VP, Financial Planning & Analysis

LevelBlue reduces risk and builds lasting resilience so organizations can innovate and advance their mission with confidence. As the world’s most analyst-recognized and largest pure-play managed security services provider, LevelBlue elevates client outcomes that matter: stronger defense, faster response, and sustained business continuity. LevelBlue combines AI-powered security operations, advanced threat intelligence, and elite human expertise to provide the most comprehensive portfolio of strategic advisory, managed security, offensive security, and incident response services.

Location:  New York or Chicago — or remote US east coast with regular HQ presence

Reports to:  Chief Financial Officer

Partners with:  Corporate Controller / CAO, VP Treasury, VP Corporate Development, Integration Management Office, Revenue Operations

Direct reports:  4–6 (Corporate FP&A, GTM Finance, Delivery/Services Finance, G&A Finance, Planning Systems); ~12–18 total function

Status:  Full-time, exempt

LevelBlue is the largest pure-play managed security services provider in the world — a 2024 carve-out of AT&T Cybersecurity, majority-owned by WillJam Ventures with AT&T retaining a minority stake, now past $1B of business following the acquisitions of Trustwave, Cybereason, and the Alert Logic managed services business.

That growth outpaced the finance operating model behind it. This role is integration-first. LevelBlue today runs on four sets of books, four planning conventions, four definitions of a customer, and a synergy case that has to be proven rather than asserted. The VP of FP&A reports to the CFO and is the person who turns that into one company with one plan, one set of numbers, and a credible bridge from underwriting case to realized result — while continuing to run the forecast the board, the sponsor, and the lenders rely on.

This is a build role with board and sponsor visibility from week one, on the critical path to the company’s next liquidity milestone. It is not a caretaker forecasting job.

• Own the financial spine of integration in partnership with the IMO: synergy tracking against the underwriting case, bottom-up by initiative and owner, with realized-versus-plan reported monthly to the CFO, sponsor, and board.
• Enforce clean separation of one-time integration cost, run-rate savings, and dis-synergies. No synergy claimed without a line item and an owner.
• Model and track TSA exit economics and stranded-cost burn-down from the AT&T carve-out and each subsequent acquisition.
• Own the revenue side of the synergy case, not just cost: cross-sell and attach assumptions across the acquired customer bases, re-based retention cohorts, and honest visibility into which revenue synergies are landing.
• Build the repeatable finance integration playbook — Day 1 reporting, Day 100 plan consolidation — so the next acquisition is faster than the last.

Consolidate legacy LevelBlue, Trustwave, Cybereason, and Alert Logic planning into a single driver-based operating model on a common chart of accounts, entity structure, and cost taxonomy. Restate acquired-entity history onto a comparable basis. Retire the spreadsheet-of-record.

Establish and defend the enterprise definitions of ARR, net revenue retention, gross and net bookings, backlog, and contracted-not-billed — and own the reconciliation from those metrics to GAAP revenue with the Controller. Today’s variance between systems is a diligence finding waiting to happen.

Build margin visibility by delivery line — SOC operations, MDR/XDR, professional services and consulting, product/platform — including utilization, bill-rate realization, cost-to-serve, and contribution margin by customer cohort and by legacy entity. Recurring managed services and project-based consulting must be modeled and steered differently.

Own the covenant model, liquidity forecast, and 13-week cash view with Treasury. Deliver lender and sponsor packages that require no rework, including pro forma and adjusted-EBITDA presentation that survives scrutiny of the addbacks.

Build what an IPO or sale process assumes already exists: quarterly-close-grade reporting, segment and cohort analytics, comparable multi-year history across the acquired entities, and a forecast track record a diligence team can test.

• Annual operating plan, quarterly reforecast, monthly rolling forecast, long-range plan.
• The enterprise financial model — P&L, balance sheet, cash flow, covenant compliance — integrated rather than stitched.
• Scenario and sensitivity work for pricing, retention shocks, delivery-cost inflation, integration slippage, and further acquisitions.

• Acquisition models, accretion/dilution, and synergy cases; pressure-test the deal team’s assumptions before they become commitments.
• Diligence support and purchase-accounting partnership with the Controller: opening balance sheet forecast impacts, earnout and deferred-consideration modeling, and post-close plan integration.
• Entity rationalization and legal-entity forecast impacts across a multi-jurisdiction footprint.

• Embed finance partners with Sales and GTM, Delivery and SOC operations, Product and Engineering, and G&A; hold each function to agreed operating drivers.
• Partner with Revenue Operations on pipeline conversion, quota and capacity planning, sales productivity, and commission modeling across newly combined sales organizations.
• Support pricing and packaging with unit economics rather than anecdote.

• Monthly management reporting package, board materials, sponsor and lender reporting.
• Variance analysis with root cause, named owners, and corrective action — not a bridge chart with no accountability.
• Present directly to the board, WillJam Ventures, and the lender group alongside the CFO.

• Build, coach, and retain a distributed team assembled from the legacy organizations; resolve duplicate roles and unclear ownership rather than working around them.
• Own the planning-system roadmap (EPM selection or consolidation, data model, reporting layer) and automate reporting cycles, including AI-assisted analysis and commentary where it removes manual effort.

• 12+ years in FP&A, corporate finance, or transaction advisory/private equity, including 5+ years leading a corporate FP&A function at $500M+ revenue.
• Owned FP&A through at least one major M&A integration — consolidated planning models, harmonized metric definitions, and personally owned the synergy tracking that was reported to a board or sponsor. Serial-acquirer experience strongly preferred.
• Carve-out and/or TSA-exit experience, including stranded-cost management.
• Private-equity-owned or sponsor-backed environment: covenant reporting, sponsor cadence, value-creation-plan tracking.
• Fluency in both recurring-revenue economics (ARR, NRR, cohort retention, CAC payback) and services economics (utilization, bill-rate realization, project margin, cost-to-serve). Strength in only one will be a stretch here.
• Built a driver-based enterprise model from the ground up, not inherited and maintained one.
• Proven ability to work from incomplete and inconsistent acquired-company data and still publish a number you will defend.
• Credible in front of a board, a sponsor, and a lender group without the CFO in the room.

• Managed security services, cybersecurity, MSP/MSSP, or IT services sector experience.
• IPO preparation or public-company FP&A: S-1 support, guidance frameworks, segment reporting, quarterly cadence.
• Multi-entity, multi-currency international operations.
• Hands-on EPM implementation (Anaplan, Pigment, Planful, Adaptive, OneStream) with comfort in the underlying data architecture.
• Bachelor’s in Finance, Accounting, Economics, or related. MBA and/or CPA/CFA welcome, not required.

• You lead with the number and the recommendation, then the support.
• You surface bad news early and with a proposed path.
• You are comfortable being the person who says two systems disagree — and then fixes it.
• You build trust fast across organizations that were competitors eighteen months ago.

• Not a steady-state forecasting seat. Roughly half of the first two years is integration work.
• Not a role with clean data on arrival. You will build the source of truth, not inherit it.
• Not a back-office position. Board, sponsor, and lender exposure is direct and frequent.

90 days — Synergy tracking live against the underwriting case with named initiative owners; single consolidated forecast model in production; metric definitions documented and ratified by Finance, Revenue Operations, and the Controller.

Six months — Monthly reporting package on a fixed calendar with no rework; TSA and stranded-cost burn-down forecast owned and tracking; covenant model owned and reconciled; forecast variance inside agreed tolerance for two consecutive quarters.

Twelve months — Planning system consolidated; acquired-entity history restated to a comparable basis; margin visibility by delivery line and customer cohort; annual operating plan built bottom-up with functional ownership; FP&A judged diligence-ready by the sponsor and external advisors.

Why Join LevelBlue?
At LevelBlue, you’re not just an employee—you’re part of a team making a real difference in the world of cybersecurity. We foster a culture of innovation and creativity where your contributions are valued, and you’ll have the support and resources to grow and thrive.

Benefits and Perks:

• Comprehensive medical, dental, and vision insurance.
• 401(k) with employer matching.
• Generous paid time off and holidays.
• Flexible spending accounts and health savings accounts.
• Employee assistance programs.
• Training and development opportunities.
• Adoption assistance program.

This role is open to candidates legally authorized to work in the United States. At LevelBlue, we support flexible work and bring people together in person for key moments based on role, team, and business needs.

LevelBlue is committed to a culture of respect, inclusion, and equal opportunity. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age, or any other status protected under applicable law.

To all agencies: Please do not contact LevelBlue employees outside of the Talent Acquisition team. LevelBlue’s policy is to only accept resumes from agencies through its approved agency process and with a valid agreement in place. Any resume submitted outside this process will be considered the property of LevelBlue, and no fee will be paid if a candidate is hired from such a submission.

#LI-MC1

#LI-Remote