Principal Risk Advisor

Job Description Summary

The MA&D Risk and Third-Party Risk Manager is responsible for leading cybersecurity and data privacy risk management across mergers, acquisitions, divestitures, and other strategic transactions, as well as supporting broader third-party risk activities. This role coordinates due diligence and readiness assessments with internal stakeholders and external providers, translates complex technical findings into clear business risk insights, and supports risk-informed decision-making throughout the deal lifecycle and integration phases.

The manager also contributes to the development and improvement of MA&D and third-party risk standards, processes, and metrics, helping to reduce cyber and privacy risk, improve integration outcomes, and enhance the overall maturity and consistency of enterprise risk practices.

The MA&D Risk and Third-Party Risk Manager serve as a key risk lead and coordinator for cybersecurity and data privacy across mergers, acquisitions, divestitures, and other strategic transactions. This role is responsible for coordinating readiness assessments, interpreting complex technical findings into business-focused risk insights, and supporting risk-informed decision-making throughout the deal lifecycle. The manager will coordinate MA&D risk processes, contribute to standards, and monitor performance metrics to help ensure consistent, timely, and high-quality execution.

• Lead cybersecurity and data privacy risk scoping and planning for mergers, acquisitions, divestitures, joint ventures, and other strategic transactions.
• Coordinate MA&D cybersecurity and privacy readiness assessments with external providers, including but not limited to maturity assessments, compromise assessments, software composition analysis, application security testing (SAST/DAST), Office 365 security reviews, network security assessments, red team exercises, executive background research, and integration support.
• Review and synthesize provider assessment outputs, translating technical findings into clear, business-focused risk summaries that highlight significant business impacts, likelihood and severity, and prioritization of remediation activities.
• Develop and present structured recommendations to support deal decisions, including risk acceptance, mitigation strategies, deal term adjustments, and conditions for close (e.g., remediation milestones and required controls).
• Partner with Corporate Development, Cybersecurity, Privacy, Legal, IT, and business leaders to integrate cybersecurity and privacy risk considerations into deal evaluation, negotiation, and integration planning.
• Coordinate Day 1 cyber readiness activities and support the design and implementation of future‑state cyber operating models for acquired or divested entities, ensuring alignment with enterprise security standards and control frameworks.
• Convert assessment findings into actionable remediation plans with clear owners, timelines, and tracking mechanisms; monitor progress, escalate delays or critical risks, and provide options and trade‑offs to stakeholders.
• Contribute to the development, maintenance, and continuous improvement of MA&D risk management standards, procedures, and playbooks, ensuring alignment with enterprise cybersecurity and privacy policies and standard control frameworks (such as NIST, CIS, ISACA, or ISO).
• Collaborate with security awareness and training program owners to ensure MA&D‑related requirements, patterns, and lessons learned are incorporated into training, guidance, and communications for key stakeholder groups.
• Oversee the repository of MA&D projects, assessments, risks, and compliance issues in the governance, risk, and compliance (GRC) tool, working with operations and GRC teams to ensure workflows are in place to trigger security reviews based on data risk ratings and to track findings through remediation and closure.
• Manage MA&D‑related cybersecurity and privacy policy exceptions, ensuring that exceptions are documented, approved, monitored, and reviewed or closed prior to expiration; ensure that automated alerts are issued to the SOC or relevant teams…