Security and Risk Director

Who We Are

Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we help clients with total transformation-inspiring complex change, enabling organizations to grow, building competitive advantage, and driving bottom-line impact.

To succeed, organizations must blend digital and human capabilities. Our diverse, global teams bring deep industry and functional expertise and a range of perspectives to spark change. BCG delivers solutions through leading-edge management consulting along with technology and design, corporate and digital ventures—and business purpose. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, generating results that allow our clients to thrive.

What You'll Do

The Director of Security & Risk serves as the senior security and risk leader for the firm's U.S. Federal Government business, with expanding responsibilities including State and Local Government business. Reporting directly to US Government business leadership, this role provides strategic oversight, executive advisory, and operational leadership to protect the BCG’s people, information, operations, and ability to conduct government business. The Director is responsible for establishing and executing security and risk management strategies that ensure compliance with applicable government security requirements, safeguard classified and controlled unclassified information (CUI), and strengthen organizational resilience.

The Director oversees the Facility Security Officer (FSO), leads the business response to sensitive information incidents, and drives security governance, employee training, and business continuity planning. Working closely with government business leaders, Cybersecurity, Legal, Contracts, Finance, and other corporate functions, the Director translates complex security requirements into practical business solutions, proactively manages emerging risks, and enables the firm's continued growth and successful delivery of government engagements.

Your work may include…

Security Strategy, Governance & Executive Advisory

* Serve as the senior security and risk advisor to BCG Federal leadership, representing the organization's security risk posture to executive leadership,
* Board committees, internal governance forums, regulators, and external auditors, and facilitating risk escalation and acceptance decisions within established governance and delegated authority.
* Develop and execute security and risk management strategies, governance frameworks, and policies that protect BCG Federal's people, information, operations, and ability to conduct government business, while supporting the broader U.S. Public Sector business as it grows.
* Identify potential systemic gaps, assess emerging risks, and drive prioritized remediation and continuous improvement to strengthen security program effectiveness.
* Establish risk reporting, performance metrics, and escalation protocols to provide leadership with visibility into material risks, compliance obligations, and corrective actions.

Federal Security Compliance & Industrial Security Oversight

* Provide strategic leadership and oversight of the Facility Security Officer (FSO) and industrial security function, ensuring effective management of personnel and facility clearances, continuous vetting, classified contracts, and associated government security obligations.
* Oversee compliance with applicable federal security regulations, contractual obligations, and agency-specific requirements, including the National Industrial Security Program Operating Manual (NISPOM).
* Establish governance and oversight for the protection and appropriate handling of classified information and Controlled Unclassified Information (CUI), partnering with the FSO, Government Cybersecurity, and other relevant functions to ensure effective policies, procedures, and controls.
* Review business development opportunities, project scopes, and contractual requirements to identify security risks early, advise business leadership, and support compliance throughout the engagement lifecycle.

Export Compliance & Government Regulatory Requirements

* Enhance and oversee BCG Federal's U.S. export compliance program, including governance, policies, procedures, training, and monitoring to support adherence to applicable export control requirements.
* Partner with Legal, Contracts, Compliance, and business leadership to assess export control risks, coordinate authorization processes, and enable compliant participation in sensitive defense and international government programs.
* Assess business implications of applicable federal IT and data security requirements, including Section 889, DFARS 252.204-7012, NIST SP 800-171, and CMMC, partnering with Government Cybersecurity on assessment readiness and ongoing compliance activities.
* Coordinate with Government Cybersecurity and other stakeholders on insider threat and Foreign Ownership, Control, or Influence (FOCI) mitigation requirements, ensuring alignment with government security obligations and established program ownership.

Security Incident Management & Business Continuity

* Lead the business response to security incidents involving classified information, CUI, or other sensitive government information, including escalation, business impact assessment, remediation oversight, and executive communications.
* Coordinate with the FSO, Government Cybersecurity, Legal, Compliance, and other stakeholders to ensure appropriate incident containment, investigation, reporting, and corrective actions in accordance with government and contractual requirements.
* Establish and oversee business continuity and operational resilience plans addressing security-related disruptions, including sensitive information spills, to minimize impacts on government engagements and business operations.
* Drive post-incident reviews and improvements to security policies, controls, training, and response procedures to strengthen organizational preparedness and reduce recurrence.

Business Partnership, Training & Operational Excellence

* Serve as a strategic partner to federal business leadership and collaborate with Finance, Contracts, Compliance, Cybersecurity, Legal, and other stakeholders to navigate complex security requirements, manage risks, and enable business objectives.
* Oversee security awareness and enhance training programs for federal and relevant U.S. Public Sector personnel, including classified information handling, CUI protection, incident reporting, and regulatory obligations.
* Drive implementation of AI tools, automation, and process improvements to strengthen security program visibility, compliance tracking, workflow management, and support for client-facing teams.
* Lead and develop the security team, establishing priorities, performance expectations, and resource plans while coaching and mentoring talent.

You're Good At:

* Translating complex compliance requirements into actionable workstreams and communicating them to non-technical stakeholders
* Superior analytical skills and creative problem-solving ability, with an appreciation for striking a practical balance between business and legal objectives
* Talent for absorbing new skill sets and areas of expertise quickly and comfortably and the flexibility to deal with changing situations and priorities with tact, poise, and patience
* Ability to perform successfully and produce results in a fast-paced, intellectually intense environment
* Experience in building or improving security intake, triage, and remediation tracking workflows that scale
* High level of self-motivation and initiative; follows through and sees tasks to completion
* A ‘player-coach’ mentality. Ability to take on tasks of your own while delegating projects to

View and apply on HireChats