KPMG UK
Cyber Response & Recovery - Senior Manager
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Cyber Response & Recovery - Senior Manager
The Role
The Cyber Response & Recovery Senior Manager role will be working in the Cyber Response Services (CRS) Team within KPMG’s Risk Consulting practice, reporting directly into the head of cyber response.
Cybersecurity is one of the areas KPMG has identified for tremendous investment and growth. Our clients face a challenging cyber threat and look to us to help them understand and respond to that threat.
This is a hands-on and operational management role with opportunities to grow into service line leadership. The successful candidate is expected to:
- Manage a broad range of cyber-security incidents
- Perform digital forensics (disk, volatile memory, network packets, log files)
- Help advance KPMG’s incident response processes and methodologies
In this role, we are looking for someone who:
- Demonstrates a strong technical background
- Has significant experience in incident response and digital forensics
- Is looking to grow into incident response leadership as part of our growing team
You will:
- Lead incident response case managers and practitioners
- Work closely with and learn from service leadership for continuous development
When not responding to incidents, you may be involved in:
- Building our clients’ in-house incident response capabilities
- Developing cyber-response tools
- Authoring and adapting runbooks/playbooks
- Assessing incident response maturity
- Assisting in tabletop cyber-scenario exercises
When not engaged in client work, you will:
- Help develop delivery capability
- Operational efficiency
- Standard operating procedures
- Team learning and development
- Tooling and platforms
- Lab development and orchestration
Key Requirements
Transport and clearance:
- Willing and able to undergo acquisition of SC Clearance
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Key skills:
- Proven track record of incident management
- Strong competency in digital forensics
- Strong technical expertise in managing complex cyber incidents (ransomware, advanced network intrusions)
Experience:
- Flexibility with working hours and potential for onsite travel (up to 2–3 weeks per assignment)
Responsibilities
-
Manage and coordinate cyber security incidents for clients
-
Conduct digital forensics on relevant data (disk, volatile memory, network packets, log files)
-
Maintain an up-to-date view of the cyber threat landscape, advising clients on threats relevant to them
-
Manage the development of KPMG’s in-house cyber-response tools
-
Assess clients’ incident response capability maturity
-
Support the setup or improvement of clients' internal incident response programs
-
Handle project management of engagements including:
- Scoping and costing
- Financial management
- Engagement and risk management
- Production and review of deliverables to high standards
- Liaising with clients on delivery, implementation, and project issues
- Generating structured responses to bids and RFPs (requests for proposals)*
The Person
Ensuring success in this role requires:
- Strong cybersecurity and incident response background
- Ability to guide clients through unstructured incident responses (e.g., advanced network intrusions)
- Define objectives in each incident response phase (scoping/triage, containment, evidence preservation/extraction, eradication, recovery, analysis)
- Broad knowledge of the cyber threat landscape
- Expertise in ** computers, networks, and programming**
- Significant, proven incident response experience
- Proven ability to manage rapid deployment incident response teams
- Strong interpersonal, written, and communication skills
- Deep understanding of information security and IT methodologies, principles, technologies, and techniques
- Passion for mentoring junior team members
- Strong attention to detail with the ability to handle multiple simultaneous cases
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Qualifications and Skills
To be successful, you should demonstrate competency in computing, networks, and cybersecurity through:
- Work experience, degree, or industry certification (These are means to prove qualification rather than strict requirements)
Preferred Certifications
- Degree: MSc in Information Security, IT, or STEM fields (Preferred)
- General InfoSec: CISSP, CISM, CISA (Preferred)
- Incident Management:
- CREST-certified incident manager (CCIM)
- GIAC Certified Incident Handler (GCIH)
- Digital Forensics:
- CREST-certified registered intrusion analysts (CRIA, CCNIA, CCHIA, CCMRE)
- GIAC Certified (Network) Forensic Analyst (GCFA, GNFA)
Technical Skills
- Strong IT/network knowledge (Windows/Windows AD, Linux, Cisco etc.)
- Programming ability (preferably Python; expertise transferable)
- Advanced proficiency in:
- Network/logging analysis
- Linux, Mac, Unix forensics
- Malware reverse engineering (dynamic/static analysis)
- Advanced mobile forensics
- Advanced experience in forensics tools:
- X-Ways, EnCase, FTK, IEF/AXIOM, TZWorks, Cellebrite
- Evidence preservation expertise (cloud data, handling BitLocker, FileVault, LUKS)
- Windows enterprise security controls knowledge
- Competent analyst using computer forensic tools
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location