Senior Consultant - Cyber Resilience

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation. At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD. We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived. We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.

Responsibilities

• • Assess and mature incident response, cyber resilience, and threat intelligence capabilities.

  • Design or improve recovery operating models based on threat hunting scenarios, roles and responsibilities, escalation paths, and decision rights.

  • Develop and refine cyber recovery plans, recovery runbooks, crisis playbooks, and communications procedures.

  • Facilitate post-incident reviews, after-action reviews, and lessons-learned sessions that produce measurable improvements.

  • Create and conduct tabletop exercises, cyber recovery simulations, and technical recovery exercises.

  • Evaluate recovery dependencies across identity, networking, endpoints, applications, data, cloud platforms, backup infrastructure, and third parties.

  • Assess backup and restore strategies, including isolation, immutability, recoverability, privileged-access controls, and validation testing.

  • Help clients define critical attack paths, pertinent threat intelligence sources, and conduct exposure reconnaissance.

  • Create practical roadmaps to mature anticipation and recovery capabilities over time based on proven organizational threats.

  • Support implementation of prioritized improvements, coordinating with client technical teams and delivery partners.

  • Lead purple-team-style validation of cyber recovery readiness by translating realistic attack paths into scenarios that test prevention, detection, containment, response, and recovery.

  • Partner with offensive-security and defensive-security stakeholders to validate whether controls, telemetry, escalation paths, and recovery procedures work together.

  • Use threat intelligence, exposure findings, attack-path analysis, and detection gaps to prioritize resilience improvements.

  • Facilitate assume-breach exercises and adversary-emulation-informed tabletop exercises that produce actionable recovery requirements.

  • Use threat scenarios, exposure findings, and detection gaps to improve recovery readiness.

  • Identify control, telemetry, and detection improvements that would reduce time to contain, investigate, and recover.

  • Help clients connect vulnerability, exposure, detection, and recovery data into a risk-informed resilience program.

  • Contribute to assessments of compromise assumptions, blast radius, and recovery sequencing.

  • Provide feedback to upstream security capabilities based on incident and exercise findings.

  Consulting and practice responsibilities

  • Lead workshops with technical, operational, risk, and executive stakeholders.

  • Produce clear deliverables, including assessment reports, target-state designs, roadmaps, playbooks, exercise materials, and executive briefings.

  • Serve as a trusted advisor to clients during high-consequence resilience and recovery initiatives.

  • Contribute reusable methods, accelerators, reference architectures, and points of view to AHEAD’s cyber resilience practice.

  • Mentor consultants and collaborate with account, delivery, and technical leadership.

  • Support proposal development, scoping, estimation, and solution shaping for relevant engagements.

Required Qualifications

• • Significant experience in cybersecurity consulting, incident response, cyber recovery, disaster recovery, business continuity, or a closely related discipline.

  • Demonstrated experience designing, assessing, testing, or improving incident response and recovery capabilities.

  • Strong understanding of enterprise infrastructure and security environments, including identity, endpoints, networks, cloud, applications, data, backups, and third-party dependencies.

  • Ability to distinguish and integrate cyber recovery, IT disaster recovery, business continuity, and crisis management practices.

  • Experience facilitating tabletop exercises, simulations, post-incident reviews, or recovery testing.

  • Ability to communicate complex technical risks and recovery decisions to both practitioners and executives.

  • Strong consulting skills, including workshop facilitation, structured problem solving, written communication, and stakeholder management.

  • Willingness to travel for client engagements as required.

Preferred Qualifications

• • Experience with ransomware recovery, destructive attacks, identity compromise, cloud recovery, or major cyber incident response.

  • Experience developing recovery architectures, clean-room or isolated recovery environments, cyber vaults, immutable backups, or recovery validation programs.

  • Experience with security operations, detection engineering, threat hunting, threat intelligence, attack-path analysis, or exposure management.

  • Familiarity with NIST CSF, NIST SP 800-61, NIST SP 800-34, CISA guidance, ISO 22301, ISO 27001, or comparable frameworks.

  • Relevant certifications such as CISSP, CISM, CBCP, CRISC, GCIH, GCIA, GCFA, or equivalent experience.