Cyber Response & Recovery – Manager, Remediation Focus

KPMG UK

. Lead and support cyber recovery workstreams during active cyber incidents and post-incident remediation programmes .

Posted 11/11/2026full-timeManchester • United KingdomMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cyber recovery and incident response, with strong capabilities in managing recovery engagements, developing remediation strategies, and leading technical teams. Proficient in hands-on remediation across various systems and environments, ensuring robust recovery and security improvements.

Highest-signal resume keywords

Cyber Security Incident ResponseActive Directory HardeningWindows Server AdministrationCloud Environments (Azure, AWS)Project Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Infrastructure AdministrationNetwork Architecture DesignVulnerability RemediationBackup ValidationRansomware RecoverySecurity Roadmap DevelopmentRemediation Tracker DeliverySystem RebuildFirewall DesignSegmentation Techniques

Soft Skills

Interpersonal CommunicationStakeholder ManagementMentoringAttention to DetailFlexibility

Tools & Technologies

Security ToolingIncident Response ToolsAutomation ToolsLab EnvironmentsTechnical Playbooks

Certifications & Qualifications

SC ClearanceDV Clearance

Industry Keywords

Cyber RecoveryIncident ManagementCyber ResilienceInformation SecurityIT Methodologies

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityLinux

About the role

Key responsibilities & impact

Lead and support cyber recovery workstreams during active cyber incidents and post-incident remediation programmes
Translate incident findings into clear remediation and recovery actions
Deliver hands-on remediation across Active Directory, Windows/Linux systems, networks, cloud, endpoints, and security tooling
Remove attacker persistence and restore trust in compromised environments
Drive patching and vulnerability remediation based on business risk, threat actor behaviour, and incident context
Review and redesign network architecture and security controls, including segmentation, firewall rules, and administrative access pathways
Establish and support secure recovery environments and rebuild strategies
Validate backups, sequence restores, and securely restore business-critical services
Define and execute phased recovery and transformation plans covering stabilisation, remediation, security improvement roadmaps, and rebuild standards
Manage end-to-end recovery engagements, including stakeholder communication, project management, reporting, proposals, and capability development
Mentor junior team members
Support cyber resilience, recovery readiness, and post-incident transformation engagements
Develop recovery playbooks, isolated recovery environments, resilience assessments, ransomware recovery plans, network segmentation improvements, backup and restore strategies, and cyber security roadmaps
Contribute to KPMG’s cyber recovery capability through standard operating procedures, technical playbooks, tooling, automation, lab environments, architecture patterns, and team training
Work with incident response leads, forensic teams, legal advisers, crisis management teams, technology teams, client executives, client IT, insurers, and senior stakeholders

Requirements

What you’ll need

Current SC or DV clearance, or eligibility and willingness to obtain clearance
Strong background in cyber-security and incident response
Deep infrastructure and systems administration experience
Strong technical background in computers and networks, and programming skills
Significant and proven experience dealing with cyber security incidents and associated response measures
Experience managing a rapid deployment incident response team
Broad understanding of the cyber security threat landscape
Understanding of information security and IT methodologies, principles, technologies and techniques
Strong hands-on experience across Windows Server, Active Directory, Linux, networking, and cloud environments such as Azure, AWS, and Microsoft 365
Experience supporting cyber incident recovery, including ransomware, Active Directory compromise, network intrusion, or large-scale infrastructure incidents
Experience leading remediation activities, including identity and Active Directory hardening, patching and vulnerability remediation, secure system rebuild, backup validation, and restoration of business-critical services
Understanding of network architecture and security, including segmentation, firewall design, and administrative access paths
Experience developing and delivering structured recovery plans, remediation trackers, and security roadmaps
Project and delivery management capability, including scoping, prioritisation, financial oversight, and managing multiple workstreams
Excellent interpersonal, written, oral communication, stakeholder management, and project management skills
Strong attention to detail and ability to manage multiple simultaneous cases
Genuine interest in developing and mentoring junior team members
Flexibility in working hours and willingness to participate in an on-call rotation
Preparedness to travel on short notice for periods of up to 2 or 3 weeks
Competency may be demonstrated through relevant work experience, a completed degree, or industry-relevant certification; listed qualifications are not requirements

Benefits

Comp & perks

Investment in certifications and training
Opportunity to shape a rapidly growing capability
Technical growth and career progression into senior cyber response and recovery leadership roles
Access to nationally significant incidents
Exposure across government and critical infrastructure
Opportunity to work on complex, high-profile cyber incidents across a wide range of sectors