Cfgi
GRC and AI Governance - Senior Manager
United States · Senior
Sponsorship not specified$171k-$800kDetected 89 days ago
Machine LearningCybersecurityComplianceStakeholder ManagementBusiness DevelopmentAccountingAuditingSupply ChainHIPAALeadershipCommunicationPublic SpeakingInternal Audit
About the role
- This role blends hands-on delivery, executive communication, and practice leadership.
Responsibilities
- Lead end-to-end GRC and privacy engagements, including scoping, planning, execution, and executive reporting.
- Design and operationalize cybersecurity governance models (policies, standards, risk appetite, committees, reporting KPIs/KRIs).
- Build and mature enterprise risk programs: risk assessments, risk registers, control libraries, and control testing approaches.
- Lead AI governance and compliance engagements - design and operationalize AI governance frameworks, conduct AI risk and impact assessments, build model inventories, establish AI use-case classification and tiering, advise on responsible AI principles, and guide clients through compliance with the EU AI Act, NIST AI RMF, and ISO 42001.
- Develop and implement security policies, standards, and procedures aligned to common frameworks (e.g., NIST CSF, ISO 27001/27002, CIS, SOC 2, CMMC, FedRAMP, NIST AI RMF, ISO 42001).
- Support regulatory readiness and compliance initiatives (e.g., SEC cyber disclosure support, NYDFS 500, GDPR/UK GDPR, CCPA/CPRA, HIPAA, PCI DSS, SOX ITGC, EU AI Act, CMMC, FedRAMP alignment where applicable).
- Stand up or enhance privacy programs: data mapping/inventories, DPIAs/PIAs, DSAR processes, retention, consent management, third-party privacy risk, and privacy by design.
- Perform vendor/third-party risk assessments and implement scalable TPRM operating models.
- Coordinate cross-functional stakeholders (Legal, IT, Security, Compliance, Product, HR) to drive outcomes and adoption.
- Deliver executive-ready artifacts: board/audit committee materials, roadmaps, operating models, heatmaps, and risk dashboards.
Requirements
- Bachelor's degree in a related field is required.
- Demonstrated expertise implementing and operationalizing cybersecurity frameworks and control programs: NIST CSF / NIST 800-53, ISO 27001/27002, SOC 2, CIS, NIST AI RMF, ISO 42001
- Strong privacy fundamentals and experience with privacy program build-out and operations: GDPR/UK GDPR, CCPA/CPRA
- Exceptional written and verbal communication skills with a track record of producing executive-level deliverables.
Nice to have
- CMMC RP or CCA a plus.
- PE/portfolio company experience: rapid maturity uplift, integration, carve-out/stand-up, and pragmatic road mapping.
- Exposure to incident readiness, tabletop exercises, and crisis communications coordination with Legal/Comms.
- Experience supporting audits and assurance activities (SOC 2 readiness, ISO certification readiness, CMMC certification readiness, internal audit coordination).
- familiarity with AI lifecycle management, model validation, and AI supply chain risk.
- High-impact work with sophisticated clients and private equity portfolio companies.
- Opportunity to shape and scale a fast-growing Cybersecurity practice.
- Support CMMC readiness activities where applicable, including gap analyses and compliance alignment to NIST SP 800-171 (experience a plus, not required).
Compensation
- Competitive compensation, benefits, and career growth trajectory.
Benefits
- Competitive compensation, benefits, and career growth trajectory.
Company info
- Experience advising on AI governance strategy, responsible AI programs, or AI risk management within regulated industries (financial services, healthcare, energy, defense); familiarity with AI lifecycle management, model validation, and AI supply chain risk.
This listing is sourced directly from Cfgi's careers page and normalized into a canonical job model.