VP, Financial Planning & Analysis

Level Blue reduces risk and builds lasting resilience so organizations can innovate and advance their mission with confidence. As the world’s most analyst-recognized and largest pure-play managed security services provider, Level Blue elevates client outcomes that matter: stronger defense, faster response, and sustained business continuity. Level Blue combines AI-powered security operations, advanced threat intelligence, and elite human expertise to provide the most comprehensive portfolio of strategic advisory, managed security, offensive security, and incident response services.

Location: New York or Chicago — or remote US east coast with regular HQ presence

Reports to: Chief Financial Officer

Partners with: Corporate Controller / CAO, VP Treasury, VP Corporate Development, Integration Management Office, Revenue Operations

Direct reports: 4–6 (Corporate FP&A, GTM Finance, Delivery/Services Finance, G&A Finance, Planning Systems); ~12–18 total function

Status: Full-time, exempt

Level Blue is the largest pure-play managed security services provider in the world — a 2024 carve-out of AT&T Cybersecurity, majority-owned by Will Jam Ventures with AT&T retaining a minority stake, now past $1B of business following the acquisitions of Trustwave, Cybereason, and the Alert Logic managed services business.

That growth outpaced the finance operating model behind it.
This role is integration-first. Level Blue today runs on four sets of books, four planning conventions, four definitions of a customer, and a synergy case that has to be proven rather than asserted. The VP of FP&A reports to the CFO and is the person who turns that into one company with one plan, one set of numbers, and a credible bridge from underwriting case to realized result — while continuing to run the forecast the board, the sponsor, and the lenders rely on.

This is a build role with board and sponsor visibility from week one, on the critical path to the company’s next liquidity milestone. It is not a caretaker forecasting job.

• Own the financial spine of integration in partnership with the IMO: synergy tracking against the underwriting case, bottom-up by initiative and owner, with realized-versus-plan reported monthly to the CFO, sponsor, and board.
• Enforce clean separation of one-time integration cost, run-rate savings, and dis-synergies. No synergy claimed without a line item and an owner.
• Model and track TSA exit economics and stranded-cost burn-down from the AT&T carve-out and each subsequent acquisition.
• Own the revenue side of the synergy case, not just cost: cross-sell and attach assumptions across the acquired customer bases, re-based retention cohorts, and honest visibility into which revenue synergies are landing.
• Build the repeatable finance integration playbook — Day 1 reporting, Day 100 plan consolidation — so the next acquisition is faster than the last.

Consolidate legacy Level Blue, Trustwave, Cybereason, and Alert Logic planning into a single driver-based operating model on a common chart of accounts, entity structure, and cost taxonomy. Restate acquired-entity history onto a comparable basis. Retire the spreadsheet-of-record.

Establish and defend the enterprise definitions of ARR, net revenue retention, gross and net bookings, backlog, and contracted-not-billed — and own the reconciliation from those metrics to GAAP revenue with the Controller. Today’s variance between systems is a diligence finding waiting to happen.

Build margin visibility by delivery line — SOC operations, MDR/XDR, professional services and…