Director, National Security-Cybersecurity Governance

Alvarez & Marsal supports teams doing national security-focused cybersecurity work across advisory, oversight, and audit engagements. In this role, you will help organizations, investors, and counsel identify, assess, and reduce national security-related risk through modern security architectures, enterprise-grade solutions, and regulatory-aligned security controls.

How you will contribute

• Support organizations, investors, and counsel in identifying, assessing, and reducing national security-related risk through modern security architectures and enterprise-grade solutions.
• Implement Zero Trust frameworks, establish robust Identity and Access Management (IAM) controls, and embed regulatory requirements into business systems and processes.
• Facilitate transparency between companies and regulators using data analytics, automated compliance monitoring, and advanced security tooling.
• Serve as fiduciary to U.S. government agencies as a third-party monitor or third-party auditor, supporting adherence to federal security standards and frameworks.

Responsibilities

• Lead cross-functional project teams delivering advisory, oversight, and audit work related to Foreign Direct Investment (FDI) national security reviews, export and technology controls, and Cybersecurity Maturity Model Certification (CMMC). Own project plans, set key milestones, and manage resource allocation using enterprise project management methodologies and tools.
• Design and implement Zero Trust architecture frameworks and IAM solutions, including privileged access management (PAM), role-based access control (RBAC), and continuous authentication. Partner with client security personnel to define and document security controls for distributed, big data environments with emphasis on least-privilege access.
• Conduct enterprise-wide security assessments to validate administrative, technical, and physical safeguards, with focus on identity governance, access management, and Zero Trust implementation.
• Assess security control maturity against NIST 800-53, ISO 27001, and CMMC and evaluate alignment to applicable frameworks.
• Direct comprehensive application and software security assessments, including architecture diagram reviews for identity and access flows, interviews across DevSecOps teams, evaluation of IAM integration points and Zero Trust, oversight of static and dynamic code analysis, management of network penetration testing, and preparation of detailed technical reports for senior counsel, executives, and national security officials.
• Analyze and interpret penetration test results, emphasizing identity-related vulnerabilities, access control weaknesses, and deviations from Zero Trust principles. Produce remediation roadmaps aligned with enterprise architecture standards.
• Implement and integrate security technologies such as SIEM, IGA, and PAM to support automated compliance monitoring and security oversight.
• Create and maintain project management artifacts including work breakdown structures, risk registers, and resource allocation plans. Establish project governance frameworks and reporting mechanisms to support alignment with organizational objectives and regulatory requirements.
• Maintain availability for up to 20% travel to client sites and security assessment locations.

Requirements

• 8+ years of experience with technology companies that deliver controlled technology nationally and internationally.
• Experience with NIST CSF, NIST SP 800-53, NIST SP 800-171, NIST SP 800-218, NIST SP 800-161, and/or ISO 27001.
• Cybersecurity governance experience, including work with NIST CSF, NIST 800-171 and -53, CIS-18 IG1, and ISO 27001.
• Proficiency in at least one programming language (for example, Python or Java).
• Background in network and cloud-based platforms (for example, GCP, AWS, Kubernetes).
• Familiarity with containerization technologies and deployments.
• Experience with Big Data platforms (on premise and cloud).
• Ability to obtain a USG security clearance.
• One or more relevant industry certifications: CompTIA Security+, CompTIA CySA+, CompTIA CASP+, CISSP, CISM, CISA, ISO 27001, or comparable certifications.

Benefits

• Healthcare plans
• Flexible spending and savings accounts
• Life, AD&D, and disability coverages
• 401(k) retirement plan
• Discretionary contribution to their 401(k) from Alvarez & Marsal (provided eligibility requirements are met)
• Paid time off including vacation and personal days
• Seventy-two (72) hours of sick time (prorated for part time employees)
• Ten federal holidays
• One floating holiday
• Parental leave
• Formalized and on the job training
• Networking opportunities with renowned legal and accounting experts

Salary range

$130,000 - $175,000 per year, dependent on education, experience, skills, and geography. A discretionary bonus program may be available based on individual and firm performance.

Location and travel

Washington, DC 20005 (onsite). Travel up to 20% may be required to client sites and security assessment locations.

Technologies and frameworks

Zero Trust, IAM, PAM, RBAC, continuous authentication mechanisms, least-privilege access principles, NIST 800-53, ISO 27001, CMMC, NIST CSF, NIST SP 800-171, NIST SP 800-218, NIST SP 800-161, CIS-18 IG1, Python, Java, GCP, AWS, Kubernetes, containerization technologies, Big Data platforms, SIEM, IGA, DevSecOps, static and dynamic code analysis, network penetration testing, architecture diagrams, FDI.

How you will grow and be supported

• Gain experience across different industries, sectors, and companies on critical projects.
• Apply critical thinking, analysis, and research skills in complex, ambiguous situations.
• Distill findings into concise, intuitive, and compelling data stories.
• Work closely with experienced professionals who provide developmental feedback.
• Lead project workstreams and gain exposure to disputes and investigations across a range of clients and industries.
• Access formalized and on the job training resources and networking opportunities with renowned legal and accounting experts.