Associate Director, Cyber Response

The Associate Director is responsible for managing the Cyber Response Team in the US and leading overall delivery of incident response cases in the region. This role involves leading the technical aspects of the cyber response practice, managing our technical team members as well as managing client relationships. This role will report to Global Head of Cyber Response and work in tandem with European, Middle East and Asia colleagues on a follow-the-sun basis. The successful candidate will have a strong technical skill set, deep understanding of the North American cyber incident response market and a deep understanding of current and emerging advanced threat actors. They will have a proven track record of responding to advanced threats leveraging forensics and threat hunting technology.

Role tasks and responsibilities

Technical response

• Oversee incident response cases for all host and network based investigations, be responsible for the overall quality of our technical incident response work.
• Ownership of the entire lifecycle of a cyber incident including identification, containment, eradication and recovery. A particular area of specialty in eradication and recovery from an incident.
• Threat hunting using EDR tooling to evaluate an attacker's spread through a system and network, anticipating and thwarting further attacker activity.
• Perform live compromise assessments for organizations who suspect a compromise.
• Detect and hunt unknown live, dormant, and custom malware in memory across multiple systems in an enterprise environment.
• Demonstrate a deep understanding of both existing and emerging threat actors, as well as experience identifying rapidly changing tools, tactics and procedures of attackers.
• Advise on the safe technical recovery of an organizations IT systems balancing the need to understand what has happened but speed up recovery.
• Be responsible for Control Risks technical Cyber Response strategy. Identify, design and then implement solutions that meet these strategic objectives.

Client Management

• To build and develop client relationships facilitating where appropriate introduction and provision of additional Control Risks services. Working closely with the Global Head of Cyber Response and Global colleagues to ensure a cohesive go-to-market approach.
• Possess and develop working knowledge of key insurer and law firm relationships that may drive growth.

Reporting

• Provide situation reports and other significant case related material to the client and the Director of Cyber Response.
• Provide documentation to the relevant consultants in sufficient time to allow review and feedback, before submitting to a client.
• Report on the performance of the Technical Cyber Response work and forecast technical and resource requirements in the near and long term.

Team management

• Establish resourcing requirements for our already growing Cyber Response practice, hire and then manage these technical individuals.
• Establish relationships with key recruiters and where possible align with the Cyber Crisis Management teams resourcing plans.
• Align with and help to expand the already re-occurring Internship Program and where business need requires onboard interns into the technical team.
• Define clear roles and responsibilities for new hires including a learning pathway for training & development.
• Ensure new joiners have appropriate time dedicated to technical development and research whilst balancing un-predictable workload.

Governance

• Own the technical response Standard Operating Procedures, working with the team to ensure they are kept up to date with the latest threats.
• Ensure issues identified during delivery of cases are identified, escalated and resolved efficiently.

Supporting the growth of the Cyber Response practice

• Refining Control Risks’ cyber response methodologies and approaches and tailoring the approach in changing market conditions.
• Identifying potential new areas of growth and opportunity.

Requirements

• Candidates must be legally authorized to work in the US on a permanent basis without sponsorship.
• Candidates must possess unrestricted US work authorization.
• Proven experience in technically responding to significant and complex cyber attacks and information security related advisory
• Proven experience of managing and/or building the requisite technologies necessary for responding to a wide variety of common cyber security incidents
• Demonstrable experience of operating within a commercial environment and engaging with key stakeholders in insurance and risk m