Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 161 days ago

GRC and AI Governance - Senior Manager

CFGI76 open roles

Where
United States
Work mode
Hybrid
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowGRC and AI Governance - Senior ManagerCFGI · United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on CFGI's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

7.8% of postings close within 7 days. Measured by our own scanner across the market. CFGI postings stay open a median of 30 days.

Share of postings closed within
  1. 1.6%1 day
  2. 3.4%3 days
  3. 7.8%7 days
  4. 14.3%14 days
  5. 33.7%30 days
This job: posted 161 days ago

CFGI median: 30 days open

The posting

Cybersecurity: GRC & AI Governance – Senior Manager

CFGI is a leading advisory firm that partners with private equity sponsors, portfolio companies, and public companies to solve complex challenges across finance, technology, compliance, and business transformation. Our Cybersecurity practice is rapidly growing and supports clients through cybersecurity governance, risk and compliance (GRC), data privacy, AI governance and compliance, regulatory readiness, and operational resilience programs.

Role Overview

CFGI is seeking a Cybersecurity GRC & AI Governance Subject Matter Expert to lead and deliver strategic advisory engagements that strengthen clients’ security governance, risk management, compliance posture, AI governance programs, and privacy programs. This role blends hands-on delivery, executive communication, and practice leadership. You will work directly with CISOs, CIOs, CFOs, General Counsel/Privacy Counsel, Risk Leaders, and PE deal teams to design pragmatic programs, build operating models, and drive measurable outcomes.

The ideal candidate brings deep expertise in GRC frameworks, regulatory compliance, privacy, and AI governance and compliance (e.g., NIST AI RMF, EU AI Act), strong consulting instincts, and a proven ability to lead teams and manage multiple client workstreams.

Key Responsibilities

Client Advisory & Delivery

  • Lead end-to-end GRC and privacy engagements, including scoping, planning, execution, and executive reporting.
  • Design and operationalize cybersecurity governance models, including policies, standards, risk appetite, committees, and reporting KPIs/KRIs.
  • Build and mature enterprise risk programs, including risk assessments, risk registers, control libraries, and control testing approaches.
  • Lead AI governance and compliance engagements — design and operationalize AI governance frameworks, conduct AI risk and impact assessments, build model inventories, establish AI use-case classification and tiering, advise on responsible AI principles, and guide clients through compliance with the EU AI Act, NIST AI RMF, and ISO 42001.
  • Develop and implement security policies, standards, and procedures aligned to common frameworks, including NIST CSF, ISO 27001/27002, CIS, SOC 2, CMMC, FedRAMP, NIST AI RMF, and ISO 42001.
  • Support regulatory readiness and compliance initiatives, including SEC cyber disclosure support, NYDFS 500, GDPR/UK GDPR, CCPA/CPRA, HIPAA, PCI DSS, SOX ITGC, EU AI Act, CMMC, and FedRAMP alignment where applicable.
  • Stand up or enhance privacy programs, including data mapping/inventories, DPIAs/PIAs, DSAR processes, retention, consent management, third-party privacy risk, and privacy by design.
  • Support CMMC readiness activities where applicable, including gap analyses and compliance alignment to NIST SP 800-171.
  • Perform vendor/third-party risk assessments and implement scalable TPRM operating models.
  • Coordinate cross-functional stakeholders, including Legal, IT, Security, Compliance, Product, and HR, to drive outcomes and adoption.

Executive Communication & Stakeholder Management

  • Translate complex technical, regulatory, privacy, and AI governance requirements into business-oriented recommendations.
  • Help clients communicate AI risk posture and governance maturity to boards, regulators, and executive leadership, including EU AI Act compliance status and NIST AI RMF alignment.
  • Deliver executive-ready artifacts, including board/audit committee materials, roadmaps, operating models, heatmaps, and risk dashboards.
  • Serve as a trusted advisor to senior leadership; confidently present findings and influence decisions.

Practice Development & Leadership

  • Contribute to go-to-market development, including offerings, templates, accelerators, methodologies, and points of view.
  • Support business development through proposal writing, SOW development, client presentations, and solution shaping.
  • Mentor and develop consultants and managers; lead teams across multiple engagements while maintaining quality and delivery rigor.
  • Partner with other CFGI service lines, including Accounting Advisory, CFO Advisory, and Technology Enablement, to deliver integrated solutions.

What You Must Have

  • 8+ years of relevant experience in cybersecurity GRC, privacy, governance, risk management, compliance, or consulting.
  • Demonstrated expertise implementing and operationalizing cybersecurity frameworks and control programs, including NIST CSF/NIST 800-53, ISO 27001/27002, SOC 2, CIS, or comparable frameworks, with strong privacy fundamentals and experience with privacy program build-out and operations.
  • Demonstrated expertise in AI governance and compliance frameworks, including NIST AI RMF, EU AI Act, and ISO 42001, with experience in AI risk classification, algorithmic impact assessments, responsible AI principles, and practical application within enterprise or client-facing advisory engagements.

What Sets You Apart

  • Experience performing or leading enterprise/security risk assessments, control design and testing, policy and standards development, TPRM programs, compliance/regulatory readiness programs, and AI governance program design and implementation.
  • Experience with GDPR/UK GDPR and CCPA/CPRA, with exposure to HIPAA, GLBA, or other sectoral privacy standards.
  • Proven ability to lead teams, manage timelines and budgets, and deliver effectively in a client-facing environment.
  • Exceptional written and verbal communication skills with a track record of producing executive-level deliverables.
  • Experience advising on AI governance strategy, responsible AI programs, or AI risk management within regulated industries such as financial services, healthcare, energy, or defense.
  • Familiarity with AI lifecycle management, model validation, and AI supply chain risk.

Nice to Have

  • Certifications such as CISM, CISSP, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor, CIPM/CIPP (E/US), CDPSE, AI/ML-related certifications such as CAIAP or ISO 42001 Lead Implementer, or CMMC RP/CCA.
  • Exposure to CMMC or FedRAMP readiness activities.
  • Private equity or portfolio company experience, including rapid maturity uplift, integration, carve-out/stand-up, and pragmatic road mapping.
  • Exposure to incident readiness, tabletop exercises, and crisis communications coordination with Legal/Communications.
  • Experience supporting audits and assurance activities, including SOC 2 readiness, ISO certification readiness, CMMC certification readiness, or internal audit coordination.

Why CFGI

  • High-impact work with sophisticated clients and private equity portfolio companies.
  • Opportunity to shape and scale a fast-growing Cybersecurity practice.
  • Collaborative culture with autonomy, flexibility, and strong leadership support.
  • Competitive compensation, benefits, and career growth trajectory.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against CFGI's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on CFGI's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    CFGI's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.