Senior Associate, Cyber Risk Advisory

Alvarez & Marsal; Boston (MA); On-site; USD 85,000 - 120,000; Full time

Benefits offered by this job

Healthcare plans

401(k) retirement plan

Paid time off

Job summary

Alvarez & Marsal (A&M) in Boston seeks a Senior Associate – Cyber Risk Advisory to help clients understand, measure, and reduce cyber risk. You will evaluate maturity against industry frameworks, assess regulatory readiness, and craft pragmatic roadmaps for boards and executives.

You will lead interviews, coordinate with stakeholders, and deliver incident response planning, third-party risk reviews, and risk-based project work. Some travel may be required.

Qualifications

• Bachelor’s degree in Cybersecurity, Information Systems, Security and Risk Analysis, Computer Science.
• Minimum of two years of consulting experience (Big Four, specialist advisory firm, or equivalent).
• Experience with cybersecurity program or maturity assessments or regulatory compliance support.

Responsibilities

• Plan and execute cybersecurity program assessments against NIST CSF, ISO/IEC 27001, and other frameworks.
• Facilitate interviews/workshops with CISOs, IT, risk, legal, and business leaders.
• Develop incident response plans, playbooks, and tabletop exercise facilitation.
• Perform third-party risk assessments and cloud configuration reviews.
• Prepare client-ready deliverables and risk communications.

Skills

Cyber risk advisory

Consulting

Stakeholder communication

Project management

Risk assessment

Education

Bachelor’s degree in Cybersecurity, Information Systems, Security and Risk Analysis, Computer Science

Tools

PowerPoint

Excel

Job description

Description

About Alvarez & M

Alvarez & M (A&M) is a global consulting firm with entrepreneurial, action- and results-oriented professionals. We take a hands‑on approach to solving our clients' problems and helping them reach their potential. A&M is different by design: we give people ownership and impact from day one, fuel development through real opportunity, and provide direct access to leaders who invest in our growth. Our culture celebrates independent thinkers and doers who positively impact clients and shape our industry. Guided by A&M's core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity, our collaborative, globally minded environment is why our people love working at A&M.

The Team

Alvarez & M’s (A&M’s) Global Cyber Risk Services (GCRS) practice helps Boards and management teams understand and manage cyber risk, strengthen resilience, support transactions, and respond with confidence when incidents occur. As the cyber landscape continues to evolve, we help clients see that cybersecurity is not a technology issue, but a business issue. Our methods are grounded in guidance from the regulatory and industry frameworks and best practices that govern our clients’ specific business. Our team of cybersecurity experts provides prioritized findings, observations, recommendations, and a roadmap for gap closure, using expertly developed methodologies, tools, and techniques to identify vulnerabilities, system misconfigurations, and program deficiencies and improve our clients’ overall cyber posture and process maturity.

Our Services

A&M’s team includes former Chief Information Security Officers (CISOs), forensic investigators, offensive security practitioners, and senior information security professionals who help organizations articulate a strategic vision that goes well beyond the day-to-day management of cybersecurity. GCRS delivers across four service lines:

• Cyber Risk Advisory: program maturity assessments (ISO 27001, NIST, CIS Controls), risk-based program prioritization, security and privacy governance, data privacy and cyber compliance (GDPR, CCPA, NYDFS, HIPAA, PCI-DSS), third-party risk, AI security assessments, and board reporting.
• Incident Response & Forensic Investigations: breach and ransomware response, cyber war room management, comprehensive forensic investigations and log analysis, malware reverse engineering, Microsoft 365 investigations, AI incident response, expert witness and litigation support, and incident response retainers.
• Cyber Resilience: incident response program development, ransomware readiness and playbooks, cyber threat simulations and tabletop exercises, red teaming and penetration testing, threat hunting and compromise assessments, application, network, cloud and OT security assessments, and secure DevOps.
• Cybersecurity Transaction Advisory: buy‑side, sell‑side, and carve‑out cybersecurity due diligence, Day 1 readiness, separation and integration support (IMO/SMO), TSA governance and exit planning, and post‑close performance improvement.

Our clients choose A&M for our technical depth, board‑level judgment, and product‑agnostic approach. A&M is accredited by the National Security Agency (NSA) as a Cyber Incident Response Assistance (CIRA) firm and is a CREST Cybersecurity Incident Response provider, with a global footprint and dedicated cyber and forensics labs that enable in‑region data handling and rapid on‑the‑ground response.

Across GCRS, we are building practical capability to help clients navigate the security implications of artificial intelligence, including AI governance, model and pipeline security, and the emerging risks of agentic AI systems, as well as the use of AI by threat actors.

How you will contribute

Our Global Cyber Risk Services (GCRS) team is seeking a Senior Associate – Cyber Risk Advisory. You will be a key part of the continued growth of our practice. Working with organizations across all industries, you will develop your career by listening to and understanding our clients and communicating creative solutions for their specific needs, in a field where there really are no off‑the‑shelf recommendations.

As a Senior Associate within our Cyber Risk Advisory practice, you will help clients across industries understand, measure, and reduce their cyber risk. You will assess the maturity of cybersecurity programs against industry control frameworks, evaluate readiness against regulatory expectations, and develop pragmatic, prioritized future‑state roadmaps that Boards and management teams can act on.

The nature of this role means no two engagements will be the same. Your work may include cybersecurity program assessments for a healthcare system or financial institution, regulatory compliance support (e.g., NYDFS, HIPAA), incident response plan development and tabletop exercise facilitation, third‑party risk reviews, cloud configuration reviews, and cybersecurity due diligence for private equity and corporate clients evaluating acquisition targets. You will also help clients govern the use of AI safely, including assessing AI‑related security and governance risk.

As cyber‑crime continues to threaten businesses large and small, threat actors are improving their tactics, techniques, and procedures faster than corporate security teams can keep up, and are increasingly organized, collaborative, and AI‑enabled. When our clients do not have the knowledge or resources to take on the threat of a cyber‑attack, they look to us for expertise and partnership.

Key Responsibilities

• Plan and execute cybersecurity program assessments to evaluate current‑state maturity against frameworks such as NIST CSF 2.0, ISO/IEC 27001, NIST SP 800‑53, CIS Critical Security Controls, and sector‑specific requirements, and develop future‑state recommendations and roadmaps.
• Facilitate stakeholder interviews and workshops with CISOs, IT, risk, legal, and business leaders to understand the control environment and document findings.
• Support regulatory compliance and remediation efforts, including NYDFS Part 500, HIPAA, GLBA, PCI DSS, SEC cyber disclosure expectations, and other applicable state, federal, and international requirements.
• Develop and refine security and privacy policies, standards, governance models, operating models, and risk management processes.
• Support cyber risk quantification, risk register development, and risk‑based prioritization of security investments.
• Develop incident response plans, playbooks, and crisis communications procedures, and plan and facilitate executive and technical incident response tabletop exercises, including ransomware scenarios.
• Perform third‑party and vendor cyber risk assessments, and assess cloud configuration and other focused control areas as needed.
• Assess AI‑related risk, including AI governance, acceptable use, model and data security, and third‑party AI exposure, using frameworks such as the NIST AI Risk Management Framework, ISO/IEC 42001, and applicable regulatory requirements.
• Support buy‑side, sell‑side, and carve‑out cybersecurity due diligence, identifying material risks and areas requiring investment that may affect valuation, deal structure, or integration.
• Develop polished, client‑ready deliverables, including assessment reports, executive summaries, heat maps, and Board‑level presentations, and clearly communicate risk in business terms.
• Manage workstreams, timelines, and client communications; mentor analysts and interns; and contribute to GCRS methodologies, tools, and thought leadership.

Skills and Attributes for Success

• Translate complex technical and regulatory requirements into clear, business‑relevant risk statements and practical recommendations.
• Build credibility quickly with senior client stakeholders, including CISOs, CIOs, general counsel, and Board members.
• Bring structured thinking and attention to detail to fast‑moving, ambiguous, and multi‑workstream engagements.
• Take responsibility for managing workstreams, including ownership of client communication, coordination of internal resources, and planning and execution of assessment or response activities.
• Communicate information security and technology issues verbally and in writing, formally and informally, to all levels of client staff, from senior executives to technical users, and produce high‑quality written reports and documents.
• Work independently to manage and execute multiple engagements in diverse client environments, keep management apprised of status, bring engagements to completion, and follow up with clients on results.
• Develop tools, scripts, and documentation for internal team use, and actively contribute to the maintenance and enhancement of team systems, playbooks, and processes.
• Develop and complete an education plan to grow your skills consistent with client needs, and support the development of junior team members through coaching and feedback.
• Promote awareness of the team by building relationships, publishing whitepapers or advisories, contributing to marketing materials, or presenting at conferences.

Qualifications

Required

• Bachelor’s degree in Cybersecurity, Information Systems, Security and Risk Analysis, Computer Science, or a related field, supported by approximately 4–7 years of relevant experience in cyber risk advisory, cybersecurity consulting, governance, risk and compliance, or information security.
• Minimum of two years of consulting experience (Big Four, specialist advisory firm, or equivalent professional services environment).
• Direct responsibility for one or more of the following: cybersecurity program or maturity assessments, security controls gap assessments, regulatory compliance support, policy and process design or review, incident response planning, or cybersecurity due diligence.
• Working knowledge of one or more control frameworks and standards, such as NIST CSF, NIST SP 800‑53, ISO/IEC 27001/27002, CIS Controls, DFARS/NIST SP 800‑171, HIPAA, PCI DSS, or NYDFS 23 NYCRR 500.
• Demonstrated ability to facilitate interviews and workshops with senior stakeholders and to produce high‑quality written deliverables.
• Proficiency with Microsoft Office tools, particularly PowerPoint, Word, and Excel.
• Ability to occasionally work weekends and/or off hours as necessary to meet client needs, including time‑sensitive, high‑pressure situations
• Ability and willingness to travel as needed
• Strong written and verbal communication skills, with the ability to interact effectively with stakeholders from technical staff to Board members
• Strong analytical skills, solid attention to detail, and a penchant for accuracy
• History of balancing competing priorities and adapting to changing client needs while meeting deadlines
• Proven ability to create and maintain technical documentation for enterprise‑level clients

Preferred / Plus

• CISSP or CISM is a plus; additional certifications such as CISA, CRISC, CCSP, CIPP, CDPSE, ISO 27001 Lead Implementer/Auditor, or SANS GIAC certifications (e.g., GSLC, GSTRT, GCED) are valued.
• Understanding of AI security and governance risk, including threats from AI (e.g., AI‑enabled social engineering and deepfakes, prompt injection, risks of agentic AI), and familiarity with the NIST AI RMF, ISO/IEC 42001, the EU AI Act, or the OWASP Top 10 for LLM Applications.
• Experience performing cybersecurity M&A due diligence for private equity or corporate clients.
• Experience with incident response planning and tabletop exercise design and facilitation.
• Experience in regulated industries such as financial services, healthcare, or life sciences, including responding to regulatory matters.
• Experience with GRC platforms, risk quantification methods (e.g., FAIR), or data analysis and visualization tools.
• Across all GCRS roles, a solid understanding of artificial intelligence and the threats posed by and to AI systems is a plus.

Your journey at A&M

At A&M, professional growth is tied directly to performance, not tenure. Our people take on meaningful, hands‑on work supported by a performance development process that rewards contribution and fosters a culture of meritocracy. Stretch roles, evolving business needs, and firm growth create ongoing opportunities for ownership and building new skills, while direct access to senior leaders provides mentorship and real‑time coaching along the way. We also prioritize your wellbeing through comprehensive benefits and resources. Together, these elements create an environment where high‑performing professionals can continue to grow and advance from day one.

Regular employees working 30 or more hours per week are also entitled to participate in Alvarez & M Holdings’ fringe benefits consisting of healthcare plans, flexible spending and savings accounts, life, AD&D, and disability coverages at rates determined periodically as well as a 401(k) retirement savings plan. Provided the eligibility requirements are met, employees will also receive an annual discretionary contribution to their 401(k) retirement savings plan from Alvarez & M. Additionally, employees are eligible for paid time off including vacation, personal days, seventy‑two (72) hours of sick time (prorated for part time employees), ten federal holidays, one floating holiday, and parental leave. The amount of vacation and personal days available varies based on tenure and role type. Click here for more information regarding A&M’s benefits programs.

Thesalaryrange is $85,000- $120,000annually, dependent on several variables including but not limited to education, experience, skills, and geography. In addition, A&M offers a discretionary bonus program which is based on a number of factors, including individual and firm performance. Please ask your recruiter for details.

A&M does not require or administer lie detector tests as a condition of employment or continued employment. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.