Incident Response Manager

Job Description

Job description The Role The incident response manager role will be working in the Cyber Response Services (CRS) Team within our Risk Consulting practice, reporting directly into the head of cyber response. Cyber security is one of the areas which KPMGhas identified for tremendous investment and growth. Our clients face a challenging cyber threat and look to us to help them understand and respond to that threat.This is a hands-on and operational management role with opportunities to grow into service lineleadership. The successful candidate is expected to manage a broad range of cyber-security incidents as well as perform digital forensics (disk, volatile memory, network packets, logfiles) and help advance KPMGs incident response processes and methodologies.In this role we are looking for a person who can demonstrate strong technical background, significant experience in incident response and digital forensics and is looking to grow into an incident response leadership role as part of a growing team. You willbe expected to lead a number of incident response case managers and practitioners, as well as have the opportunity to work with, and learn from, the service leadership as part of your continuous development.When not responding to incidents, you may be helpingour clients to build their in-house incident response capabilities, which could include: building and developing cyber-response tools, authoring and adapting runbooks/playbooks, assessing the incident response maturity, assisting in table-top cyber-scenarioexercises. When not engaged in client work, you will be helping to develop our own delivery capability, including operational efficiency, standard operating procedures, team learning and development, tooling and platforms, lab development and orchestration.Ourclients expect that cyber-incidents will be tackled with urgency, therefore, there is an expectation that you will be flexible in terms of working hours. In addition, you should be prepared to travel on short notice for periods up to 2 or 3 weeks at a time.ResponsibilitiesManage and co-ordinate cyber security incidents for our clients, working closely with the head of cyber response. Digital forensics of relevant incident data (disk, volatile memory, network packets, log files).Maintaining a current view of the cyber threat,and being able to advise clients on the threat landscape and attacks which may be relevant to them. Manage the development of KPMGs in house cyber-response tools. Assess client incident response capability maturity. Help stand-up or improve clients ownincident response capabilities. Project management of engagements to deliver high quality work in a timely manner, including: Scoping and costing of engagements Financial management of projects Engagement and risk management Production and review of deliverablesto a high standard. Liaising with clients on delivery, implementation and project issues. Ability to generate well-structured responses to bids and requests for proposals.The PersonExperiences in cyber-security and incident response. For example: You shouldbe able to guide a client through a unstructured incident response process (such as an advanced network intrusion) - managing resources and defining objectives at each stage of the incident response process; scoping and triage, containment, evidence preservationand extraction, eradication, recovery, forensic analysis and investigation. A broad understanding of the cyber security threat landscape. Strong technical background in computers and networks, and programming skills. Significant and proven experience ofdealing with cyber security incidents and associated response measures. Experience of managing a rapid deployment incident response team. Excellent interpersonal, written and communication skills. Understanding of a wide range of information security andIT methodologies, principles, technologies and techniques. A genuine interest and desire to develop and mention junior team members. Strong attention for detail and the ability to manage multiple simultaneous cases.Qualifications and SkillsThe successfulcandidate will demonstrate competency in computing and networks as well as in cyber-security either by having the relevant work experience, completed a degree or obtained industry relevant certification. Therefore the qualifications below should be seen asmeans to demonstrate competency and not as a requirement. The desired skill and qualification is provided below:Excellent communication skills (both written and oral) and project management skills. Strong IT and network skills - knowledge of common enterprisetechnologies - Windows and Windows Active Directory, Linux, Cisco, etc. Working programming skill-set to be able to author and develop tools. Most in-house security tools in KPMG are written in Python, but we accept that a competent programmer will be ableto transfer skillsets across languages. Technical proficiency in at least one of these areas: network security/traffic/log analysis; Linux and/or Mac/Unix operating system forensics; Linux/Unix disk forensics (ext2/3/4, HFS+, and/or APFS file systems), advancedmemory forensics, static and dynamic malware analysis / reverse engineering, advanced mobile device forensics Advanced experience in industry computer forensic tools such as X-Ways, EnCase, FTK, Internet Evidence Finder (IEF) / AXIOM, TZWorks, and/or CellebriteAdvanced experience in preservation of digital evidence (including experience preserving cloud data and handling encryption such as BitLocker, FileVault, and/or LUKS) Experience with and understanding of enterprise Windows security controls (Preferred) Degreelevel qualified, MSc in Information Security, IT or relevant STEM subjects.(Preferred) General information security certificates such CISSP, CISM or CISA.(Preferred) Incident management certifications such as: CREST certified incident manager (CCIM).GIAC Certified Incident Handler (GCIH) (Preferred) Digital forensics certificates such as: CREST certified registered intrusion analyst (CRIA), CREST certified network intrusion analyst (CCNIA), CREST certified host intrusion analyst (CCHIA), CREST certifiedmalware reverse engineer (CCMRE), GIAC Certified (Network) Forensic Analyst (GCFA, GNFA) (Preferred) A current government security clearance (SC/DV) or willingness to acquire such a clearance will be seen as an advantage.