Job Description Summary

Lead GE Vernova’s cybersecurity due diligence and integration/separation for a global M&A portfolio (acquisitions, divestitures/carve-outs, JVs, minority investments) across IT and OT/ICS. Own a NIST-aligned workstream from pre-LOI red-flags through close and 30/60/100-day execution. Quantify and communicate cyber risk to inform valuation, terms, and closing conditions; ensure Day 1 control readiness; standardize reusable playbooks (IAM, network/zero trust, cloud, endpoint, data, logging/monitoring, vulnerability management, third-party risk, incident response, BCP/DR); drive safe OT/ICS integration (incl. NERC CIP where applicable); operate in a matrix with DT M&A/PMO, Legal, Privacy, Finance, Insurance, and BU security; manage external providers; track KPIs and reduce TSA duration.

Job Description

Essential Responsibilities

• Lead pre-sign red-flag and full due diligence for GE Vernova's Deal Processes in DT and OT/ICS targets aligned to NIST CSF, SP 800-53/800-171, and 800-82.
• Quantify risk and remediation (capex/opex, timeline) and translate into valuation, PPAs, holdbacks, R&Ws/indemnities, and closing conditions.
• Own Day 1 control readiness; build and execute 30/60/100-day plans and drive TSA exit milestones.
• Develop and run standard playbooks for IAM/PAM, network segmentation/zero trust, endpoint/EDR, cloud tenancy/landing zones, app security, data discovery/classification/transfer, logging/SIEM, vulnerability management, third-party risk, IR, and BCP/DR.
• Design/govern safe OT/ICS integration and segmentation strategies; assess NERC CIP applicability and compliance contours.
• Establish clean-room protocols and data handling standards; ensure privacy and cross-border compliance (e.g., DPIAs).
• Operate in a matrix with DT M&A/PMO, Business Development, Legal, Privacy, Finance, Insurance, Sourcing, and BU security; lead cross-functional squads.
• Manage third-party providers for surge capacity/testing/regulatory advisory; integrate and QA outputs.
• Track and report KPIs (flow efficiency, diligence cycle time, Day 1 control coverage, TSA months saved, post-close findings); drive continuous improvement.
• Provide executive-ready risk narratives, options/trade-offs, and recommendations under tight timelines.

Key Deliverables

• Red-flag memo; preliminary NIST scorecard; diligence plan and data room list; clean-room SOPs.
• Control gap assessment with target state; quantified remediation estimates; executive risk register and heatmap.
• OT/ICS Purdue mapping; zone/conduit strategy; NERC CIP relevance assessment (as applicable).
• Day 1 control checklist and exceptions log; 30/60/100-day plan with critical path and TSA exit criteria.
• Integration/separation runbooks/playbooks; cutover command-center and stabilization plans.
• SPA/TSA cyber clause recommendations; insurance underwriting package.
• Deal dashboard, weekly executive updates, risk/issue logs; post-close lessons learned; BU handover package.

Required Qualifications

• 10+ years in cybersecurity with significant M&A diligence and integration/separation leadership.
• Experience across IT and OT/ICS security, including segmentation and operational resilience.
• Deep knowledge of NIST CSF, SP 800-53/800-171, and 800-82; familiarity with NERC CIP.
• Proven ability to quantify risk/remediation and translate into deal economics and SPA/TSA language.
• Track record delivering Day 1 readiness and 30/60/100-day execution with TSA exits in global environments.
• Hands-on depth in IAM/PAM, network/cloud security, endpoint/EDR, data protection, logging/monitoring, vuln mgmt, third-party risk, IR, and BCP/DR.
• Executive communication and matrix leadership; ability to lead external advisors.
• Bachelor’s degree in cybersecurity, computer science, engineering, or related field (or equivalent experience).
• Location: Flexible US; hybrid/remote options based on candidate location.
• Travel: Some Domestic and international, as required.

Preferred Qualifications

• OT-heavy transaction experience (generation, grid, renewables); prior clean-room design/operations.
• Risk quantification (e.g., FAIR or equivalent); Lean/Agile/PMO experience with metrics focus.
• Experience improving cyber insurance submissions and influencing SPA/TSA controls.
• Relevant certifications: CISSP, CISM, CRISC, CISA, GICSP, CCSK/CCSP, cloud provider certs.

Additional Information

GE Vernova offers a great work environment, professional development, challenging careers, and comp