Senior Director, Secure MA&D

Own and evolve the enterprise Secure MA&D strategy, operating model, and capability roadmap for acquisitions, divestitures, carve-outs, joint ventures, and minority investments Establish governance, decision rights, risk thresholds, and escalation criteria for deal-impacting cyber findings Set standards for diligence playbooks, cost models, integration blueprints, Day 1 control baselines, and executive reporting Own the annual plan, budget, tooling, third-party bench, and program effectiveness metrics Lead, coach, and develop a global team of Secure MA&D principals and analysts Direct third-party diligence and integration partners, including selection, scoping, commercial terms, quality assurance, and performance management Direct pre-close cybersecurity due diligence and calibrate diligence to deal type, size, and thesis Quantify and defend remediation, integration, tooling, licensing, labor, and run-rate cost estimates Ensure cyber findings are reflected in deal documents and protections Define security requirements and exit criteria for TSAs and reverse TSAs; direct divestiture separation planning Direct Day 1 readiness, including minimum viable controls, identity and network interconnection, endpoint and email protections, logging and monitoring, and incident response coverage Own the handoff from diligence to delivery with tracked risks, owners, and funded remediation plans Lead security response for active or historical compromises at targets Establish risk acceptance and exception frameworks for inherited risks Ensure regulatory exposure is addressed across diligence and integration Aggregate inherited cyber risk into the enterprise risk register and report trends to executive risk committees Oversee third-party and fourth-party risk from acquired vendor ecosystems Align practices to NIST CSF, NIST SP 800-53, ISO 27001, CIS Controls, and HITRUST Serve as the security voice in deal committees, investment committees, and Board-level materials Translate technical findings into valuation, timing, compliance, and operational impact Brief security owners, business leaders, and acquired-company executives Lead organizational change, stakeholder engagement, training, communication, talent assessment, and tooling migration during integration Institutionalize lessons learned after each close Requirements Bachelor's degree required; advanced degree in business or a technical discipline preferred 15+ years of progressive experience in cybersecurity, technology risk, or security consulting 5+ years leading teams and enterprise-scale programs Experience leading cybersecurity due diligence and integration across multiple completed transactions At least one carve-out, divestiture, or separation experience Working fluency in deal mechanics and terminology, including letters of intent, data-room and clean-team protocols, SPA and TSA constructs, purchase price adjustments, escrow and indemnity, and representations and warranties insurance Financial acumen to build, defend, and negotiate multi-year remediation and run-rate cost estimates Breadth and depth across identity and access management, cloud and network security, endpoint, data protection, application security, security operations and incident response, vulnerability management, GRC, and third-party risk Experience in a highly regulated industry; healthcare, pharmaceutical distribution, life sciences, or medical technology strongly preferred Working knowledge of HIPAA, GxP, DSCSA, SOX, PCI DSS, and GDPR Familiarity with NIST CSF, NIST SP 800-53 and 800-171, ISO 27001, CIS Controls, and HITRUST Proven vendor management and budget ownership Ability to influence and align executive stakeholders without direct authority across global business units and geographies Exceptional written and verbal communication skills, including Board and deal-committee materials Proven discretion in handling material non-public information and simultaneous confidential transactions Willingness to travel and support compressed transaction timelines, including nonstandard hours and multiple time zones Relevant certifications such as

CISSP

, CISM, CRISC, CISA, CCSP, or PMP preferred Core Competencies Demonstrates expertise in cybersecurity due diligence, integration, and risk management, with a strong focus on leading teams and managing enterprise-scale programs. Proficient in aligning security practices with regulatory standards and effectively communicating with executive stakeholders. Highest-signal resume keywords Cybersecurity Due Diligence Enterprise Risk Management Team Leadership Regulatory Compliance Vendor Management Hard Skills Cybersecurity Technology Risk Identity and Access Management Cloud Security Network Security Data Protection Application Security Security Operations Incident Response Vulnerability Management Soft Skills Exceptional Communication Skills Influencing Stakeholders Discretion in Handling Confidential Information Certifications & Qualifications CISSP CISM

CRISC

CISA CCSP PMP Industry Keywords Healthcare Pharmaceutical Distribution Life Sciences Medical Technology

HIPAA

GxP

DSCSA

SOX

PCI DSS

GDPR Tools & Technologies

NIST CSF

ISO 27001

CIS Controls

HITRUST

GRC #J-18808-Ljbffr Jobtailor