> Markdown version of [/jobs/ext/76236-manager-incident-response](https://www.wearedevelopers.com/jobs/ext/76236-manager-incident-response). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Manager, Incident Response

- **Company:** Kpmg LLP
- **Location:** Chicago, IL, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Network Security, Security Information and Event Management, Cyber Threat Analysis, Cybercrime
- **Published:** May 15, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=c2c6213ab31640f1

## About the Role

Do you have experience in Threat intelligence?, Do you have a Bachelor's degree?, * Five years of experience in cybersecurity incident response or cyber threat management is required

 * Bachelor's degree from an accredited college or university (or equivalent work experience); advanced degree a plus
 * Proven experience leading cyber incident investigations and managing escalations in high pressure environments, applying established incident response frameworks (e.g., NIST, SANS) and breach response practices
 * Hands on experience with security monitoring and response technologies, including SIEM, EDR, DLP, network security, and threat intelligence platforms
 * Strong engagement and stakeholder management capabilities, with the ability to lead complex workstreams, balance competing priorities, and communicate effectively-including presenting to senior executives
 * Demonstrated professionalism and judgment, exhibiting a high degree of integrity and the ability to manage sensitive and confidential matters
 * Must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future. KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)

## Description

* Lead and manage cyber incident response activities, including triage, containment, eradication, and recovery efforts for client incidents
 * Oversee and coordinate incident investigations across cyber threats such as ransomware, data breaches, insider threats, and advanced persistent threats
 * Lead and coordinate incident response engagements, including client communications, executive briefings, war-room facilitation, and cross functional stakeholder management (legal, forensics, privacy, communications, and leadership) during high impact events
 * Oversee incident investigation and remediation, including root cause analysis, development of actionable improvement plans, and integration with broader cyber resilience practices
 * Manage incident response delivery and performance, defining and tracking SLAs, metrics, reporting, and contributing to the enhancement of incident response playbooks, methodologies, and service offerings
 * Collaborate and lead within the Cyber & Tech Risk practice, partnering across threat management, governance, risk, compliance, privacy, and technology risk teams while mentoring and developing incident response personnel
 * Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment


## Related Videos

- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure)
- [Small, Secure, Interconnected: The next Internet Protocol](https://www.wearedevelopers.com/videos/100062-small-secure-interconnected-the-next-internet-protocol)
- [Forecasting Cyber Attacks with Glassdoor Reviews - Lianne Potter](https://www.wearedevelopers.com/videos/2143-forecasting-cyber-attacks-with-glassdoor-reviews-lianne-potter)
- [Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [UK Business Culture and Etiquette](https://www.wearedevelopers.com/magazine/326-uk-business-culture-and-etiquette)
- [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk)
- [Best Companies to Work For in Berlin: Top 14 Companies in 2023 ](https://www.wearedevelopers.com/magazine/188-best-companies-to-work-for-in-berlin-top-14-companies-in-2023)
- [System change: restart as developer?](https://www.wearedevelopers.com/magazine/39-system-change-restart-as-developer)
- [Finding IT & Technology English-speaking Jobs in Germany ](https://www.wearedevelopers.com/magazine/446-finding-it-technology-english-speaking-jobs-in-germany)