAA, GLBA, or other sector-specific privacy requirements. Ability to translate technical control gaps into clear business and regulatory risk rather than relying solely on checklist-based assessments. Exceptional written and verbal communication skills, with a track record of producing concise, executive-level deliverables. Proven ability to lead teams, manage multiple workstreams, timelines, and budgets, and deliver effectively in a client-facing consulting environment.

## Nice to Have

Certifications such as CISSP, CISM, CRISC, CISA, CCSP, ISO 27001 Lead Implementer/Lead Auditor, CIPM/CIPP (E/US), CDPSE, or relevant cloud security certifications. Hands-on experience with, or meaningful exposure to, Microsoft Azure, AWS, Microsoft 365 security, Entra ID, common SIEM and EDR platforms, vulnerability scanning tools, GRC platforms, and privacy management tools. Private equity or portfolio company experience, including rapid maturity uplift, integration, carve-out/stand-up, and pragmatic road mapping. Experience supporting cybersecurity architecture reviews, incident readiness, tabletop exercises, crisis coordination, audits, and assurance activities such as SOC 2 or ISO certification readiness. Understanding of secure software development, application security testing, DevSecOps, or product security.

## Why CFGI

High-impact work with sophisticated clients and private equity portfolio companies. Opportunity to shape and scale a fast-growing Cybersecurity practice that integrates governance, privacy, and technical risk expertise. Collaborative culture with autonomy, flexibility, and strong leadership support. Competitive compensation, benefits, and career growth trajectory.

## About CFGI

## Company Overview
- **One-liner**: CFGI is an independent accounting, tax, and advisory firm that supports CFOs by providing former Big Four professionals to execute critical finance initiatives without auditor independence constraints.
- **Entity Type**: Private (backed by The Carlyle Group and CVC Capital Partners)
- **Headquarters**: Boston, Massachusetts, United States
- **Founded**: 2001 (some sources cite 2000)
- **Founders**: Nick Nardone and Shane Caiazzo

## Core Business
- **Primary industry/industries**: Accounting Advisory, Tax, Capital Markets, Risk Advisory, Cybersecurity, ESG, Financial Transformation
- **Target customers**: CFOs and finance teams at public and private companies, private equity sponsors, and portfolio companies (B2B, Enterprise)
- **Mission or purpose statement**: To serve as a full-service resource equipped to efficiently address clients' most crucial accounting, reporting, tax, and compliance challenges, functioning as an extension of the internal team.

## Products & Services
- **Value Creation Execution Office**: Program management, financial value reconciliation, VCP governance, EBITDA bridge modeling, and board reporting for private equity-backed companies.
- **Financial Transformation & Technology**: FP&A design, ERP/EPM implementation, close optimization, finance automation, and post-merger integration.
- **Transactions & Catalyst Events**: IPO readiness, carve-outs, spin-offs, quality of earnings, working capital analysis, sell-side readiness, and purchase accounting.
- **Accounting, Reporting & Compliance**: Technical accounting, audit readiness, tax provisions, SOX compliance, treasury, cybersecurity/vCISO, and ESG reporting.
- **Interim & Managed Services (AI Native)**: AI-native finance managed services powered by PRISM (Close, FP&A, Tax, P2P), interim CFO/CAO/Controller roles, and embedded team scaling.

## Market Standing
- **Valuation**: Not disclosed (acquired by CVC Capital Partners in 2021 for an estimated USD 1.85 billion per LinkedIn)
- **Key Metric**: Annual revenue estimated at $215M (LinkedIn), with 3,000+ active clients and 1,400+ ex-Big Four professionals
- **Notable Investors/Partners**: The Carlyle Group (investment in 2018), CVC Capital Partners (investment in 2022), Pine Hill Group (acquired 2019), PAS Financial Advisory (acquired 2024)
- **Growth Signals**: 30+ global offices across the Americas, Europe, and Asia Pacific; headcount of ~924 employees (+10.5% YoY); expanded to London (2022), Edinburgh, Dublin, and Singapore; completed 10,000+ transactions and 300+ IPOs

## Competitive Advantages
- **Independence from audit constraints**: CFGI is not an audit firm, so it can prepare memos, financial statements, and documentation that auditors cannot, and works directly with audit teams.
- **Senior practitioner model**: Engagements are staffed with senior professionals (ex-Big Four national office backgrounds), not junior teams supervised from a distance.
- **Embedded, not advisory**: Practitioners work alongside management as an extension of the internal team, doing the work rather than just advising.
- **Full-service under one roof**: Covers technical accounting, tax, capital markets, technology, risk, ESG, and operations without siloed handoffs.
- **Institutional backing**: Backed by two of the world’s largest private equity firms (Carlyle and CVC), enabling national and global growth without compromising independence.

## Strategic Focus
- **Global expansion**: Continuing to build out its footprint across the Americas, Europe, and Asia Pacific (30+ offices currently).
- **AI and technology integration**: Embedding AI, automation, and proprietary technology (PRISM platform) into every engagement for faster, sharper delivery.
- **Deepening PE sponsor relationships**: Serving over 500 sponsors and focusing on value creation and transaction advisory for the private equity ecosystem.
- **Scaling the senior practitioner model**: Replicating the grassroots, local-office approach that worked in Boston and New York across new international markets.

## Why Work Here
- **Culture**: Described as a "community-first corporation" where people are the priority internally and externally; employees are empowered to leverage their previous knowledge to craft innovative strategies.
- **Work model**: Practitioners work near clients (side by side), with a "roll-up-the-sleeves" approach. The firm maintains a local presence in 30+ cities, so roles are likely hybrid/office-based near client sites.
- **Career opportunity**: Work on the most complex and interesting accounting and advisory challenges (IPOs, carve-outs, large transactions) alongside the best clients, with direct access to senior leadership.
- **Team composition**: Exclusively former Big Four professionals (1,400+), meaning you join a peer group of high-caliber talent from Deloitte, PwC, EY, and KPMG.
- **Growth trajectory**: Rapid headcount growth (+10.5% YoY), recent international expansion, and backing from top-tier PE firms signal strong momentum and career advancement potential.

## Sources
1. [cfgi.com - About Us](https://www.cfgi.com/about/)
2. [cfgi.com - Homepage](https://www.cfgi.com/)
3. [cfgi.com - Team](https://www.cfgi.com/about-us/team/)
4. [LinkedIn - CFGI](https://www.linkedin.com/company/thecorporatefinancegroup)
5. [Lever - CFGI Careers](https://jobs.lever.co/cfgi)

## Other roles at CFGI

- [Data & AI - Technical Project Manager](https://feeny.ai/job/data-ai-technical-project-manager-cfgi-singapore-0n2dbft3dnpj) — Singapore
- [Business Continuity and Disaster Recovery - Senior Manager](https://feeny.ai/job/business-continuity-and-disaster-recovery-senior-manager-cfgi-united-states-qpepn68xk993) — United States
- [AI Solutions Architecture - Managing Director](https://feeny.ai/job/ai-solutions-architecture-managing-director-cfgi-united-states-kd18evkr65r8) — United States
- [AI Strategy & Readiness - Managing Director](https://feeny.ai/job/ai-strategy-readiness-managing-director-cfgi-united-states-jmyrmgakjzw7) — United States
- [Stamford/Arlington Operations Support Manager](https://feeny.ai/job/stamford-arlington-operations-support-manager-cfgi-stamford-fmzmewst7tdj) — Stamford, CT
- [Automation - Leader](https://feeny.ai/job/automation-leader-cfgi-united-states-zf8mdvh0m6sr) — United States
- [VAT - Manager](https://feeny.ai/job/vat-manager-cfgi-london-119zte39t20k) — London, United Kingdom
- [Financial Due Diligence - Manager](https://feeny.ai/job/financial-due-diligence-manager-cfgi-new-york-qnsj5krzryg8) — New York, NY
- [Financial Due Diligence - Consultant](https://feeny.ai/job/financial-due-diligence-consultant-cfgi-philadelphia-drm3n273x6z7) — Philadelphia, PA
- [Denver Operations Support Manager](https://feeny.ai/job/denver-operations-support-manager-cfgi-denver-x01wahbs2804) — Denver, CO