Disputes & Investigations - Senior Director, Incident Response Lead

Alvarez & Marsal; Greater London; On-site; GBP 180,000 - 260,000; Full time

Job summary

Alvarez & Marsal in London seeks a lead incident responder to run major cyber incidents end to end from London and shape EMEA capabilities. This hands-on role requires deep DFIR expertise and the ability to engage with the board, general counsel and sponsors under pressure.

Responsibilities include coordinating global responders, guiding legal and technical workstreams, and delivering evidence‑driven outcomes. Occasional travel across EMEA and readiness for out‑of‑hours work are expected.

Qualifications

• DFIR background and hands-on incident leadership experience across major cyber incidents including ransomware.
• Experience delivering investigations and forensic reports used in proceedings or regulator scrutiny.
• Comfort communicating with CEOs, general counsel and boards under pressure and in high‑stakes situations.
• Proven ability to coordinate cross‑border responders and manage time‑zone logistics.
• Established relationships with breach counsel and law firms instructing incident responses.
• Relevant certifications (GCFA, GCIH, GREM) or equivalent experience, and familiarity with CREST/NCSC CIR standards.

Responsibilities

• Lead major cyber incidents end to end as incident commander, from triage to eradication and recovery.
• Mobilise and direct responders across time zones, coordinating technical, legal, communications and remediation workstreams.
• Run counsel‑instructed work through recover, investigate and litigate phases with evidential rigor.
• Lead the technical narrative in the room with board and GC/PE deal teams, enabling clear decision making.
• Collaborate with Forensic Technology, eDiscovery and Forensic Valuation teams on evidence preservation and readiness for testimony.
• Set incident playbooks, surge model, tooling and remediation approach for EMEA regulatory and operational needs.
• Mentor responders as the team grows and build relationships with partner firms.

Skills

DFIR expertise

Incident leadership

Ransomware experience

Evidence in proceedings

Board communication

Evidential standards

Surge team leadership

Travel willingness

Breach counsel relationships

Certifications

Job description

Description

About Alvarez & Marsal

Alvarez & Marsal (A&M) is a global consulting firm with over 10,000 entrepreneurial, action and results-oriented professionals in over 40 countries. We take a hands‑on approach to solving our clients' problems and assisting them in reaching their potential. Our culture celebrates independent thinkers and doers who positively impact our clients and shape our industry. The collaborative environment and engaging work—guided by A&M's core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity—are why our people love working at A&M.

The Team

A&M is investing in a new phase of growth for its EMEA cyber practice, building a cyber response capability inside its EMEA Disputes & Investigations practice. We cover the full incident lifecycle as one integrated team, from the server room to the witness box: incident response, recovery, investigation and litigation with remediation alongside. The practice leadership, counsel relationships and board-facing layer are in place.

We are now looking for a lead responder who will run major incidents end to end from London and shape how this capability operates across EMEA. This is a hands‑on incident leadership role, not a practice management role. You will join at the start of the build, working with a small core team and drawing on A&M's global cyber teams and trusted specialist partners as each incident requires. You will work with a senior A&M lead who engages with the board, general counsel or PE deal team, and alongside Forensic Technology, eDiscovery and Forensic Valuation colleagues who are already instructed by counsel and giving expert evidence.

For the right person this is a rare opportunity: to shape a capability from the start rather than inherit it; a senior operator track that does not require managing a team to progress; a path to giving expert evidence in your own name, alongside colleagues who already do; and a role in the practice’s published work as it establishes itself as a leading voice in incident response.

How you will contribute:

• Lead major cyber incidents end to end as incident commander, from triage and containment through to eradication, restoration, recovery and post-incident review.
• Mobilise and direct responders across time zones, drawing on A&M's global cyber teams and specialist partners, and coordinate the technical, legal, communications and remediation workstreams.
• Run counsel‑instructed work through the recover, investigate and litigate phases, working to an evidential standard from the first hour so that it stands up to regulatory or judicial scrutiny.
• Lead the technical narrative in the room alongside the senior A&M leaders who advise boards, general counsel and PE deal teams, and give them the decisions they need to take.
• Work with our Forensic Technology, eDiscovery and Forensic Valuation teams on evidence preservation, privileged workflows and readiness for expert testimony.
• Set the practice’s incident playbooks, surge model, tooling and remediation approach, suited to EMEA regulatory and operational requirements.
• Mentor responders as the team grows, and build relationships with specialist partners.

What you will bring:

This role needs two things that rarely come together: deep hands‑on incident expertise, and the ability to be trusted by a board, a general counsel or a sponsor in the worst week of their year. We are looking for both.

• A DFIR background.
• Hands‑on experience leading major incidents end to end, including ransomware, where you personally made the containment, eradication, restoration and recovery decisions.
• Experience working with specialists on ransomware negotiations, including sound judgement on when not to negotiate. Time on the client side of a negotiation is a plus.
• Forensic or incident reports you have written that have been tested in proceedings or by a regulator, and an example of how that experience changed the way you report.
• Confidence with CEOs, general counsel and boards. You do not need to own the relationship, but you do need to be trusted within it, and to communicate clearly under pressure.
• A habit of working to evidential standards from the first hour, because actions taken during an incident may later be examined in court.
• Experience leading distributed surge teams, and willingness to travel across EMEA.
• Willingness to respond out of hours when a live incident requires it.
• Established relationships with breach counsel and law firms who instruct you, and experience with regulated clients or sponsor‑owned businesses, are a strong plus.
• Relevant certifications (for example GCFA, GCIH or GREM) or equivalent experience, and familiarity with CREST or NCSC CIR incident response standards, are a plus.

Your journey at A&M

We recognize that our people are the driving force behind our success, which is why we prioritize an employee experience that fosters each person’s unique professional and personal development. Our robust performance development process promotes continuous learning, rewards your contributions, and fosters a culture of meritocracy. With top‑notch training and on‑the‑job learning opportunities, you can acquire new skills and advance your career.

We prioritize your well-being, providing benefits and resources to support you on your personal journey. Our people consistently highlight the growth opportunities, our unique, entrepreneurial culture, and the fun we have together as their favorite aspects of working at A&M. The possibilities are endless for high‑performing and passionate professionals.