Forensics - Crisis and Investigations - Cyber Response - Manager

The opportunity

We are seeking an experienced Manager to lead client engagements involving cyber incidents, data breaches, and information security events. This role focuses on the post-incident response phase, helping clients assess impacted data, evaluate legal and regulatory obligations, coordinate remediation activities, and manage stakeholder communications. The successful candidate will serve as a trusted advisor to clients and executive stakeholders while leading multidisciplinary teams through complex breach response and recovery efforts.

Your key responsibilities

• Lead end-to-end breach response engagements following incident containment and forensic investigation.
• Direct the assessment and analysis of impacted data sets to determine potential exposure of sensitive, confidential, regulated, or personal information.
• Coordinate cross-functional teams including cybersecurity, privacy, legal, forensic, compliance, and client stakeholders.
• Advise clients on notification, regulatory, contractual, and reporting obligations arising from security incidents.
• Oversee data review, document analysis, impact assessments, and decision-making related to affected individuals and organizations.
• Develop executive-level reports, client deliverables, regulatory submissions, and board-ready communications.
• Guide clients through remediation planning and implementation, including process improvements and control enhancements.
• Manage large-scale projects involving multiple workstreams, tight deadlines, and significant stakeholder engagement.
• Provide strategic counsel to client leadership during high-profile and business-critical incidents.
• Mentor and develop engagement teams while ensuring quality and consistency of client deliverables.

Skills and attributes for success

• Lead engagement teams and provide oversight of technical analyses and client deliverables.
• Analyze findings in investigative matters and develop fact-based reports.
• Ability to identify and articulate opportunities for improvement while helping drive lessons learned activities.
• Demonstrate strong analytical, project management, and problem-solving skills.
• Coach, mentor, and develop staff and senior team members through active feedback and professional development.
• Identify opportunities to expand existing client relationships and support business development initiatives.
• Work effectively across multidisciplinary teams and manage competing priorities in a fast-paced environment.
• Leverage technology and innovation to enhance engagement delivery and team effectiveness.
• Application of emotional intelligence and calm under pressure.

To qualify for the role, you must have

• A bachelor’s or master’s degree in computer science, information systems, engineering, cybersecurity or a related field.
• 5 to 8 years of experience in cyber incident response, data breach response, digital forensics, privacy consulting, cybersecurity consulting, risk advisory, or related disciplines.
• Deep understanding of security threats, vulnerabilities, and incident response, to include the ability to digest threat intelligence and apply it to client engagements.
• Be familiar with a basic understanding of legalities surrounding electronic discovery and analysis.
• Strong understanding of privacy and data protection regulations, including notification and reporting requirements across multiple jurisdictions.
• Experience supervising engagement teams and reviewing work products.
• Strong written and verbal communication skills with the ability to present complex information to executive-level stakeholders.
• Proven ability to lead teams and manage multiple concurrent engagements in a fast-paced environment.
• Excellent executive communication, stakeholder management, and client-facing consulting skills.
• Strong negotiation and influencing skills, and the confidence to communicate complex technical concepts to a wide range of audiences
• Achieved or be willing to pursue related professional certifications such as GCFE, GCFA, GCIH, CISA, CISM, CISSP, or CCIM.
• The ability and willingness to travel and work in excess of standard hours when necessary.
• Access to reliable transportation to/from the EY office and client sites. A driver's license is strongly recommended as ride share and public transportation options may not be available in all locations.

Ideally, you’ll also have

• Experience working with Fortune 500 companies.
• Experience in industries such as manufacturing, healthcare, energy, infrastructure, or the public sector.
• Experience working with law enforcement, both domestic and internationally, in the cyber incident response or related crisis management field.

What we look for

• Demonstrated integrity in a professional environment.
• Ability to work independently, while also being able to contribute to a cohesive team environment under crisis conditions.
• Have a global mind-set for working with different cultures and backgrounds.
• Excellent social, communication, and writing skills.
• Knowledgeable in business industry standard security incident response process, procedures, and life cycle.
• Excellent organizational skills, teaming skills, and strong attention to detail.