Cyber Response & Recovery - Manager (Remedian focus)

Above all, KPMG is looking for someone who is passionate about helping clients recover from cyber incidents in a safe, structured and sustainable way. In return, KPMG is committed to supporting your development, technical growth and progression into senior cyber response and recovery leadership roles.

Why join us?

• One of only nine UK Tier 1 incident response providers
• Access to nationally significant incidents
• Exposure across government and critical infrastructure
• Investment in certifications and training
• Opportunity to shape a rapidly growing capability

What will you be doing?

This role is not a pure incident response role. It is a hands-on cyber recovery role focused on helping clients restore services, remediate compromised infrastructure and build stronger security foundations after a cyber incident.

The ideal candidate will combine:

• Deep infrastructure and systems administration experience.
• Strong cyber security and incident response understanding.
• Hands-on remediation and recovery capability.
• Active Directory, Windows, Linux and network architecture expertise.
• The ability to lead technical workstreams during high-pressure incidents.
• The ability to define and execute short, medium and long-term security roadmaps.

Further responsibilities will include:

The Cyber Response Recovery Manager will be responsible for leading and supporting cyber recovery workstreams during active cyber incidents and post-incident remediation programmes. Responsibilities will include:

• Lead cyber recovery workstreams during major incidents, working closely with incident response, forensic, client IT, legal, insurer and senior stakeholder teams, translating incident findings into clear remediation and recovery actions.
• Deliver hands-on remediation across enterprise environments, including Active Directory recovery and hardening, Windows/Linux systems, network, cloud, endpoint and security tooling, with a focus on removing attacker persistence and restoring trust.
• Drive patching and vulnerability remediation activities, prioritising actions based on business risk, threat actor behaviour and incident context.
• Review and redesign network architecture and security controls, including segmentation, firewall rules, and administrative access pathways, to reduce reinfection risk and improve resilience.
• Establish and support secure recovery environments and rebuild strategies, including isolated environments, backup validation, restore sequencing, and secure restoration of business-critical services.
• Define and execute phased recovery and transformation plans, including immediate stabilisation, structured remediation, and security improvement roadmaps and rebuild standards.
• Manage end-to-end delivery of recovery engagements, including stakeholder communication, project management, reporting, proposals, capability development, and mentoring junior team members.

The Person

You should have a strong background in cyber-security and incident response. For example: You should be able to guide a client through an unstructured incident response process (such as an advanced network intrusion) – managing resources and defining objectives at each stage of the incident response process; scoping and triage, containment, evidence preservation and extraction, eradication, recovery, forensic analysis and investigation.

A broad understanding of the cyber security threat landscape. Strong technical background in computers and networks, and programming skills. Significant and proven experience of dealing with cyber security incidents and associated response measures. Experience of managing a rapid deployment incident response team. Excellent interpersonal, written and communication skills. Understanding of a wide range of information security and IT methodologies, principles, technologies and techniques. A genuine interest and desire to develop and mentor junior team members. Strong attention for detail and the ability to manage multiple simultaneous cases.

Skills we’d love to see/Amazing Extras:

The successful candidate will demonstrate competency in computing and networks as well as in cyber-security either by having the relevant work experience, completed a degree or obtained industry relevant certification. Therefore the qualifications below should be seen as means to demonstrate competency and not as a requirement. The desired skill and qualification is provided below:

• Excellent communication skills (both written and oral) and project management skills.
• Strong hands-on experience across enterprise infrastructure, including Windows Server, Active Directory, Linux, networking, and cloud environments (e.g. Azure, AWS, Microsoft 365), with the ability to operate at a systems administrator level during recovery scenarios.
• Proven experience supporting cyber incident recovery, including ransomware, Active Directory compromise, network intrusion, or large-scale infrastructure incidents, with the ability to translate incident findings into practical remediation and recovery actions.
• Demonstrated capability in leading and executing remediation activities, including identity and Active Directory hardening, patching and vulnerability remediation, secure system rebuild, backup validation, and restoration of business-critical services.
• Solid understanding of network architecture and security, including segmentation, firewall design, administrative access paths, and the ability to review and redesign environments to reduce reinfection risk and improve resilience.
• Experience developing and delivering structured recovery plans, remediation trackers, and security roadmaps aligned to immediate recovery, medium-term stabilisation, and long-term transformation.
• Strong stakeholder management and communication skills, with the ability to engage both technical and executive audiences, manage high-pressure situations, and produce clear, high-quality deliverables and reporting.
• Effective project and delivery management capability, including scoping, prioritisation, financial oversight, and managing multiple workstreams during complex, time-sensitive cyber recovery engagements.

Location:

Our core hubs for this role are either:

• London (Canary Wharf); or
• Manchester (St Peter’s Square).

You must be within commutable distance to one of these locations. Current KPMG policy is 60% of the week with clients or our offices, 40% elsewhere (that can include working from home).