Want to know if this job is worth applying to?
United States
Hybrid
AHEAD is seeking a Senior Consultant to help clients anticipate, withstand, recover from, and evolve beyond cyber incidents. This role will lead advisory and delivery work focused on incident recovery, cyber disaster recovery, response and recovery maturation, and post-incident resilience improvement.
The successful candidate will help organizations translate lessons from incidents, exercises, and threat exposure into practical improvements to recovery strategies, operating models, playbooks, architectures, governance, and testing programs. The role will also connect recovery planning to anticipation capabilities through purple-team-style validation: using realistic attack paths, threat hunting, exposure reconnaissance, and assume-breach scenarios to test whether exposure reduction, detection, response, and recovery controls work together.
This is a client-facing consulting role requiring strong technical judgment, executive communication, and the ability to move from strategy to implementation. The consultant should be comfortable working across security, infrastructure, cloud, applications, business continuity, risk, and crisis-management stakeholders.
Assess and mature incident response, cyber resilience, and threat intelligence capabilities.
Design or improve recovery operating models based on threat hunting scenarios, roles and responsibilities, escalation paths, and decision rights.
Develop and refine cyber recovery plans, recovery runbooks, crisis playbooks, and communications procedures.
Facilitate post-incident reviews, after-action reviews, and lessons-learned sessions that produce measurable improvements.
Create and conduct tabletop exercises, cyber recovery simulations, and technical recovery exercises.
Evaluate recovery dependencies across identity, networking, endpoints, applications, data, cloud platforms, backup infrastructure, and third parties.
Assess backup and restore strategies, including isolation, immutability, recoverability, privileged-access controls, and validation testing.
Help clients define critical attack paths, pertinent threat intelligence sources, and conduct exposure reconnaissance.
Create practical roadmaps to mature anticipation and recovery capabilities over time based on proven organizational threats.
Support implementation of prioritized improvements, coordinating with client technical teams and delivery partners.
Lead purple-team-style validation of cyber recovery readiness by translating realistic attack paths into scenarios that test prevention, detection, containment, response, and recovery.
Partner with offensive-security and defensive-security stakeholders to validate whether controls, telemetry, escalation paths, and recovery procedures work together.
Use threat intelligence, exposure findings, attack-path analysis, and detection gaps to prioritize resilience improvements.
Facilitate assume-breach exercises and adversary-emulation-informed tabletop exercises that produce actionable recovery requirements.
Use threat scenarios, exposure findings, and detection gaps to improve recovery readiness.
Identify control, telemetry, and detection improvements that would reduce time to contain, investigate, and recover.
Help clients connect vulnerability, exposure, detection, and recovery data into a risk-informed resilience program.
Contribute to assessments of compromise assumptions, blast radius, and recovery sequencing.
Provide feedback to upstream security capabilities based on incident and exercise findings.
Consulting and practice responsibilities
Lead workshops with technical, operational, risk, and executive stakeholders.
Produce clear deliverables, including assessment reports, target-state designs, roadmaps, playbooks, exercise materials, and executive briefings.
Serve as a trusted advisor to clients during high-consequence resilience and recovery initiatives.
Contribute reusable methods, accelerators, reference architectures, and points of view to AHEAD’s cyber resilience practice.
Mentor consultants and collaborate with account, delivery, and technical leadership.
Support proposal development, scoping, estimation, and solution shaping for relevant engagements.
Significant experience in cybersecurity consulting, incident response, cyber recovery, disaster recovery, business continuity, or a closely related discipline.
Demonstrated experience designing, assessing, testing, or improving incident response and recovery capabilities.
Strong understanding of enterprise infrastructure and security environments, including identity, endpoints, networks, cloud, applications, data, backups, and third-party dependencies.
Ability to distinguish and integrate cyber recovery, IT disaster recovery, business continuity, and crisis management practices.
Experience facilitating tabletop exercises, simulations, post-incident reviews, or recovery testing.
Ability to communicate complex technical risks and recovery decisions to both practitioners and executives.
Strong consulting skills, including workshop facilitation, structured problem solving, written communication, and stakeholder management.
Willingness to travel for client engagements as required.
Experience with ransomware recovery, destructive attacks, identity compromise, cloud recovery, or major cyber incident response.
Experience developing recovery architectures, clean-room or isolated recovery environments, cyber vaults, immutable backups, or recovery validation programs.
Experience with security operations, detection engineering, threat hunting, threat intelligence, attack-path analysis, or exposure management.
Familiarity with NIST CSF, NIST SP 800-61, NIST SP 800-34, CISA guidance, ISO 22301, ISO 27001, or comparable frameworks.
Relevant certifications such as CISSP, CISM, CBCP, CRISC, GCIH, GCIA, GCFA, or equivalent experience.
Experience operating in regulated, complex, or highly available environments.
Experience building offerings, methodologies, or delivery practices in a consulting organization.