Cyber Response & Recovery Manager (Remediation)

Cyber Response scoping and triage, containment, evidence preservation and extraction, eradication, recovery, forensic analysis and investigation.

A broad understanding of the cyber security threat landscape.

Strong technical background in computers and networks, and programming skills.

Significant and proven experience of dealing with cyber security incidents and associated response measures.

Experience of managing a rapid deployment incident response team.

Excellent interpersonal, written and communication skills.

Understanding of a wide range of information security and IT methodologies, principles, technologies and techniques.

A genuine interest and desire to develop and mention junior team members.

Strong attention for detail and the ability to manage multiple simultaneous cases.

Skills we’d love to see/Amazing

Extras: The successful candidate will demonstrate competency in computing and networks as well as in cyber-security either by having the relevant work experience, completed a degree or obtained industry relevant certification.

Therefore the qualifications below should be seen as means to demonstrate competency and not as a requirement.

The desired skill and qualification is provided below: Excellent communication skills (both written and oral) and project management skills.

Strong hands-on experience across enterprise infrastructure, including Windows Server, Active Directory, Linux, networking, and cloud environments (e. g.

Azure, AWS, Microsoft 365), with the ability to operate at a systems administrator level during recovery scenarios.

Proven experience supporting cyber incident recovery, including ransomware, Active Directory compromise, network intrusion, or large-scale infrastructure incidents, with the ability to translate incident findings into practical remediation and recovery actions.

Demonstrated capability in leading and executing remediation activities, including identity and Active Directory hardening, patching and vulnerability remediation, secure system rebuild, backup validation, and restoration of business-critical services.

Solid understanding of network architecture and security, including segmentation, firewall design, administrative access paths, and the ability to review and redesign environments to reduce reinfection risk and improve resilience.

Experience developing and delivering structured recovery plans, remediation trackers, and security roadmaps aligned to immediate recovery, medium-term stabilisation, and long-term transformation.

Strong stakeholder management and communication skills, with the ability to engage both technical and executive audiences, manage high-pressure situations, and produce clear, high-quality deliverables and reporting.

Effective project and delivery management capability, including scoping, prioritisation, financial oversight, and managing multiple workstreams during complex, time-sensitive cyber recovery engagements.

Location: Our core hubs for this role are either: London (Canary Wharf); or Manchester (St Peter’s Square).

You must be within commutable distance to one of these locations.

Current KPMG policy is 60% of the week with clients or our offices, 40% elsewhere (that can include working from home).