Cyber Response and Recovery – Assistant Manager (Reactive)

Overview

In this role you will support reactive digital forensics and incident response within KPMG’s Cyber Response Services team, handling smaller cases as a junior case manager and collaborating on larger incidents. You’ll gain rapid exposure across clients and be supported to obtain security certifications. There is a clear path toward incident response leadership, with involvement in developing in-house capabilities and playbooks. You will work on urgent, on-call incidents and help shape the delivery capability of the practice.

Pay / Benefits

• Certifications and training investments
• Hybrid work model (60% client/office, 40% elsewhere)
• Exposure to national incidents and critical infrastructure
• Opportunities to shape a growing capability
• Travel opportunities on short notice
• On-call rotation

Responsibilities

• Perform incident response activities for client cyber incidents, including on-call coverage
• Carry out digital forensics on incident data (disk, memory, network packets, logs)
• Provide clients with threat landscape insights and current attack trends
• Liaise with clients on delivery, implementation, and project issues
• Contribute to bids and RFP responses with well-structured outputs
• Help build in-house IR capabilities, runbooks/playbooks, and lab development
• Support delivery efficiency, SOPs, and training within the team

Key requirements

• Strong background in cyber-security and incident response
• Ability to guide unstructured incident response processes (e.g., advanced network intrusions)
• Broad understanding of cyber security threat landscape
• Strong technical foundation in computers and networks; programming skills
• Proven experience in managing cyber security incidents and response measures
• Understanding of information security methodologies, technologies, and techniques
• Excellent interpersonal, written, and communication skills
• Willingness to travel on short notice and to be on-call on a rotation basis
• Eligible for current SC or DV clearance or willingness to obtain clearance

• Strong communication and client-facing abilities
• Team collaboration and coordination under pressure
• Adaptability and learning mindset
• Digital forensics (disk, memory, network data, logs)
• Incident response lifecycle management
• Network and computer fundamentals

…