Global Cybersecurity Director - Risk & Compliance

About the role

The Director, Federal Security Governance, Risk & Compliance (SGRC) role at BCG Federal serves as the senior accountable lead for the SGRC pillar. This role drives the strategy, risk governance, regulatory compliance, certification readiness, and control maturity agenda across all BCG Federal offerings.

Responsibilities

• Lead the Federal GRC pillar strategy, roadmap, operating model, governance rhythm, reporting structure, and control maturity agenda across BCG Federal.
• Direct enterprise compliance initiatives supporting DFARS, CMMC Level 2, NIST 800-171/, FedRAMP, AI governance, cloud security, and related federal cybersecurity requirements.
• Partner closely with Security Architecture to align policies with technical engineering; defining what control outcomes are required while Architecture designs how technical controls and baselines are configured.
• Own organizational readiness for federal assessments and certifications, including assessment scoping, SSP development, evidence preparation, stakeholder preparation, audit defense, C3PAO engagement, and executive reporting.
• Establish and mature Federal AI Governance, including risk methodologies, safety frameworks (e.g., NIST AI RMF), boundary protections, and approval pathways for secure adoption of Generative AI and LLMs.
• Own the federal risk register governance model, including risk identification, severity assessment, mitigation planning, exception management, escalation, and reporting.
• Lead cybersecurity review of federal contracts, RFPs, client opportunities, software approvals, cloud service reviews, and third-party vendor risk management to support secure technology adoption.
• Lead organizational change management for federal cybersecurity and compliance initiatives, including stakeholder alignment, communications, training, readiness tracking, and sustainment of new governance processes.
• Oversee continuous monitoring (CONMON) governance, evidence traceability, recurring review cadences, POA&M tracking, and management reporting.
• Define and deliver executive-level metrics, dashboards, QBR content, risk reporting, compliance status updates, and decision-ready materials for leadership.
• Lead, mentor, onboard, and develop GRC personnel while improving team operating rhythms, accountability, prioritization, and delivery quality.

Requirements

• 10+ years of experience in cybersecurity, information security, GRC, audit, compliance, risk management, or technology governance environments.
• Demonstrated experience leading federal cybersecurity compliance programs (preferably supporting CMMC Level 2, NIST 800-171/53, FedRAMP) in consulting, cloud, SaaS, or federal contracting environments.
• Direct experience leading or materially supporting external assessments, regulatory inquiries, audit readiness efforts, C3PAO assessments, evidence preparation, and audit defense.
• Proven track record establishing AI Security Governance, evaluating machine learning/GenAI security risks, and applying federal AI risk management frameworks.
• Proven ability to partner with Security Architecture, DevSecOps, and IT engineering teams to translate complex legal and federal requirements into practical operating baselines.
• Strong organizational change management experience, including leading cross-functional process adoption, stakeholder readiness, communications, training, and sustainment of new operating models.
• Excellent written and verbal communication skills, including experience developing executive briefings, policies, audit materials, and management-level reporting.
• Ability to obtain and maintain a U.S. Government Secret Clearance where required.

Qualifications

• Master's degree in a relevant field (e.g., Computer Science, Information Systems, Cybersecurity).
• CISSP, CISM, or equivalent certifications preferred.

Skills

• Strategic thinking and problem-solving skills.
• Strong project management and leadership abilities.
• Experience with federal regulations and compliance standards (CMMC Level 2, NIST SP 800-171/53, FedRAMP).
• Knowledge of Generative AI and machine learning security principles.
• Experience with cloud security and compliance frameworks.

Benefits

Boston Consulting Group offers a comprehensive benefits package including:

• Zero dollar ($0) health insurance premiums for BCG employees, spouses, and children.
• Low $10 (USD) copays for trips to the doctor, urgent care visits and prescriptions for generic drugs.
• Dental coverage, including up to $5,000 in orthodontia benefits.
• Vision insurance with coverage for both glasses and contact lenses annually.
• Reimbursement for gym memberships and other fitness activities.
• Fully vested Profit Sharing Retirement Fund contributions made annually, whether you contribute or not, plus the option for employees to make personal contributions to a 401(k) plan.
• Paid Parental Leave and other family benefits such as elective egg freezing, surrogacy, and adoption reimbursement.
• Generous paid time off including 12 holidays per year, an annual office closure between Christmas and New Years, and 15 vacation days per year (earned at 1.25 days per month).
• Paid sick time on an as needed basis.