> Markdown version of [/jobs/ext/1920595-manager-incident-response](https://www.wearedevelopers.com/jobs/ext/1920595-manager-incident-response). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Manager, Incident Response

- **Company:** Kpmg LLP
- **Location:** Minneapolis, MN, United States
- **Experience:** Expert
- **Salary:** $23,733.0
- **Contract:** Permanent contract
- **Skills:** Network Security, Security Information and Event Management, Cyber Threat Analysis, Cybercrime
- **Published:** August 4, 2026
- **Apply:** https://www.juju.com/job/00000000glllxd

## About the Role

Five years of experience in cybersecurity incident response or cyber threat management is required

Bachelor's degree from an accredited college or university (or equivalent work experience); advanced degree a plus

Proven experience leading cyber incident investigations and managing escalations in high pressure environments, applying established incident response frameworks (e.g., NIST, SANS) and breach response practices

Hands on experience with security monitoring and response technologies, including SIEM, EDR, DLP, network security, and threat intelligence platforms

Strong engagement and stakeholder management capabilities, with the ability to lead complex workstreams, balance competing priorities, and communicate effectively-including presenting to senior executives

Demonstrated professionalism and judgment, exhibiting a high degree of integrity and the ability to manage sensitive and confidential matters, Bachelor Degree

## Description

Lead and manage cyber incident response activities, including triage, containment, eradication, and recovery efforts for client incidents

Oversee and coordinate incident investigations across cyber threats such as ransomware, data breaches, insider threats, and advanced persistent threats

Lead and coordinate incident response engagements, including client communications, executive briefings, war-room facilitation, and cross functional stakeholder management (legal, forensics, privacy, communications, and leadership) during high impact events

Oversee incident investigation and remediation, including root cause analysis, development of actionable improvement plans, and integration with broader cyber resilience practices

Manage incident response delivery and performance, defining and tracking SLAs, metrics, reporting, and contributing to the enhancement of incident response playbooks, methodologies, and service offerings

Collaborate and lead within the Cyber & Tech Risk practice, partnering across threat management, governance, risk, compliance, privacy, and technology risk teams while mentoring and developing incident response personnel

Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment


## Related Videos

- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure)
- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Small, Secure, Interconnected: The next Internet Protocol](https://www.wearedevelopers.com/videos/100062-small-secure-interconnected-the-next-internet-protocol)
- [Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra)
- [Forecasting Cyber Attacks with Glassdoor Reviews - Lianne Potter](https://www.wearedevelopers.com/videos/2143-forecasting-cyber-attacks-with-glassdoor-reviews-lianne-potter)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [System change: restart as developer?](https://www.wearedevelopers.com/magazine/39-system-change-restart-as-developer)
- [From developer to manager – what does it take to become an engineering manager?](https://www.wearedevelopers.com/magazine/42-from-developer-to-manager-what-does-it-take-to-become-an-engineering-manager)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Best Companies to Work For in Berlin: Top 14 Companies in 2023 ](https://www.wearedevelopers.com/magazine/188-best-companies-to-work-for-in-berlin-top-14-companies-in-2023)
- [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)