Senior Cloud Incident Response & Forensics Leader

Booz Allen Hamilton; McLean (VA); On-site; USD 113,000 - 257,000; Full time

Benefits offered by this job

Health insurance

Life insurance

Disability insurance

Retirement benefits

Paid leave

Professional development

Tuition assistance

Work-life programs

Dependent care

Recognition awards

Job summary

Booz Allen Hamilton seeks a Cloud Cyber Incident Response Manager to lead the cloud DFIR leadership team, directing strategic incident response across cloud environments and ensuring investigations are conducted in alignment with client, regulatory, and business requirements. You will oversee complex digital forensic investigations, manage senior personnel, and engage with executives, legal counsel, insurers, and regulators to drive client success and practice growth.

This role requires U.S.

Qualifications

• 7+ years of experience in digital forensics, incident response, cybersecurity investigations, or cyber risk.
• 3+ years of experience leading incident response teams, forensic investigation teams, or cybersecurity functions.
• Experience managing multiple teams, senior technical personnel, or a geographically distributed workforce, and leading complex cybersecurity incidents involving executive, legal, insurance, or regulatory stakeholders.
• Experience serving as a senior advisor during significant cyber incidents such as ransomware, data breach, or business email compromise.
• Experience with employee development, career management, performance management, and disciplinary actions.
• Experience developing and maintaining client relationships within the cyber insurance, legal, incident response, or cybersecurity markets, and investigating incidents in cloud platforms, including AWS, Azure, or GCP.
• Knowledge of digital forensic methodologies, evidence preservation, chain of custody, investigative documentation, and defensible reporting.
• Ability to develop scripts and utilize log and data analysis platforms, including Elastic, Splunk, or AWS Athena
• Ability to identify new opportunities, expand client relationships, contribute to business growth, and communicate technical findings and business risks to executives, boards, legal counsel, insurers, and senior stakeholders
• Bachelor's degree in Cybersecurity, CS, Business Administration, or Digital Forensics

Responsibilities

• Provide strategic direction and leadership for DFIR teams across cloud environments.
• Oversee complex digital forensic investigations and incident response engagements.
• Serve as senior advisor during high-severity incidents and communicate with client executives, legal counsel, cyber insurance carriers, regulators, and other stakeholders.
• Lead and develop team leads and senior personnel, including career management, employee development, performance management, and disciplinary actions.
• Promote a culture of accountability, collaboration, technical excellence, and strong client service.
• Maintain relationships with breach counsel, law firms, and corporate clients.
• Support new business opportunities, help expand relationships, and contribute to DFIR practice growth.
• Establish and maintain DFIR policies, standards, procedures, investigative methodologies, and documentation requirements.
• Provide senior-level oversight for high-severity cybersecurity incidents and complex forensic investigations.
• Review significant findings, executive briefings, timelines, and client deliverables.
• Communicate findings, risks, and recommendations to executives, legal, and non-technical audiences.
• Collaborate with legal, HR, privacy, compliance, and risk teams during sensitive investigations.
• Ensure investigations comply with legal, privacy, contractual, and regulatory requirements.
• Identify opportunities to improve investigative processes, automation, service offerings, and technical capabilities.
• Represent the organization at client meetings, industry events, and market-facing activities.

Skills

Digital forensics

Incident response

Cyber investigations

Cyber risk

Leadership

Client relations

Cloud platforms

AWS

Azure

GCP

Scripting

Elastic

Splunk

AWS Athena

Career management

Disciplinary actions

Education

Bachelor's degree in Cybersecurity, CS, Business Administration, or Digital Forensics

Tools

Elastic

Splunk

AWS Athena

Job description

Booz Allen Hamilton seeks a Cloud Cyber Incident Response Manager to lead the cloud DFIR leadership team, directing strategic incident response across cloud environments and ensuring investigations are conducted in alignment with client, regulatory, and business requirements. You will oversee complex digital forensic investigations, manage senior personnel, and engage with executives, legal counsel, insurers, and regulators to drive client success and practice growth.

This role requires U.S.