Senior Consultant - Cyber Security

Lead regulatory remediation programs. Translate MRAs, MRIAs, Matters Requiring Attention, Consent Orders, and 500.17 (NY DFS) cybersecurity event notifications into prioritized remediation plans with defensible milestones, evidence requirements, and validation criteria.

Run point with examiners and internal audit. Prepare clients for FRB, OCC, FDIC, NY DFS, SEC, and FFIEC exams and continuous-monitoring touchpoints. Draft response letters, walkthroughs, and evidence packages. Defend the work.

Drive technical remediation, not just documentation. Partner with client CISO, IT Risk, Infrastructure, and IAM teams to actually close findings — not just status-report them. Push for engineering outcomes, not slideware.

Run cyber incident response engagements. Lead or co-lead client-side IR for material events: containment strategy, forensic coordination, regulator and law-enforcement notification timing, executive and board communications, and post-incident remediation.

Strengthen vulnerability and patch management programs. Assess current-state VM/patch operations, design risk-based SLAs, build exception governance, and operationalize tooling (Qualys, Tenable, Rapid7, Wiz, ServiceNow VR) so remediation actually happens at SLA.

Lead IAM remediation workstreams. Drive privileged access management, joiner-mover-leaver, recertification, segregation-of-duties, and identity governance improvements. Reduce standing privilege and clean up the access debt regulators flag.

Coach the team. Mentor analysts and consultants. Review their deliverables. Raise the bar on what “good” looks like in a remediation deliverable.

Grow the practice. Contribute to proposals, thought leadership, and methodology assets. Identify follow-on work with existing clients.