Cyber Response and Recovery - Assistant Manager (Reactive)

The Cyber Response from ransomware to advanced network intrusions is a pre-requisite. Our clients expect that cyber-incidents will be tackled with urgency, therefore, there is an expectation that you will be flexible in terms of working hours and be on call (on a rotation basis). In addition, you should be prepared to travel on short notice for periods up to 2 or 3 weeks at a time. Above all, KPMG is looking for someone who is passionate about helping our clients with their cyber security challenges, often at a time of critical need. In return, we are committed to helping you to enjoy the role and develop your skills and career within the KPMG with the objective of progressing into a senior leadership role. Why join us? One of only nine UK Tier 1 incident response providers Access to nationally significant incidents Exposure across government and critical infrastructure Investment in certifications and training Opportunity to shape a rapidly growing capability What will you be doing? Perform incident response activities during cyber security incidents for our clients (this includes being available to work on-call monthly). Carry out digital forensics of relevant incident data (disk, volatile memory, network packets, log files). Maintain a current view of the cyber threat and being able to advise clients on the threat landscape and attacks which may be relevant to them. Liaising with clients on delivery, implementation and project issue. Ability to generate well-structured responses to bids and requests for proposals. This role requires current SC or DV clearance, or eligibility and willingness to obtain clearance., You should have a strong background in cyber-security and incident response. For example: You should be able to guide a client through an unstructured incident response process (such as an advanced network intrusion) - managing resources and defining objectives at each stage of the incident response process; scoping and triage, containment, evidence preservation and extraction, eradication, recovery, forensic analysis and investigation. A broad understanding of the cyber security threat landscape. Strong technical background in computers and networks, and programming skills. Proven experience of dealing with cyber security incidents and associated response measures. Understanding of a wide range of information security and IT methodologies, principles, technologies and techniques. Excellent interpersonal, written and communication skills. Skills you'd love to see/Amazing Extras: The successful candidate will demonstrate competency in computing and networks as well as in cyber-security either by having the relevant work experience, completed a degree or obtained industry relevant certification. Therefore the qualifications below should be seen as means to demonstrate competency and not as a requirement. Preferred: Incident management certifications such as: CREST Certified Incident Manager (CCIM) GIAC Certified Incident Handler (GCIH) CREST Certified Practitioner Intrusion Analyst (CPIA) Degree level qualified, MSc in Information Security, IT or relevant STEM subjects.