The role will be working in the Cyber Response Services (CRS) Team within our Risk Consulting practice. Cyber security is one of the areas which KPMG has identified for tremendous investment and growth. Our clients face a challenging cyber threat and look to us to help them understand and respond to that threat.This is a hands-on role with opportunities to grow into management. The successful candidate is expected to manage cyber-security incidents as well as perform digital forensics (disk, volatile memory, network packets, logfiles) and help advance KPMG’s proprietary in-house toolkit.In this role we are looking for a person who can demonstrate strong technical background, experience in incident response and digital forensics and is looking to grow skills and experience. You will be expected to lead one or two analysts to achieve a task in a project, as well as have the opportunity to work with, and learn from, our most experienced team members as part of your continuous development.
- Help manage and co-ordinate cyber security incidents for our clients, working closely with the incident management lead within the team.
- Help with project management of engagements to deliver high quality work in a timely manner, including:
- Basic financial management
- Engagement and risk management
- Digital forensics of relevant incident data (disk, volatile memory, network packets, log files).
- Maintaining a current view of the cyber threat, and being able to advise clients on the threat landscape and attacks which may be relevant to them.
- Develop KPMG’s in house cyber-response tools
- Help assess client incident response capability maturity.
- Help stand-up or improve clients’ own incident response capabilities.
- Production and review of deliverables.
- Liaising with clients on delivery, implementation and sales issues.
- A broad understanding of the cyber security threat landscape.
- Strong technical background in computers and networks, and programming skills.
- Understanding of a wide range of information security and IT methodologies, principles, technologies and techniques.
- A genuine interest and desire to work in the information security field.
- Standing and positive reputation in the information security community is seen as a plus.
Qualification & Experience:
- Excellent communication skills (both written and oral) and project management skills.
- Strong IT and network skills – knowledge of common enterprise technologies – Windows and Windows Active Directory, Linux, Cisco, etc.
- (Preferred) General information security certificates such CISSP, CISM or CISA.
- (Preferred) Incident management certifications such as:
- CREST certified incident manager (CCIM)
- Experience of dealing with cyber security incidents and associated response measures.
- Experience of being part of an incident response team, either holding a formal role, or being able to evidence your personal contribution to the team.
- GIAC Certified Incident Handler (GCIH)
- (Preferred) Digital forensics certificates such as:
- CREST certified registered intrusion analyst (CRIA)
- Working programming skill-set to be able to author and develop tools. Most in-house security tools in KPMG are written in Python, but we accept that a competent programmer will be able to transfer skillsets across languages.
- Technical proficiency in at least one of these areas: network security/traffic/log analysis; Linux and/or Mac/Unix operating system forensics; Linux/Unix disk forensics (ext2/3/4, HFS+, and/or APFS file systems), advanced memory forensics, static and dynamic malware analysis / reverse engineering, advanced mobile device forensics
- Advanced experience in industry computer forensic tools such as X-Ways, EnCase, FTK, Internet Evidence Finder (IEF) / AXIOM, TZWorks, and/or Cellebrite
- Advanced experience in preservation of digital evidence (including experience preserving cloud data and handling encryption such as BitLocker, FileVault, and/or LUKS)
- Experience with and understanding of enterprise Windows security controls
- (Preferred) Degree level qualified, MSc in Information Security, IT or relevant STEM subjects.
- CREST certified network intrusion analyst (CCNIA)
- CREST certified host intrusion analyst (CCHIA)
- CREST certified malware reverse engineer (CCMRE)
- GIAC Certified (Network) Forensic Analyst (GCFA, GNFA)
- (Preferred) A current government security clearance (SC/DV) or willingness to acquire such a clearance will be seen as an advantage.
Vacancy Type: Full Time
Job Location: London, England
Application Deadline: N/A