Principal Cyber Risk Advisor, Cybersecurity M&A

Description

• Manage third-party providers for surge capacity/testing/regulatory advisory; integrate and QA outputs.
• Operate in a matrix with DT M&A/PMO, Business Development, Legal, Privacy, Finance, Insurance, Sourcing, and BU security; lead cross-functional squads.
• Own Day 1 control readiness; build and execute 30/60/100-day plans and drive TSA exit milestones.
• Provide executive-ready risk narratives, options/trade-offs, and recommendations under tight timelines.
• Quantify risk and remediation (capex/opex, timeline) and translate into valuation, PPAs, holdbacks, R&Ws/indemnities, and closing conditions.
• Track and report KPIs (flow efficiency, diligence cycle time, Day 1 control coverage, TSA months saved, post-close findings); drive continuous improvement.
• Lead pre-sign red-flag and full due diligence for GE Vernova's Deal Processes in DT and OT/ICS targets aligned to NIST CSF, SP 800-53/800-171, and 800-82.
• Develop and run standard playbooks for IAM/PAM, network segmentation/zero trust, endpoint/EDR, cloud tenancy/landing zones, app security, data discovery/classification/transfer, logging/SIEM, vulnerability management, third-party risk, IR, and BCP/DR.
• Establish clean-room protocols and data handling standards; ensure privacy and cross-border compliance (e.g., DPIAs).
• Control gap assessment with target state; quantified remediation estimates; executive risk register and heatmap.
• Design/govern safe OT/ICS integration and segmentation strategies; assess NERC CIP applicability and compliance contours.

Requirements

• Track record delivering Day 1 readiness and 30/60/100-day execution with TSA exits in global environments.
• Hands-on depth in IAM/PAM, network/cloud security, endpoint/EDR, data protection, logging/monitoring, vuln mgmt, third-party risk, IR, and BCP/DR.
• Day 1 control checklist and exceptions log; 30/60/100-day plan with critical path and TSA exit criteria.
• Relevant certifications: CISSP, CISM, CRISC, CISA, GICSP, CCSK/CCSP, cloud provider certs.
• Proven ability to quantify risk/remediation and translate into deal economics and SPA/TSA language.
• OT-heavy transaction experience (generation, grid, renewables); prior clean-room design/operations.
• Deep knowledge of NIST CSF, SP 800-53/800-171, and 800-82; familiarity with NERC CIP.
• Deal dashboard, weekly executive updates, risk/issue logs; post-close lessons learned; BU handover package.
• Executive communication and matrix leadership; ability to lead external advisors.
• Bachelor’s degree in cybersecurity, computer science, engineering, or related field (or equivalent experience).
• 10+ years in cybersecurity with significant M&A diligence and integration/separation leadership.
• Risk quantification (e.g., FAIR or equivalent); Lean/Agile/PMO experience with metrics focus.
• Red-flag memo; preliminary NIST scorecard; diligence plan and data room list; clean-room SOPs.
• OT/ICS Purdue mapping; zone/conduit strategy; NERC CIP relevance assessment (as applicable).
• Experience across IT and OT/ICS security, including segmentation and operational resilience.
• Experience improving cyber insurance submissions and influencing SPA/TSA controls.

Benefits

• Location: Flexible US; hybrid/remote options based on candidate location.
• SPA/TSA cyber clause recommendations; insurance underwriting package.
• Integration/separation runbooks/playbooks; cutover command-center and stabilization plans.

Training + Development

Interview process

Visa Sponsorship

Security clearance