Security and Risk Director

Who We Are Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we help clients with total transformation-inspiring complex change, enabling organizations to grow, building competitive advantage, and driving bottom-line impact.

To succeed, organizations must blend digital and human capabilities. Our diverse, global teams bring deep industry and functional expertise and a range of perspectives to spark change. BCG delivers solutions through leading-edge management consulting along with technology and design, corporate and digital ventures - and business purpose. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, generating results that allow our clients to thrive.

What You'll Do The Director of Security & Risk serves as the senior security and risk leader for the firm's U.S. Federal Government business, with expanding responsibilities including State and Local Government business. Reporting directly to US Government business leadership, this role provides strategic oversight, executive advisory, and operational leadership to protect the BCG’s people, information, operations, and ability to conduct government business. The Director is responsible for establishing and executing security and risk management strategies that ensure compliance with applicable government security requirements, safeguard classified and controlled unclassified information (CUI), and strengthen organizational resilience.

The Director oversees the Facility Security Officer (FSO), leads the business response to sensitive information incidents, and drives security governance, employee training, and business continuity planning. Working closely with government business leaders, Cybersecurity, Legal, Contracts, Finance, and other corporate functions, the Director translates complex security requirements into practical business solutions, proactively manages emerging risks, and enables the firm's continued growth and successful delivery of government engagements.

Your work may include…

Security Strategy, Governance & Executive Advisory

• Serve as the senior security and risk advisor to BCG Federal leadership, representing the organization's security risk posture to executive leadership,
• Board committees, internal governance forums, regulators, and external auditors, and facilitating risk escalation and acceptance decisions within established governance and delegated authority.
• Develop and execute security and risk management strategies, governance frameworks, and policies that protect BCG Federal's people, information, operations, and ability to conduct government business, while supporting the broader U.S. Public Sector business as it grows.
• Identify potential systemic gaps, assess emerging risks, and drive prioritized remediation and continuous improvement to strengthen security program effectiveness.
• Establish risk reporting, performance metrics, and escalation protocols to provide leadership with visibility into material risks, compliance obligations, and corrective actions.

Federal Security Compliance & Industrial Security Oversight

• Provide strategic leadership and oversight of the Facility Security Officer (FSO) and industrial security function, ensuring effective management of personnel and facility clearances, continuous vetting, classified contracts, and associated government security obligations.
• Oversee compliance with applicable federal security regulations, contractual obligations, and agency-specific requirements, including the National Industrial Security Program Operating Manual (NISPOM).
• Establish governance and oversight for the protection and appropriate handling of classified information and Controlled Unclassified Information (CUI), partnering with the FSO, Government Cybersecurity, and other relevant functions to ensure effective policies, procedures, and controls.
• Review business development opportunities, project scopes, and contractual requirements to identify security risks early, advise business leadership, and support compliance throughout the engagement lifecycle.

Export Compliance & Government Regulatory Requirements

• Enhance and oversee BCG Federal's U.S. export compliance program, including governance, policies, procedures, training, and monitoring to support adherence to applicable export control requirements.
• Partner with Legal, Contracts, Compliance, and business leadership to assess export control risks, coordinate authorization processes, and enable compliant participation in sensitive defense and international government programs.
• Assess business implications of applicable federal IT and data security requirements, including Section 889, DFARS 252.204-7012, NIST SP 800-171, and CMMC, partnering with Government Cybersecurity on assessment readiness and ongoing compliance activities.
• Coordinate with Government Cybersecurity and other stakeholders on insider threat and Foreign Ownership, Control, or Influence (FOCI) mitigation requirements, ensuring alignment with government security obligations and established program ownership.

Security Incident Management & Business Continuity

• Lead the business response to security incidents involving classified information, CUI, or other sensitive government information, including escalation, business impact assessment, remediation oversight, and executive communications.
• Coordinate with the FSO, Government Cybersecurity, Legal, Compliance, and other stakeholders to ensure appropriate incident containment, investigation, reporting, and corrective actions in accordance with government and contractual requirements.
• Establish and oversee business continuity and operational resilience plans addressing security-related disruptions, including sensitive information spills, to minimize impacts on government engagements and business operations.
• Drive post-incident reviews and improvements to security policies, controls, training, and response procedures to strengthen organizational preparedness and reduce recurrence.

Business Partnership, Training & Operational Excellence

• Serve as a strategic partner to federal business leadership and collaborate with Finance, Contracts, Compliance, Cybersecurity, Legal, and other stakeholders to navigate complex security requirements, manage risks, and enable business objectives.
• Oversee security awareness and enhance training programs for federal and relevant U.S. Public Sector personnel, including classified information handling, CUI protection, incident reporting, and regulatory obligations.
• Drive implementation of AI tools, automation, and process improvements to strengthen security program visibility, compliance tracking, workflow management, and support for client-facing teams.
• Lead and develop the security team, establishing priorities, performance expectations, and resource plans while coaching and mentoring talent.

You're Good At:

• Translating complex compliance requirements into actionable workstreams and communicating them to non-technical stakeholders
• Superior analytical skills and creative problem-solving ability, with an appreciation for striking a practical balance between business and legal objectives
• Talent for absorbing new skill sets and areas of expertise quickly and comfortably and the flexibility to deal with changing situations and priorities with tact, poise, and patience
• Ability to perform successfully and produce results in a fast-paced, intellectually intense environment
• Experience in building or improving security intake, triage, and remediation tracking workflows that scale
• High level of self-motivation and initiative; follows through and sees tasks to completion
• A ‘player-coach’ mentality. Ability to take on tasks of your own while delegating projects to your team

What You'll Bring

• Prior experience supporting national security, defense, intelligence, state & local or other highly regulated customers
• Broad, cross-functional expertise in US federal security, compliance, and regulatory matters
• US citizen with an active security clearance at TS or above
• 10+ years of professional experience with demonstrable record of impact and with progressively increasing levels of responsibility
• Outstanding, confident written and verbal communication skills
• Ability to navigate complex problems to arrive at pragmatic, actionable solutions
• Demonstrated AI literacy, including an understanding of AI-related security and compliance risks and opportunities to improve operational efficiency
• Experience managing direct reports
• Strong knowledge of Microsoft Office Suite (SharePoint, Outlook, Word, and PowerPoint essential)

Additional preferred experience and qualificaitons:

• Bachelor’s degree required
• Advanced degree or certifications in business, law, risk, security, or other related fields strongly preferred
• Experience or expertise with ITAR and Foreign Ownership, Control and Influence (FOCI) factors and mitigation techniques

Who You'll Work With This role reports to the BCG Federal Corp Senior Director. You will collaborate with Finance, Contracts, Compliance, Data Privacy/Security, Legal, and other internal firm functions and external advisers to support BCG Federal and the broader US Public Sector business.

Additional info

Format Information:

At BCG, our people and relationships are at the heart of everything we do. We believe that in-person work is essential to our culture, mentorship, and professional development. That's why we operate on a hybrid model, with the expectation that team members will be in the office 3 to 5 days per week. This role is designed for those who thrive in a dynamic, collaborative environment and is not intended for remote or virtual work.

Compensation Information:

Total compensation for this role includes base salary, annual discretionary performance bonus, retirement contribution, and a market leading benefits package described below.

The base salary range for this role is $167,000-$198,000 (USD).

This is an estimated range and specific base salaries within the range depend on factors such as office location, experience, and skill set. It is not common for new BCG employees to be hired at the high-end of the salary range. BCG regularly reviews its ranges to ensure market competitiveness.

In addition to your base salary, your total compensation will include a discretionary bonus of up to 30% and a generous retirement contribution that starts at 5% and moves to 10% after 2 years.

At BCG, we are committed to offering a comprehensive benefit program that includes everything our employees and their families need to be well and live life to the fullest. We pay the full cost of medical, dental, and vision coverage for employees – and their eligible family members.* That’s zero dollars in premiums taken from employee paychecks.

All of our plans provide best in class coverage:

• Zero dollar ($0) health insurance premiums for BCG employees, spouses, and children
• Low $10 (USD) copays for trips to the doctor, urgent care visits and prescriptions for generic drugs
• Dental coverage, including up to $5,000 in orthodontia benefits
• Vision insurance with coverage for both glasses and contact lenses annually
• Reimbursement for gym memberships and other fitness activities
• Fully vested Profit Sharing Retirement Fund contributions made annually, whether you contribute or not, plus the option for employees to make personal contributions to a 401(k) plan
• Paid Parental Leave and other family benefits such as elective egg freezing, surrogacy, and adoption reimbursement
• Generous paid time off including 12 holidays per year, an annual office closure between Christmas and New Years, and 15 vacation days per year (earned at 1.25 days per month)
• Paid sick time on an as needed basis

*Employees, spouses, and children are covered at no cost. Employees share in the cost of domestic partner coverage.

Boston Consulting Group is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, age, religion, sex, sexual orientation, gender identity / expression, national origin, disability, protected veteran status, or any other characteristic protected under national, provincial, or local law, where applicable, and those with criminal histories will be considered in a manner consistent with applicable state and local laws.

BCG is an E - Verify Employer. Click here for more information on E-Verify.