Cloud Cyber Incident Response Manager

Booz Allen Hamilton•McLean, VA

21h•$112,800 - $257,000•Remote

About The Position

Serve on the cloud cyber incident response leadership team, providing strategic direction, operational oversight, client delivery, and growth for multiple incident response teams. Oversee complex digital forensic investigations and cybersecurity incident response engagements across cloud environments, ensuring work meets client, legal, regulatory, and business requirements. Act as a senior advisor during high-severity incidents and communicate with client executives, legal counsel, cyber insurance carriers, regulators, and other stakeholders. Lead and develop team leads and senior personnel, including career management, employee development, performance management, and disciplinary actions. Promote accountability, collaboration, technical excellence, and strong client service. Maintain relationships with breach counsel, law firms, and corporate clients; support new business opportunities and account growth; and contribute to the development of the DFIR practice. Oversee incident response team operations and performance. Establish and maintain DFIR policies, standards, procedures, investigative methodologies, and documentation requirements. Provide senior oversight and serve as the escalation point for major incidents, sensitive matters, client concerns, and investigative decisions. Review significant findings, reports, executive briefings, timelines, and client deliverables, and communicate findings, risks, limitations, and recommendations to executive, legal, technical, and non-technical audiences. Collaborate with legal, Human Resources, privacy, compliance, and risk teams during sensitive investigations. Ensure investigative activities comply with applicable legal, privacy, contractual, and regulatory requirements. Identify opportunities to improve investigative processes, automation, services, and technical capabilities. Represent the organization at client meetings, industry events, conferences, and other market-facing activities. U.S. citizenship is required due to the nature of the work performed within the facility.

Requirements

7+ years of experience in digital forensics, incident response, cybersecurity investigations, or cyber risk.
3+ years of experience leading incident response teams, forensic investigation teams, or cybersecurity functions.
Experience managing multiple teams, senior technical personnel, or a geographically distributed workforce.
Experience leading complex cybersecurity incidents involving executive, legal, insurance, or regulatory stakeholders.
Experience serving as a senior advisor during significant cyber incidents such as ransomware, data breach, or business email compromise.
Experience with employee development, career management, performance management, and disciplinary actions.
Experience developing and maintaining client relationships within cyber insurance, legal, incident response, or cybersecurity markets.
Experience investigating incidents in cloud platforms, including AWS, Azure, or GCP.
Knowledge of digital forensic methodologies, evidence preservation, chain of custody, investigative documentation, and defensible reporting.
Ability to develop scripts and use log and data analysis platforms, including Elastic, Splunk, or AWS Athena.
Ability to identify opportunities, expand client relationships, contribute to business growth, and communicate technical findings and business risks to executives, boards, legal counsel, insurers, and senior stakeholders.
Bachelor’s degree in Cybersecurity, Computer Science, Business Administration, or Digital Forensics.
U.S. citizenship is required.

Nice To Haves

Experience building or expanding a digital forensics or incident response practice.
Experience building client relationships.
Experience working with cyber insurance carriers, claims teams, insurance brokers, breach counsel, and insured organizations.
Experience with pipeline management, utilization, profitability, and engagement economics.
Experience negotiating statements of work, master services agreements, retainers, pricing structures, or preferred-provider arrangements.
Experience developing thought leadership, executive briefings, conference presentations, or market-facing content.
Ability to develop and grow a portfolio of business.
Master’s degree in Cybersecurity, Computer Science, Business Administration, Digital Forensics, or a related field.
CISM, GCFR, GCFA, GCIH, GREM, GNFA, or similar certification.

Responsibilities

Provide strategic direction, operational oversight, client delivery, and growth for multiple incident response teams.
Oversee complex digital forensic investigations and cloud cybersecurity incident response engagements.
Serve as senior advisor and escalation point during high-severity incidents, sensitive matters, client concerns, and investigative decisions.
Lead team leads and senior personnel, including career management, employee development, performance management, and disciplinary actions.
Establish and maintain DFIR policies, standards, procedures, investigative methodologies, and documentation requirements.
Review significant findings, investigative reports, executive briefings, timelines, and client deliverables.
Communicate material findings, risks, limitations, and recommendations to executive, legal, technical, and non-technical audiences.
Maintain and strengthen relationships with breach counsel, law firms, corporate clients, and other stakeholders.
Support new business opportunities, account growth, revenue and pipeline objectives, and broader practice development.
Collaborate with legal, Human Resources, privacy, compliance, and risk teams during sensitive investigations.
Ensure investigations comply with applicable legal, privacy, contractual, and regulatory requirements.
Identify improvements to investigative processes, automation, service offerings, and technical capabilities.
Represent the organization at client meetings, industry events, conferences, and other market-facing activities.