CFGI is an independent accounting advisory firm that works with CFOs and finance teams on complex financial, operational, and strategic challenges. Its services span technical and operational accounting, capital markets and transaction advisory, strategic finance, analytics, ESG and sustainability reporting, tax and valuation, risk and compliance, cybersecurity, forensic accounting, and business transformation. CFGI serves organizations across business services, financial services, healthcare, life sciences, and manufacturing, helping them strengthen finance operations, manage change, and make informed decisions as their businesses evolve.
Senior Manager, GRC and AI Governance - CFGI (Hybrid, United States)
Lead CFGI advisory engagements covering cybersecurity GRC, privacy, and AI governance. Build risk, compliance, and responsible AI programs for complex client environments.
Description
- Own GRC and privacy engagements from scope definition and planning through delivery and executive reporting
- Create and implement cybersecurity governance models covering policies, standards, risk appetite, committees, and KPI/KRI reporting
- Establish and mature enterprise risk programs through assessments, risk registers, control libraries, and testing methods
- Lead AI governance and compliance work involving governance frameworks, AI risk and impact assessments, model inventories, use-case classification, responsible AI principles, the EU AI Act, NIST AI RMF, and ISO 42001
- Create security policies, standards, and procedures aligned with NIST CSF, ISO 27001/27002, CIS, SOC 2, CMMC, FedRAMP, NIST AI RMF, and ISO 42001
- Assist with regulatory readiness and compliance programs covering SEC cyber disclosure, NYDFS 500, GDPR/UK GDPR, CCPA/CPRA, HIPAA, PCI DSS, SOX ITGC, EU AI Act, CMMC, and FedRAMP
- Establish or improve privacy programs spanning data inventories, DPIAs/PIAs, DSARs, retention, consent management, third-party privacy risk, and privacy by design
- Support CMMC readiness through gap assessments and alignment with NIST SP 800-171
- Conduct vendor and third-party risk assessments and build scalable TPRM operating models
- Coordinate stakeholders across Legal, IT, Security, Compliance, Product, and HR
- Convert complex technical, regulatory, privacy, and AI governance obligations into practical business recommendations
- Help clients present AI risk posture and governance maturity to boards, regulators, and executive leaders
- Prepare board and audit committee materials, roadmaps, operating models, heatmaps, and risk dashboards
- Advise senior leaders and influence strategic decisions as a trusted advisor
- Advance go-to-market initiatives through offerings, templates, accelerators, methodologies, and points of view
- Support business development with proposals, SOWs, client presentations, and solution design
- Coach consultants and managers while leading multiple engagements with strong quality and delivery discipline
- Collaborate with Accounting Advisory, CFO Advisory, and Technology Enablement on integrated solutions
Requirements
- At least 8 years of relevant experience in cybersecurity GRC, privacy, governance, risk management, compliance, or consulting
- Expertise implementing and operating cybersecurity frameworks and control programs such as NIST CSF/NIST 800-53, ISO 27001/27002, SOC 2, CIS, or comparable standards
- Strong grounding in privacy principles with experience building and running privacy programs
- Expertise with AI governance and compliance frameworks, including NIST AI RMF, the EU AI Act, and ISO 42001
- Experience with AI risk classification, algorithmic impact assessments, responsible AI principles, and their practical use in enterprise or advisory settings
- Experience leading enterprise or security risk assessments, control design and testing, policy and standards development, TPRM, regulatory readiness, and AI governance implementation
- Experience with GDPR/UK GDPR and CCPA/CPRA, plus exposure to HIPAA, GLBA, or other sector-specific privacy standards
- Proven ability to lead teams, manage schedules and budgets, and deliver successfully in client-facing roles
- Exceptional written and verbal communication skills, including a record of producing executive-level materials
- Experience advising on AI governance strategy, responsible AI, or AI risk management in regulated sectors such as financial services, healthcare, energy, or defense
- Familiarity with AI lifecycle management, model validation, and AI supply-chain risk
- Preferred certifications include CISM, CISSP, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor, CIPM/CIPP (E/US), CDPSE, CAIAP, ISO 42001 Lead Implementer, or CMMC RP/CCA
- Preferred exposure to CMMC or FedRAMP readiness work
- Preferred experience with private equity or portfolio companies
- Preferred exposure to incident readiness, tabletop exercises, and crisis communications coordination
- Preferred experience supporting audit and assurance activities
Benefits
- Competitive compensation
- Benefits package
- Career development opportunities
- Collaborative culture offering autonomy, flexibility, and strong leadership support
- High-impact assignments with sophisticated clients and private equity portfolio companies
- Opportunity to help shape and expand a growing Cybersecurity practice