Incident Response and Operations Lead

About Us

KPMG is part of a global network of firms that offers Audit, Tax & Pensions, Consulting, Deal Advisory, and Technology services. Through the talent of over 16,000 colleagues, we bring our creativity and insight to our clients’ most critical challenges.

With offices across the UK, we work with everyone from small start-ups and individuals to major multinationals, in virtually every industry imaginable. Our work is often complex, yet our vision is simple: to be the clear choice for our clients, for our people, and for the communities we work in.

Overview

The Head of Incident Response and Investigations is a key role within the Operational Security team, part of the wider Cyber Security team at KPMG UK.

The Incident Response and Investigation team covers two capabilities: Incident Response & Investigations. The team is comprised of approximately 8 colleagues in addition to using a third-party SOC service.

This role requires a strategic thinker and will develop, implement, and oversee the incident response and investigation services. They will be responsible for ensuring we have the ability to respond to and recover from cyber security threats to the UK firm on 24x7 basis.

This represents an exciting opportunity to join a growing function and getting to a right level of maturity. With the recent merger of the UK and Swiss firms, there are many opportunities for alignment and this role will be key to identifying opportunities to work together. There are also a number of in-flight investments which will allow us to continue to evolve in our operational security capabilities.

Reporting and Accountability

This role reports directly to the Head of Operational Security. It will have regular interactions with counterparts in Switzerland (following the recent merger), other members of the Cyber and Operational Security leadership team including stakeholders from across the IT leadership and the business.  

The role will need to collaborate with colleagues from counterparts from other KPMG entities around the world and work with key vendors including our third-party SOC provider.

The role holder will represent first line Cyber Security for Incident Response on various governing bodies and audits to provide updates on the firm's cyber security posture and initiatives.

Key Responsibilities

• Lead the core Incident Response and Investigation service across KPMG UK.
• Lead a team of Information Security Professionals (split between UK and India), providing direction, mentorship, and support to ensure high performance and professional growth.
• Develop and maintain comprehensive incident response plans and procedures, including playbooks, to address a wide range of cyber risk events.
• Lead the incident response team in the investigation and resolution of security incidents, working with internal and external stakeholders as needed.
• Coordinate with relevant areas of the business to ensure timely communication and remediation of incidents in accordance with regulatory requirements and policies
• Conduct post-incident reviews to identify root causes and implement improvements.
• Champion the Incident Response and investigation services delivered by the first line of defence security team across the UK and Swiss firm.
• Regularly review and update incident response and investigation processes to ensure they remain effective and efficient.
• Be the primary UK and Swiss security operations representative for information security response global initiatives to ensure that the UK is appropriately engaged and contributes.
• Be the service owner for providers that deliver essential security services to the firm, including but limited to DLP, Digital Forensics, Incident Response.
• Report key performance indicators (KPIs) and Key Risk Indicators (KRIs) for Incident Response services.
• Stay informed about the latest cyber security trends, threats, and technologies to continuously enhance the firm's security posture.

Experience

• Bachelor’s degree in Cyber Security, Information Technology, Computer Science, or a equivalent professional experience.
• Relevant certifications such as CISSP, CISM, or CEH are highly desirable.
• Proven track record as an experienced member of Security Operations or Incident Response teams – either as an individual contributor or as a manager.
• Proven track record of building and operating Information security response services and other security managed services.
• Proven experience leading and managing incident response teams in a professional services environment.
• Experience in managing and responding to complex security incidents and data breaches.
• Robust understanding of security issues, mitigations, and a strong understanding of the current global threat environment.
• Strong knowledge of cyber security regulations, standards, and best practices.
• Experience working in a highly regulated industry such as finance, healthcare, or energy is a plus.
• Excellent leadership and management skills, with the ability to inspire and motivate a team.
• Strong analytical and problem-solving skills, with the ability to assess and mitigate risks effectively.
• Exceptional communication and interpersonal skills, with the ability to work collaboratively with diverse stakeholders.
• High level of integrity and professionalism, with a commitment to ethical conduct and confidentiality.
• Ability to stay calm and focused under pressure, especially during security incidents and emergencies in the face of ambiguity and imperfect knowledge.
• Be capable of achieving UK government security clearance.

LI-AR1