Senior Manager, Pre-Close Security

Role Overview

The Senior Manager, Information Security Risk Management (ISRM) Acquisitions & Divestitures (A&D) Cybersecurity, Pre-Close, reports directly to the Director, ISRM A&D Cybersecurity, Pre-Close and serves as a hands-on Deal Lead for cybersecurity due diligence across mergers, acquisitions, divestitures, licensing arrangements, minority investments, and strategic partnerships. This role is responsible for leading deal-level cybersecurity assessments, translating diligence evidence into clear risk insights, identifying material technical and regulatory concerns, and supporting risk-informed transaction decisions before close.

The Senior Manager brings strong technical depth across enterprise cybersecurity and technology domains and is expected to evaluate target-state environments, challenge assumptions, troubleshoot complex issues, and define practical mitigation recommendations. The Senior Manager partners with Corporate Development, Legal, Privacy, Finance, Technology Services, ISRM capability and policy owners, business technology leaders, external advisors, and transaction teams to ensure cybersecurity risks, enterprise requirements, and Day 1 security priorities are understood, documented, escalated, and transitioned to post-close execution teams.

Key Responsibilities

• Deal Lead for Pre-Close Cybersecurity Due Diligence: Serve as the primary ISRM A&D cybersecurity lead for assigned transactions, coordinating diligence activities, managing assessment timelines, tracking evidence needs, and ensuring findings are clearly documented for deal teams and leadership.
• Technical Risk Assessment & Analysis: Evaluate target environments across security architecture, identity, network, endpoint, cloud, application security, data protection, vulnerability management, incident response, third-party risk, and cyber resilience to identify material risks, control gaps, remediation needs, and integration or separation implications.
• Diligence Execution & Evidence Review: Lead cybersecurity questionnaire review, management meeting preparation, outside-in assessment coordination, documentation analysis, follow-up inquiries, advisor engagement, and consolidation of evidence into practical risk conclusions.
• Transaction Risk Decision Support: Translate technical findings into business-relevant recommendations that inform risk acceptance, contractual protections, closing conditions, Day 1 priorities, remediation cost considerations, integration dependencies, and post-close commitments.
• Stakeholder Coordination & Escalation: Partner with Corporate Development, Legal, Privacy, Finance, Technology Services, ISRM capability owners, business technology teams, external advisors, and deal sponsors to align expectations, resolve open questions, and escalate material risk issues through the Director and appropriate governance channels.
• Pre-Close Readiness & Handoff: Translate diligence findings into structured Day 1 objectives, minimum security expectations, TSA considerations, risk register entries, dependency tracking, and handoff materials for post-close integration or separation execution.
• Process, Playbook & Reporting Improvement: Contribute to the continuous improvement of diligence playbooks, questionnaires, risk taxonomies, scoring methods, templates, dashboards, reporting routines, intake workflows, and evidence standards to improve consistency and speed across the portfolio.
• Team Leadership & Knowledge Sharing: Provide guidance to managers, analysts, advisors, and cross-functional contributors supporting assigned deals while promoting accountability, mentoring, lessons learned, and consistent use of approved A&D cybersecurity methods.

Qualifications

Education: Bachelor's degree in Information Security, Computer Science, Engineering, Information Systems, Business, or a related discipline. Advanced degree (MBA, MS, or equivalent) preferred.

Required Experience & Skills

• 8+ years of progressive experience in cybersecurity, information risk management, technology delivery, security architecture, M&A transaction support, due diligence, integration or separation, or related disciplines.
• Demonstrated experience leading or materially supporting cybersecurity due diligence, acquisition assessments, divestiture assessments, third-party security reviews, or complex risk assessments in time-sensitive business environments.
• Strong technical background across security architecture, identity and access management, cloud and infrastructure security, endpoint security, network security, application security, data protection, vulnerability management, incident response, logging and monitoring, third-party risk, and cyber resilience.
• Ability to analyze fragmented or incomplete diligence evidence, identify risk themes, ask effective follow-up questions, troubleshoot technical ambiguity, and separate material transaction risk from routine operational findings.
• Experience translating technical cybersecurity findings into business-focused recommendations, risk narratives, remediation priorities, Day 1 considerations, contractual inputs, and post-close handoff requirements.
• Working knowledge of privacy, legal, regulatory, and enterprise security obligations relevant to healthcare, MedTech, pharmaceutical, manufacturing, or other regulated global environments.
• Strong understanding of recognized cybersecurity frameworks and standards, including NIST Cybersecurity Framework, ISO 27001, NIST 800-series publications, GDPR, HIPAA, and other applicable requirements.
• Experience coordinating multiple workstreams, stakeholders, vendors, advisors, and deadlines across concurrent deals or complex programs.
• Excellent written and verbal communication skills, with the ability to communicate technical risk, business impact, unresolved assumptions, and decision needs to both technical and non-technical audiences.
• Demonstrated ability to operate with confidentiality, urgency, sound judgment, and professionalism in ambiguous, high-pressure transaction environments.

Preferred Experience

• Experience serving as a cybersecurity Deal Lead or workstream lead for acquisitions, divestitures, licensing transactions, minority investments, strategic partnerships, or joint ventures.
• Experience developing or operating A&D cybersecurity diligence playbooks, questionnaires, control libraries, risk-scoring methods, issue logs, decision records, RACI models, and handoff criteria.
• Experience performing outside-in cyber assessments, threat exposure reviews, breach history analysis, vendor risk analysis, or technical architecture reviews in support of transaction diligence.
• Experience partnering with Corporate Development, Legal, Privacy, Finance, Technology Services, business technology teams, IMO/SMO functions, ISRM capability owners, external advisors, and managed service providers.
• Experience in regulated healthcare, pharmaceutical, MedTech, manufacturing, life sciences, or similarly complex global environments.
• Relevant certifications such as CISSP, CISM, CRISC, CISA, CCSP, CCSK, or equivalent credentials preferred.

Leadership Expectations

• Operates as a technically credible, business-oriented cybersecurity leader who can balance transaction speed, deal confidentiality, regulatory obligations, technical risk, and enterprise security expectations.
• Acts with ownership as the cybersecurity Deal Lead for assigned transactions, driving clarity, accountability, issue resolution, and timely escalation through the Director and governance channels.
• Maintains security by design through practical technical challenge, sound risk judgment, disciplined documentation, and partnership with ISRM policy and capability owners.
• Improves repeatability by contributing to standardized diligence methods, templates, reporting, automation, metrics, and lessons learned across the A&D cybersecurity portfolio.
• Builds trust with stakeholders through concise communication, transparent risk framing, collaborative problem solving, mentoring, and high-quality execution.