Associate Director, Cyber Operations – Cyber Response and Digital Forensics

About the role

KPMG is looking for an experienced Associate Director to lead Cyber Operations within its Enterprise Security Services organization. The role focuses on cyber response and digital forensics, handling high‑severity incidents and delivering actionable insights to senior leadership.

Key responsibilities

• Lead end‑to‑end investigations of high‑severity cyber events, producing post‑incident reports and briefings for C‑suite executives.
• Perform disk, memory, log and network packet analysis across Windows, Linux and multi‑cloud environments (Azure, AWS, GCP) to reconstruct attack timelines.
• Translate forensic findings into immediate countermeasures such as custom EDR blocks, firewall rules and network segmentation.
• Design and scale automated triage workflows, develop Python and PowerShell scripts, custom YARA rules and detection content for EDR/SIEM platforms.
• Supervise and mentor junior forensic analysts, lead tabletop exercises and improve standard operating procedures.

Required profile

• Minimum eight years of hands‑on experience in digital forensics, incident response or threat hunting within an enterprise or consulting environment.
• Active industry certifications such as GIAC (GCFA, GCFE, GNFA, GCIH), EnCE, CFCE or CISSP.
• Proven track record leading complex, high‑visibility cybersecurity incidents in federated, multi‑cloud and on‑premise environments.
• Eligibility to work in the United States without sponsorship.

Required skills

• Python
• PowerShell
• YARA
• EnCase, FTK, Axiom, X‑Ways, Volatility
• CrowdStrike Falcon, Microsoft Defender for Endpoint, Splunk
• Azure, AWS, GCP
• Windows, Linux

What we offer

• Comprehensive benefits package including medical, dental, vision, disability, life insurance and 401(k) plans.
• Generous Personal Time Off, holiday calendar and additional paid breaks throughout the year.