Director, Incident Response
KPMG US
Atlanta, GA
The Role
This senior consulting position leads complex enterprise incident response engagements from containment through recovery and post-incident resilience. Day-to-day responsibilities include directing root cause analysis, advising boards and executive leadership during active crises, overseeing remediation initiatives, and driving continuous improvement of IR methodologies and playbooks across client engagements.
Skills & Experience
Candidates require at least ten years in incident response or related cybersecurity disciplines and seven years leading large-scale IR teams. Expertise in digital forensics, SIEM, EDR/XDR platforms, NIST and SANS frameworks, and cloud environments (Azure, AWS, GCP) is essential. Certifications such as CISSP, GCIH, GCFA, GCFE, or CISM are strongly preferred.
Who It Suits
This role suits a seasoned DFIR leader with strong executive presence, established relationships in the law firm and insurance sectors, and a track record of building cyber resilience programmes. Conference speakers and those comfortable managing multiple high-priority client engagements simultaneously will thrive here.
Typical advertised salary for Incident Response roles in United States: $123,000–$179,000 (median $149,000 — from 159 recent listings analysed by Forensic Focus).
Compare Incident Response salaries in United States →
Certifications mentioned: GCFA · GCFE · GCIH · CISSP · CISM · SANS — find training for these on the DFIR Training Finder.