Cyber Response & Recovery Manager - German Speaker

Cyber Response & Recovery Manager (Reactive DFIR)

This role requires current SC or DV clearance, or eligibility and willingness to obtain clearance.

About the role

The Cyber Response & Recovery Manager will work in the Cyber Response Services (CRS) Team within our Cyber Advisory practice.

Your specific focus will be in the domain of reactive digital forensics and incident response (DFIR) acting as a case manager on medium to large cases.

This is a hands‑on incident response role and an opportunity to join a high performing team that works with a wide variety of clients, as KPMG are one of just nine Tier 1 responders in the UK.

As such, you will gain a huge amount of experience in a short space of time and will also have the opportunity to be put through a range of security certifications.

In this role we are looking for a person who can demonstrate a strong technical background, experience in incident response and digital forensics, and who is looking to grow into an incident response leadership role as part of a growing team.

You will be expected to lead a number of incident response cases as a case manager, as well as have the opportunity to work with, and learn from, the service leadership as part of your continuous development.

When not responding to incidents, you may be helping our clients to build their in‑house incident response capabilities, which could include building and developing cyber‑response tools, authoring and adapting runbooks/playbooks, assessing the incident response maturity, and assisting in tabletop cyber‑scenario exercises.

When not engaged in client work, you will be helping to develop our own delivery capability, including operational efficiency, standard operating procedures, team learning and development, tooling and platforms, lab development and orchestration.

Candidates should have a proven track record of incident management, with a strong competency in digital forensics.

KPMG will provide training and coaching to help you continually improve both your management and technical skills.

Strong technical competency and experience of managing a range of complex cyber incidents; from ransomware to advanced network intrusions is a pre‑requisite.

Our clients expect that cyber‑incidents will be tackled with urgency, therefore there is an expectation that you will be flexible in terms of working hours and be on call (on a rotation basis).

In addition, you should be prepared to travel on short notice for periods up to 2 or 3 weeks at a time.

Above all, KPMG is looking for someone who is passionate about helping our clients with their cyber security challenges, often at a time of critical need.

In return, we are committed to helping you to enjoy the role and develop your skills and career within KPMG with the objective of progressing into a senior leadership role.

Why join us?

• One of only nine UK Tier 1 incident response providers
• Access to nationally significant incidents
• Exposure across government and critical infrastructure
• Investment in certifications and training
• Opportunity to shape a rapidly growing capability

What will you be doing?

• Manage and co‑ordinate cyber security incidents for our clients, working closely with the cyber response leadership team.
• Perform digital forensics of relevant incident data (disk, volatile memory, network packets, log files).
• Maintain a current view of the cyber threat, and be able to advise clients on the threat landscape and attacks which may be relevant to them.
• Manage the development of KPMG's in‑house cyber‑response tools.
• Assess client incident response capability maturity.
• Help stand‑up or improve clients' own incident response capabilities.
• Project manage engagements to deliver high quality work in a timely manner, including:
• Scoping and costing of engagements
• Financial management of projects
• Engagement and risk management
• Production and review of deliverables to a high standard
• Liaise with clients on delivery, implementation and project issues.
• Generate well‑structured responses to bids and requests for proposals.
• The Person

You should have a strong background in cyber‑security and incident response.

You should be able to guide a client through an unstructured incident response process (such as an advanced network intrusion) – managing resources and defining objectives at each stage: scoping and triage, containment, evidence preservation and extraction, eradication, recovery, forensic analysis and investigation.

• Fluent German speaker and ability to draft reports in German.
• A broad understanding of the cyber security threat landscape.
• Strong technical background in computers and networks, and programming skills.
• Significant and proven experience of dealing with cyber security incidents and associated response measures.
• Experience of managing a rapid deployment incident response team.
• Excellent interpersonal, written and communication skills.
• Understanding of a wide range of information security and IT methodologies, principles, technologies and techniques.
• A genuine interest and desire to develop and mentor junior team members.
• Strong attention to detail and the ability to manage multiple simultaneous cases.

Skills we'd love to see / Amazing Extras

The successful candidate will demonstrate competency in computing and networks as well as in cyber‑security either by having relevant work experience, completing a degree or obtaining industry‑relevant certification.

Therefore the qualifications below should be seen as means to demonstrate competency and not as a requirement.

• Excellent communication (both written and oral) and project management skills.
• Strong IT and network skills – knowledge of common enterprise technologies: Windows, Windows Active Directory, Linux, Cisco, etc.
• Working programming skill‑set to be able to author and develop tools.

Most in‑house security tools in KPMG are written in Python, but we accept that a competent programmer will be able to transfer skillsets across languages.

• Technical proficiency in at least one of these areas: network security/traffic/log analysis; Linux and/or Mac/Unix operating system forensics; Linux/Unix disk forensics (ext2/3/4, HFS+, and/or APFS file systems); advanced memory forensics; static and dynamic malware analysis / reverse engineering; advanced mobile device forensics.
• Advanced experience with industry computer forensic tools such as X‑Ways, En Case, FTK, Internet Evidence Finder (IEF) / AXIOM, TZWorks, and/or Cellebrite.
• Advanced experience in preservation of digital evidence (including experience preserving cloud data and handling encryption such as Bit Locker, File Vault, and/or LUKS).
• Experience with and understanding of enterprise Windows security controls.
• (Preferred) Degree level qualification, MSc in Information Security, IT or relevant STEM subjects.
• (Preferred) General information security certificates such as CISSP, CISM or CISA.

• (Preferred) Incident management certifications such as

• CREST certified incident manager (CCIM).
• GIAC Certified Incident Handler (GCIH).

• (Preferred) Digital forensics certificates such as

• CREST certified registered intrusion analyst (CRIA).
• CREST certified network intrusion analyst (CCNIA).
• CREST certified host intrusion analyst (CCHIA).
• CREST certified malware reverse engineer (CCMRE).
• GIAC Certified (Network) Forensic Analyst (GCFA, GNFA).
• Location

Our core hubs for this role are either

• London (Canary Wharf)
• Manchester (St Peter's Square)

You must be within commutable distance to one of these locations.

Current KPMG policy is 60% of the week with clients or our offices, 40% elsewhere (that can include working from home).

#J-18808-Ljbffr