Global Cybersecurity Manager

<p class="job-description-header">Who We Are</p><p>Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we help clients with total transformation-inspiring complex change, enabling organizations to grow, building competitive advantage, and driving bottom-line impact.<br><br>To succeed, organizations must blend digital and human capabilities. Our diverse, global teams bring deep industry and functional expertise and a range of perspectives to spark change. BCG delivers solutions through leading-edge management consulting along with technology and design, corporate and digital ventures—and business purpose. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, generating results that allow our clients to thrive.</p><br><br><p class="job-description-header">What You'll Do</p><p><strong>1. Lead ISPM Findings Triage (Heart of the Role)</strong></p><ul><li>Independently own and drive the triage of identity and entitlement data surfaced by BCG's ISPM system covering:<ul><li>Human identities</li><li>Non-human identities (service accounts, workloads, bots)</li><li>Privileged and highly sensitive access</li></ul></li><li>Apply senior-level judgement to classify findings by:<ul><li>Criticality per BCG risk index</li><li>Acceptable vs. contextual risk vs. noise</li><li>Elimination of false positives using business context and identity risk scoring</li></ul></li><li>Own prioritisation decisions based on risk impact, blast radius, and business alignment with full autonomy</li></ul><p><strong><span class="TextRun SCXW226523661 BCX8"><span class="NormalTextRun SCXW226523661 BCX8">2. Lead Identity Risk Interpretation & Contextualisation</span></span><span class="EOP Selected SCXW226523661 BCX8"> </span></strong></p><ul><li>Independently assess and determine justification for access including:<ul><li>Excessive privilege</li><li>Dormant but dangerous accounts</li><li>Toxic combinations</li><li>Lateral movement risk</li></ul></li><li>Map findings to real attack paths, emerging threat patterns, and regulatory requirements</li><li>Translate graph-based insights into authoritative risk narratives for technical teams and executive stakeholders including CISO, CIO, CTO, and CRO</li><li>Shape BCG's identity risk strategy through programme-level recommendations with direct senior leadership visibility</li></ul><p><strong><span class="TextRun SCXW205685816 BCX8"><span class="NormalTextRun SCXW205685816 BCX8">3. Own Remediation Outcomes</span></span></strong></p><ul><li>Define and drive specific remediation actions including:<ul><li>Entitlement right-sizing</li><li>Privilege removal or restriction</li><li>Ownership reassignment</li><li>Policy or process refinement</li></ul></li><li><span class="TextRun SCXW133197351 BCX8"><span class="NormalTextRun SCXW133197351 BCX8">Serve as the senior point of accountability for remediation progress across IAM, Cloud Security, Application Owners, and GRC</span></span><span class="EOP Selected SCXW133197351 BCX8"> </span></li><li><span class="EOP Selected SCXW133197351 BCX8"><span class="TextRun SCXW206936971 BCX8"><span class="NormalTextRun SCXW206936971 BCX8">Influence IGA development roadmap based on findings and remediation patterns</span></span><span class="EOP Selected SCXW206936971 BCX8"> </span></span></li><li><span class="EOP Selected SCXW133197351 BCX8"><span class="EOP Selected SCXW206936971 BCX8"><span class="TextRun SCXW131237065 BCX8"><span class="NormalTextRun SCXW131237065 BCX8">Track items through closure and validate measurable, reportable risk reduction at enterprise scale</span></span><span class="EOP Selected SCXW131237065 BCX8"> </span></span></span></li></ul><p><strong><span class="EOP Selected SCXW133197351 BCX8"><span class="EOP Selected SCXW206936971 BCX8"><span class="EOP Selected SCXW131237065 BCX8"><span class="TextRun SCXW264910782 BCX8"><span class="NormalTextRun SCXW264910782 BCX8">4. Own and Mature the Playbook Framework</span></span><span class="EOP Selected SCXW264910782 BCX8"> </span></span></span></span></strong></p><ul><li>Design, own, and continuously improve playbooks for:<ul><li>Privileged access risk</li><li>Non-human identity governance</li><li>Cloud-to-data access risks</li><li>Orphaned or over-permissioned identities</li></ul></li><li>Set and own enterprise programme standards including:<ul><li>Severity thresholds and risk scoring methodology</li><li>Escalation criteria and cross-team engagement models</li><li>SLA expectations for remediation by risk tier</li></ul></li><li>Lead ISPM policy tuning to continuously improve signal quality and reduce noise at enterprise scale</li></ul><p><strong><span class="TextRun SCXW85267831 BCX8"><span class="NormalTextRun SCXW85267831 BCX8">5. Serve as BCG's Senior Identity Security Subject Matter Expert</span></span><span class="EOP Selected SCXW85267831 BCX8"> </span></strong></p><ul><li><p>Act as the definitive internal authority on ISPM for the Cybersecurity function</p></li><li><p>Drive understanding of dashboards, risk trends, and identity exposure patterns across senior stakeholder teams</p></li><li><p>Lead audit and compliance responses with evidence-based, defensible explanations</p></li><li><span class="TextRun SCXW230770794 BCX8"><span class="NormalTextRun SCXW230770794 BCX8">Independently produce and own executive-ready reporting articulating: </span></span><span class="EOP Selected SCXW230770794 BCX8"> </span><ul><li><p>"What changed"</p></li><li><p>"Why it matters"</p></li><li><p>"What we are doing about it"</p></li></ul></li><li><span class="TextRun SCXW83468028 BCX8"><span class="NormalTextRun SCXW83468028 BCX8">Proactively shape identity risk strategy by identifying programme gaps and driving improvements at senior leadership level</span></span><span class="EOP Selected SCXW83468028 BCX8"> </span></li></ul><br><br><p class="job-description-header">What You'll Bring</p><p><strong>Must-Have</strong> </p><p> </p><ul><li>7-9 years of experience in IAM, cloud security, identity governance, or related security analytics </li></ul><ul><li>Deep expertise in:  </li></ul><ul><li><ul><li>Privileged access models and enterprise governance frameworks </li></ul></li></ul><ul><li><ul><li>Human vs. non-human identity risk scenarios </li></ul></li></ul><ul><li><ul><li>Entitlement and role-based risk analysis at enterprise scale </li></ul></li></ul><ul><li>Demonstrated ability to independently own complex risk decisions and drive enterprise remediation programmes across multiple senior stakeholder teams </li></ul><ul><li>Strong executive communication skills — able to translate highly technical identity risk into board-level narratives without supervision </li></ul><ul><li>Proven track record of building, owning, and maturing enterprise-scale security programmes and playbooks </li></ul><p><strong>Nice-to-Have</strong> </p><p> </p><ul><li>Hands-on experience with identity platforms such as Okta, Active Directory, and Entra ID </li></ul><ul><li>Exposure to cloud IAM across AWS, Azure, and GCP </li></ul><ul><li>Familiarity with IGA platforms and access review processes </li></ul><ul><li>Experience with ServiceNow or Jira for vulnerability and remediation tracking </li></ul><ul><li>Exposure to Zero Trust frameworks and identity-centric security architecture </li></ul><ul><li>Experience supporting identity-related audits or regulatory compliance initiatives </li></ul><p> </p><p><strong>Success Metrics</strong> </p><p> </p><ul><li>Consistent reduction in unjustified privileged access across the enterprise </li></ul><ul><li>Time-to-triage for ISPM findings at programme scale </li></ul><ul><li>Percentage of findings with clear business justification or active remediation plan </li></ul><ul><li>Demonstrable and reportable reduction in overall identity risk posture </li></ul><ul><li>Increased executive confidence in identity risk reporting and programme maturity </li></ul><ul><li>Quality and adoption of playbooks across IAM and Cloud Security teams </li></ul><p> </p><br><br><p class="job-description-header">Who You'll Work With</p><p>#ISRM</p><br><br><p class="job-description-header">Additional info</p><p>BCG's ISPM provides unparalleled visibility into identities, entitlements, and risk — but visibility alone is not risk reduction. This Senior Manager is the senior individual driving the essential link between identity discovery and measurable risk reduction. With deep expertise and enterprise-level programme influence, this role moves BCG from "we have visibility" to "we have a mature, outcomes-driven identity risk programme."</p><br><br><p>Boston Consulting Group is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, age, religion, sex, sexual orientation, gender identity / expression, national origin, disability, protected veteran status, or any other characteristic protected under national, provincial, or local law, where applicable, and those with criminal histories will be considered in a manner consistent with applicable state and local laws. <br>BCG is an E - Verify Employer. <a href="https://careers.bcg.com/global/en/e-verify" target="_blank">Click here </a> for more information on E-Verify.</p>