GRC and Data Privacy - Manager

CFGI is seeking a Cybersecurity GRC & Data Privacy Subject Matter Expert to lead and deliver strategic advisory engagements that strengthen clients’ security governance, risk management, compliance posture, and privacy programs. This role blends hands-on delivery, executive communication, and practice leadership. You will work directly with CISOs, CIOs, CFOs, General Counsel/Privacy Counsel, Risk Leaders, and PE deal teams to design pragmatic programs, build operating models, and drive measurable outcomes.
 
The ideal candidate brings deep expertise in GRC frameworks, regulatory compliance, and privacy, strong consulting instincts, and a proven ability to lead teams and manage multiple client workstreams.
 
Key Responsibilities:
 
Client Advisory & Delivery:
 
·       Lead end-to-end GRC and privacy engagements, including scoping, planning, execution, and executive reporting.
·       Design and operationalize cybersecurity governance models (policies, standards, risk appetite, committees, reporting KPIs/KRIs).
·       Build and mature enterprise risk programs: risk assessments, risk registers, control libraries, and control testing approaches.
·       Develop and implement security policies, standards, and procedures aligned to common frameworks (e.g., NIST CSF, ISO 27001/27002, CIS, SOC 2, FedRamp, CMMC).
·       Support regulatory readiness and compliance initiatives (e.g., SEC cyber disclosure support, NYDFS 500, GDPR/UK GDPR, CCPA/CPRA, HIPAA, PCI DSS, CMMC, FedRamp, SOX ITGC alignment where applicable).
·       Stand up or enhance privacy programs: data mapping/inventories, DPIAs/PIAs, DSAR processes, retention, consent management, third-party privacy risk, and privacy by design.
·       Perform vendor/third-party risk assessments and implement scalable TPRM operating models.
·       Coordinate cross-functional stakeholders (Legal, IT, Security, Compliance, Product, HR) to drive outcomes and adoption.
 
Executive Communication & Stakeholder Management:
 
·  ...