Manager, Incident Response

About the role

KPMG Advisory is seeking a Manager, Incident Response to join our team. We foster a collaborative, team-driven culture where professionals thrive and grow both personally and professionally. With access to world-class training, leading market tools, and a wealth of learning opportunities, you’ll have the support to expand your skills and advance your career.

Responsibilities

• Lead and manage cyber incident response activities, including triage, containment, eradication, and recovery efforts for client incidents.
• Oversee and coordinate incident investigations across cyber threats such as ransomware, data breaches, insider threats, and advanced persistent threats.
• Lead and coordinate incident response engagements, including client communications, executive briefings, war-room facilitation, and cross-functional stakeholder management (legal, forensics, privacy, communications, and leadership) during high-impact events.
• Oversee incident investigation and remediation, including root cause analysis, development of actionable improvement plans, and integration with broader cyber resilience practices.
• Manage incident response delivery and performance, defining and tracking SLAs, metrics, reporting, and contributing to the enhancement of incident response playbooks, methodologies, and service offerings.
• Collaborate and lead within the Cyber & Tech Risk practice, partnering across threat management, governance, risk, compliance, privacy, and technology risk teams while mentoring and developing incident response personnel.
• Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment.

Qualifications

• Five years of experience in cybersecurity incident response or cyber threat management.
• Bachelor's degree from an accredited college or university (or equivalent work experience); advanced degree a plus.
• Proven experience leading cyber incident investigations and managing escalations in high-pressure environments, applying established incident response frameworks (e.g., NIST, SANS) and breach response practices.
• Hands-on experience with security monitoring and response technologies, including SIEM, EDR, DLP, network security, and threat intelligence platforms.
• Strong engagement and stakeholder management capabilities, with the ability to lead complex workstreams, balance competing priorities, and communicate effectively—including presenting to senior executives.
• Demonstrated professionalism and judgment, exhibiting a high degree of integrity and the ability to manage sensitive and confidential matters.
• Must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future.

KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa).