KPMG UK
Cyber Response & Recovery Assistant Manager (Reactive DFIR)
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Cyber Response & Recovery Assistant Manager (Reactive DFIR)
This role requires current SC or DV clearance, or eligibility and willingness to obtain clearance.
About the role
The Cyber Response & Recovery Assistant Manager role will be working in the Cyber Response Services (CRS) Team within our Advisory practice.
Your specific focus will be in the domain of reactive digital forensics and incident response (DFIR) acting as a junior case manager on smaller cases, or part of a team (reporting to a case manager or senior case manager) on larger cases.
This is a hands-on role, and an opportunity to join a high performing team that works with a wide variety of clients, as KPMG are one of just nine tier 1 responders in the UK. As such, you will gain a huge amount of experience in a short space of time and will also have the opportunity to be put through a range of security certifications.
In this role we are looking for a person who can demonstrate an emerging strong technical background, experience in incident response and digital forensics and is looking to grow into an incident response manager role as part of a growing team. You will be expected to work in a team where there are a number of incident response cases ongoing.
When not responding to incidents, you may be helping our clients to build their in-house incident response capabilities, which could include: building and developing cyber-response tools, authoring and adapting runbooks/playbooks, assessing the incident response maturity, assisting in table-top cyber-scenario exercises. When not engaged in client work, you will be helping to develop our own delivery capability, including operational efficiency, standard operating procedures, team learning and development, tooling and platforms, lab development and orchestration.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Why join us?
- One of only nine UK Tier 1 incident response providers
- Access to nationally significant incidents
- Exposure across government and critical infrastructure
- Investment in certifications and training
- Opportunity to shape a rapidly growing capability
What will you be doing?
- Perform incident response activities during cyber security incidents for our clients (this includes being available to work on-call monthly).
- Carry out digital forensics of relevant incident data (disk, volatile memory, network packets, log files).
- Maintain a current view of the cyber threat and being able to advise clients on the threat landscape and attacks which may be relevant to them.
- Liaising with clients on delivery, implementation and project issue.
- Ability to generate well-structured responses to bids and requests for proposals.
The Person
You should have a strong background in cyber-security and incident response. For example: You should be able to guide a client through an unstructured incident response process (such as an advanced network intrusion) – managing resources and defining objectives at each stage of the incident response process; scoping and triage, containment, evidence preservation and extraction, eradication, recovery, forensic analysis and investigation.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
- A broad understanding of the cyber security threat landscape.
- Strong technical background in computers and networks, and programming skills.
- Proven experience of dealing with cyber security incidents and associated response measures.
- Understanding of a wide range of information security and IT methodologies, principles, technologies and techniques.
- Excellent interpersonal, written and communication skills.
Skills we’d love to see/Amazing Extras: The successful candidate will demonstrate competency in computing and networks as well as in cyber-security either by having the relevant work experience, completed a degree or obtained industry relevant certification. Therefore the qualifications below should be seen as means to demonstrate competency and not as a requirement.
Preferred:
- Incident management certifications such as:
- CREST Certified Incident Manager (CCIM)
- GIAC Certified Incident Handler (GCIH)
- CREST Certified Practitioner Intrusion Analyst (CPIA)
- Degree level qualified, MSc in Information Security, IT or relevant STEM subjects.
Location:
Our core hubs for this role are either:
- London (Canary Wharf)
- Manchester (St Peter’s Square)
You must be within commutable distance to one of these locations. Current KPMG policy is 60% of the week with clients or our offices, 40% elsewhere (that can include working from home).
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location