Private Equity and Venture Capital Cybersecurity

About the role

Cfgi is seeking a Cybersecurity Consulting Senior Manager with deep private equity and venture capital industry experience to lead and deliver high-impact advisory engagements across the investment lifecycle, from pre-deal cybersecurity due diligence and risk assessment through post-close integration, portfolio company maturity uplift, and exit readiness. This role blends hands-on delivery, executive communication, and practice leadership. You will work directly with PE/VC deal teams, operating partners, portfolio company CISOs, CIOs, CFOs, and Board/Audit Committee members to design pragmatic programs, build scalable operating models, and deliver security outcomes tied to value creation and investment thesis. The successful candidate will own the end-to-end advisory lifecycle, translating complex cyber risk into clear investment decisions and enabling portfolio value through structured program implementation. You will be accountable for the quality and timeliness of deliverables that materially influence deal outcomes and portfolio security posture. This position requires a high degree of independence, judgment, and resilience in fast-paced, transaction-driven environments. You will shape the direction of the practice by contributing methodologies, tools, and insights that strengthen Cfgi's reputation in the private equity and venture capital cybersecurity advisory market.

Key facts

What you'll do

Lead cybersecurity advisory engagements across the PE/VC deal lifecycle, including pre-acquisition due diligence, post-close 100-day security planning, portfolio company maturity uplift, carve-out/stand-up, and exit readiness assessments.

Conduct and manage cybersecurity due diligence assessments for buy-side and sell-side transactions, identify material risks, quantify cyber exposure, and deliver findings in deal-team-ready formats such as red/yellow/green risk summaries, indemnification inputs, and rep & warranty considerations.

Design and operationalize cybersecurity governance models, including policies, standards, risk appetite, committees, and reporting KPIs/KRIs, scaled appropriately to portfolio company size and PE ownership model.

Build and mature enterprise risk programs through risk assessments, risk registers, control libraries, and control testing approaches tailored to the portfolio context.

Develop and implement security policies, standards, and procedures aligned to common frameworks such as NIST CSF, ISO 27001/27002, CIS Controls, SOC 2, CMMC, and FedRAMP where applicable.

Support regulatory readiness and compliance initiatives relevant to PE portfolio company sectors, including SEC cyber disclosure rules, SOX ITGC for pre-IPO or public company readiness, HIPAA for healthcare portfolio companies, PCI DSS, NYDFS 500, and GDPR/CCPA where applicable.

Develop investment-grade cybersecurity roadmaps and remediation plans tied to PE value-creation timelines, track progress against milestones, and communicate status to operating partners and deal teams.

Advise on cybersecurity integration and separation activities for M&A transactions, covering network segmentation, identity and access migration, data classification, Day 1 security controls, and TSA/ITSA cybersecurity workstreams.

Perform vendor and third-party risk assessments and implement scalable TPRM operating models appropriate for PE-owned businesses.

Coordinate cross-functional stakeholders, including Legal, IT, Security, Compliance, Product, and HR, to drive outcomes and adoption across portfolio companies.

Translate complex technical, regulatory, and privacy requirements into business-oriented recommendations that resonate with investment professionals and board-level audiences.

Deliver executive-ready artifacts tailored to PE/VC audiences, such as LP and board cybersecurity reporting, deal-team risk summaries, portfolio-wide security heatmaps, 100-day plan progress updates, and audit committee materials.

Serve as a trusted advisor to senior leadership, confidently presenting findings and influencing decisions in high-stakes, time-sensitive transaction environments.

Contribute to go-to-market development by shaping offerings, templates, accelerators, methodologies, and points of view that enhance the Cfgi service proposition in private equity and venture capital cybersecurity advisory.

Support business development through proposal writing, statement of work development, client presentations, and solution shaping to win new engagements in the PE/VC advisory space.

Mentor and develop consultants and managers, leading project teams across multiple engagements while maintaining delivery quality and consistency.

Partner with other Cfgi service lines, including Accounting Advisory, CFO Advisory, and Technology Enablement, to deliver integrated solutions that address multifaceted client challenges.

Requirements

Eight plus years of relevant experience in cybersecurity consulting, GRC, risk management, or compliance with meaningful direct experience serving private equity sponsors, venture capital firms, or PE-backed portfolio companies at a level that will map to experience.

Bachelor's degree in a related field is required as a foundational credential for this advisory role.

Demonstrated expertise across the full PE/VC cybersecurity advisory lifecycle, including pre-acquisition cyber due diligence on both buy-side and sell-side transactions, post-close 100-day security planning and portfolio company stand-up, as well as integration and carve-out cybersecurity workstreams.

Framework implementation and operationalization capability with NIST CSF, ISO 27001/27002, SOC 2, and CIS Controls, reflecting hands-on experience in designing and maturity models.

Familiarity with privacy and regulatory requirements common to PE portfolio company sectors, such as HIPAA, GDPR/CCPA, SOX ITGC, PCI DSS, NYDFS 500, with awareness of SEC cyber disclosure rules; deep privacy program build-out expertise is not required for this role.

Experience performing or leading cybersecurity due diligence, risk assessments, control evaluations, and remediation planning in fast-paced, deal-driven environments where timelines and stakeholder expectations are demanding.

Strong ability to operate independently and manage multiple concurrent engagements while maintaining rigorous quality standards and attention to detail.

Effective communication skills to interact confidently with executive stakeholders, including CISOs, CIOs, CFOs, and Board or Audit Committee members across various stages of the deal lifecycle.

Capacity to travel within the United States for client engagements, including occasional overnight stays, as project requirements dictate.

Ability to adapt to evolving client needs and regulatory landscapes while maintaining a pragmatic, solutions-oriented approach aligned with PE value-creation objectives.

Committed to upholding professional standards, ethical conduct, and confidentiality when handling sensitive cybersecurity and private equity advisory matters.