Private Equity and Venture Capital Cybersecurity - Manager

Job description

CFGI is seeking a Cybersecurity Consulting Manager with deep private equity and venture capital industry experience to lead and deliver high-impact advisory engagements across the investment lifecycle, from pre-deal cybersecurity due diligence and risk assessment through post-close integration, portfolio company maturity uplift, and exit readiness. This role blends hands-on delivery, executive communication, and practice leadership. You will work directly with PE/VC deal teams, operating partners, portfolio company CISOs, CIOs, CFOs, and Board/Audit Committee members to design pragmatic programs, build scalable operating models, and deliver security outcomes tied to value creation and investment thesis. The ideal candidate brings direct private equity or venture capital industry experience, either from within a PE/VC firm, a portfolio company, or a consulting practice with a dedicated PE/VC client base, combined with deep cybersecurity advisory expertise, strong commercial instincts, and a proven ability to deliver in fast-paced, deal-driven environments. Key Responsibilities: Client Advisory & Delivery: Lead cybersecurity advisory engagements across the PE/VC deal lifecycle: pre-acquisition due diligence, post-close 100-day security planning, portfolio company maturity uplift, carve-out/stand-up, and exit readiness assessments. Conduct and manage cybersecurity due diligence assessments for buy-side and sell-side transactions: identify material risks, quantify cyber exposure, and deliver findings in deal-team-ready formats (red/yellow/green risk summaries, indemnification inputs, rep & warranty considerations). Design and operationalize cybersecurity governance models (policies, standards, risk appetite, committees, reporting KPIs/KRIs) scaled appropriately to portfolio company size and PE ownership model. Build and mature enterprise risk programs: risk assessments, risk registers, control libraries, and control testing approaches. Develop and implement security policies, standards, and procedures aligned to common frameworks (e.g., NIST CSF, ISO 27001/27002, CIS, SOC 2, CMMC, FedRAMP). Support regulatory readiness and compliance initiatives relevant to PE portfolio company sectors (e.g., SEC cyber disclosure rules, SOX ITGC for pre-IPO/public-co readiness, HIPAA for healthcare portfolio companies, PCI DSS, NYDFS 500, GDPR/CCPA where applicable). Develop investment-grade cybersecurity roadmaps and remediation plans tied to PE value-creation timelines; track progress against milestones and communicate status to operating partners and deal teams. Advise on cybersecurity integration and separation activities for M&A transactions: network segmentation, identity/access migration, data classification, Day 1 security controls, and TSA/ITSA cybersecurity workstreams. Perform vendor/third-party risk assessments and implement scalable TPRM operating models appropriate for PE-owned businesses. Coordinate cross-functional stakeholders (Legal, IT, Security, Compliance, Product, HR) to drive outcomes and adoption. Executive Communication & Stakeholder Management: Translate complex technical, regulatory, and privacy requirements into business-oriented recommendations. Deliver executive-ready artifacts tailored to PE/VC audiences: LP/board cybersecurity reporting, deal-team risk summaries, portfolio-wide security heatmaps, 100-day plan progress updates, and audit committee materials. Serve as a trusted advisor to senior leadership; confidently present findings and influence decisions. Practice Development & Leadership: Contribute to go-to-market development: offerings, templates, accelerators, methodologies, and points of view. Support business development through proposal writing, SOW development, client presentations, and solution shaping. Mentor and develop consultants and managers; lead teams across multiple engagements while maintaining quality and delivery rigor. Partner with other CFGI service lines (Accounting Advisory, CFO Advisory, Technology Enablement) to deliver integrated solutions. Required Qualifications: Six plus years of relevant experience in cybersecurity consulting, GRC, risk management, or compliance with meaningful direct experience serving private equity sponsors, venture capital firms, or PE-backed portfolio companies (level will map to experience). Bachelor’s degree in a related field is required. Demonstrated expertise across the PE/VC cybersecurity advisory lifecycle: pre-acquisition cyber due diligence (buy-side and sell-side), post-close 100-day security planning and portfolio company stand-up, and integration and carve-out cybersecurity workstreams. Framework implementation and operationalization: NIST CSF, ISO 27001/27002, SOC 2, CIS Controls. Familiarity with privacy and regulatory requirements common to PE portfolio company sectors (HIPAA, GDPR/CCPA, SOX ITGC, PCI DSS); deep privacy program build-out expertise is not required. Experience performing or leading: cybersecurity due diligence assessments for M&A transactions, rapid maturity uplift and 100-day security roadmap delivery, integration or carve-out cybersecurity workstreams, enterprise/security risk assessments, control design/testing, policy and standards development, compliance/regulatory readiness programs (especially SOX ITGC, SOC 2, HIPAA for portfolio companies). Exceptional written and verbal communication skills with a track record of producing executive-level deliverables. Proven ability to lead teams, manage timelines/budgets, and deliver in a client-facing environment. Preferred Qualifications (Nice-to-Have): Certifications: CISM, CISSP, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor. Direct experience working within a private equity or venture capital firm (in-house security, operating partner role, or embedded advisory). Experience supporting portfolio-wide cybersecurity programs across multiple simultaneous investments. Exposure to incident readiness, tabletop exercises, and crisis communications coordination with Legal/Comms. Experience supporting audits and assurance activities (SOC 2 readiness, ISO certification readiness, internal audit coordination). Why CFGI: Immediate exposure to complex, high-velocity PE and VC deal environments — due diligence, integrations, carve-outs, and exit readiness — with sophisticated sponsor and portfolio company clients. Opportunity to shape and scale a fast-growing Cybersecurity practice. Collaborative culture with autonomy, flexibility, and strong leadership support. Competitive compensation, benefits, and career growth trajectory. CFGI is seeking a Cybersecurity Consulting Manager with deep private equity and venture capital industry experience to lead and deliver high-impact advisory engagements across the investment lifecycle, from pre-deal cybersecurity due diligence and risk assessment through post-close integration, portfolio company maturity uplift, and exit readiness. This role blends hands-on delivery, executive communication, and practice leadership. You will work directly with PE/VC deal teams, operating partners, portfolio company CISOs, CIOs, CFOs, and Board/Audit Committee members to design pragmatic programs, build scalable operating models, and deliver security outcomes tied to value creation and investment thesis. The ideal candidate brings direct private equity or venture capital industry experience, either from within a PE/VC firm, a portfolio company, or a consulting practice with a dedicated PE/VC client base, combined with deep cybersecurity advisory expertise, strong commercial instincts, and a proven ability to deliver in fast-paced, deal-driven environments. Key Responsibilities: Client Advisory & Delivery: Lead cybersecurity advisory engagements across the PE/VC deal lifecycle: pre-acquisition due diligence, post-close 100-day security planning, portfolio company maturity uplift, carve-out/stand-up, and exit readiness assessments. Conduct and manage cybersecurity due diligence assessments for buy-side and sell-side transactions: identify material risks, quantify cyber exposure, and deliver findings in deal-team-ready formats (red/yellow/green risk summaries, indemnification inputs, rep & warranty considerations). Design and operationalize cybersecurity governance models (policies, standards, risk appetite, committees, reporting KPIs/KRIs) scaled appropriately to portfolio company size and PE ownership model. Build and mature enterprise risk programs: risk assessments, risk registers, control libraries, and control testing approaches. Develop and implement security policies, standards, and procedures aligned to common frameworks (e.g., NIST CSF, ISO 27001/27002, CIS, SOC 2, CMMC, FedRAMP). Support regulatory readiness and compliance initiatives relevant to PE portfolio company sectors (e.g., SEC cyber disclosure rules, SOX ITGC for pre-IPO/public-co readiness, HIPAA for healthcare portfolio companies, PCI DSS, NYDFS 500, GDPR/CCPA where applicable). Develop investment-grade cybersecurity roadmaps and remediation plans tied to PE value-creation timelines; track progress against milestones and communicate status to operating partners and deal teams. Advise on cybersecurity integration and separation activities for M&A transactions: network segmentation, identity/access migration, data classification, Day 1 security controls, and TSA/ITSA cybersecurity workstreams. Perform vendor/third-party risk assessments and implement scalable TPRM operating models appropriate for PE-owned businesses. Coordinate cross-functional stakeholders (Legal, IT, Security, Compliance, Product, HR) to drive outcomes and adoption. Executive Communication & Stakeholder Management: Translate complex technical, regulatory, and privacy requirements into business-oriented recommendations. Deliver executive-ready artifacts tailored to PE/VC audiences: LP/board cybersecurity reporting, deal-team risk summaries, portfolio-wide security heatmaps, 100-day plan progress updates, and audit committee materials. Serve as a trusted advisor to senior leadership; confidently present findings and influence decisions. Practice Development & Leadership: Contribute to go-to-market development: offerings, templates, accelerators, methodologies, and points of view. Support business development through proposal writing, SOW development, client presentations, and solution shaping. Mentor and develop consultants and managers; lead teams across multiple engagements while maintaining quality and delivery rigor. Partner with other CFGI service lines (Accounting Advisory, CFO Advisory, Technology Enablement) to deliver integrated solutions. Required Qualifications: Six plus years of relevant experience in cybersecurity consulting, GRC, risk management, or compliance with meaningful direct experience serving private equity sponsors, venture capital firms, or PE-backed portfolio companies (level will map to experience). Bachelor’s degree in a related field is required. Demonstrated expertise across the PE/VC cybersecurity advisory lifecycle: pre-acquisition cyber due diligence (buy-side and sell-side), post-close 100-day security planning and portfolio company stand-up, and integration and carve-out cybersecurity workstreams. Framework implementation and operationalization: NIST CSF, ISO 27001/27002, SOC 2, CIS Controls. Familiarity with privacy and regulatory requirements common to PE portfolio company sectors (HIPAA, GDPR/CCPA, SOX ITGC, PCI DSS); deep privacy program build-out expertise is not required. Experience performing or leading: cybersecurity due diligence assessments for M&A transactions, rapid maturity uplift and 100-day security roadmap delivery, integration or carve-out cybersecurity workstreams, enterprise/security risk assessments, control design/testing, policy and standards development, compliance/regulatory readiness programs (especially SOX ITGC, SOC 2, HIPAA for portfolio companies). Exceptional written and verbal communication skills with a track record of producing executive-level deliverables. Proven ability to lead teams, manage timelines/budgets, and deliver in a client-facing environment. Preferred Qualifications (Nice-to-Have): Certifications: CISM, CISSP, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor. Direct experience working within a private equity or venture capital firm (in-house security, operating partner role, or embedded advisory). Experience supporting portfolio-wide cybersecurity programs across multiple simultaneous investments. Exposure to incident readiness, tabletop exercises, and crisis communications coordination with Legal/Comms. Experience supporting audits and assurance activities (SOC 2 readiness, ISO certification readiness, internal audit coordination). Why CFGI: Immediate exposure to complex, high-velocity PE and VC deal environments — due diligence, integrations, carve-outs, and exit readiness — with sophisticated sponsor and portfolio company clients. Opportunity to shape and scale a fast-growing Cybersecurity practice. Collaborative culture with autonomy, flexibility, and strong leadership support. Competitive compensation, benefits, and career growth trajectory.