Cyber Incident Response Manager - German Speaking

Cyber Response from ransomware to advanced network intrusions is a pre-requisite. Our clients expect that cyber-incidents will be tackled with urgency, therefore, there is an expectation that you will be flexible in terms of working hours. In addition, you should be prepared to travel on short notice for periods up to 2 or 3 weeks at a time. Above all, KPMG is looking for someone who is passionate about helping our clients with their cyber security challenges, often at a time of critical need. In return, we are committed to helping you to enjoy the role and develop your skills and career within KPMG with the objective of progressing into a senior leadership role.

Responsibilities

• Manage and co-ordinate cyber security incidents for our clients, working closely with the cyber response leadership team.
• Digital forensics of relevant incident data (disk, volatile memory, network packets, log files).
• Maintaining a current view of the cyber threat, and being able to advise clients on the threat landscape and attacks which may be relevant to them.
• Manage the development of KPMG’s in-house cyber-response tools.
• Assess client incident response capability maturity.
• Help stand-up or improve clients’ own incident response capabilities.
• Project management of engagements to deliver high quality work in a timely manner, including: scoping and costing of engagements, financial management of projects, engagement and risk management, production and review of deliverables to a high standard.
• Liaising with clients on delivery, implementation and project issues.
• Ability to generate well-structured responses to bids and requests for proposals.

The Person

• You should have a strong background in cyber-security and incident response.
• You should be able to guide a client through an unstructured incident response process (such as an advanced network intrusion) – managing resources and defining objectives at each stage of the incident response process; scoping and triage, containment, evidence preservation and extraction, eradication, recovery, forensic analysis and investigation.
• A broad understanding of the cyber security threat landscape.
• Strong technical background in computers and networks, and programming skills.
• Significant and proven experience of dealing with cyber security incidents and associated response measures.
• Experience of managing a rapid deployment incident response team.
• Excellent interpersonal, written and communication skills.
• Understanding of a wide range of information security and IT methodologies, principles, technologies and techniques.
• A genuine interest and desire to develop and mentor junior team members.
• Strong attention for detail and the ability to manage multiple simultaneous cases.

Qualifications and Skills

• The successful candidate will demonstrate competency in computing and networks as well as in cyber-security either by having the relevant work experience, completed a degree or obtained industry relevant certification.
• Excellent communication skills (both written and oral) and project management skills.
• Strong IT and network skills – knowledge of common enterprise technologies – Windows and Windows Active Directory, Linux, Cisco, etc.
• Working programming skill-set to be able to author and develop tools.
• Technical proficiency in at least one of these areas: network security/traffic/log analysis; Linux and/or Mac/Unix operating system forensics; Linux/Unix disk forensics (ext2/3/4, HFS+, and/or APFS file systems), advanced memory forensics, static and dynamic malware analysis/reverse engineering, advanced mobile device forensics.
• Advanced experience in industry computer forensic tools such as X-Ways, EnCase, FTK, Internet Evidence Finder (IEF)/AXIOM, TZWorks, and/or Cellebrite.
• Advanced experience in preservation of digital evidence (including experience preserving cloud data and handling encryption such as BitLocker, FileVault, and/or LUKS).
• Experience with and understanding of enterprise Windows security controls (Preferred).
• Degree level qualified, MSc in Information Security, IT or relevant STEM subjects (Preferred).
• General information security certificates such as CISSP, CISM or CISA (Preferred).
• Incident management certifications such as: CREST certified incident manager (CCIM), GIAC Certified Incident Handler (GCIH) (Preferred).
• Digital forensics certificates such as: CREST certified registered intrusion analyst (CRIA), CREST certified network intrusion analyst (CCNIA), CREST certified host intrusion analyst (CCHIA), CREST certified malware reverse engineer (CCMRE), GIAC Certified (Network) Forensic Analyst (GCFA, GNFA).

The successful candidate must be willing and able to undertake and acquire SC Clearance.

Our Locations: We are open to talk to talent across the country but our core hubs for this role are: London, Canary Wharf, Manchester. With 20 sites across the UK, we can potentially facilitate office work, working from home, flexible hours, and part-time options. If you have a need for flexibility, please register and discuss this with our team.