Shanghai - Associate Director, Cyber Incident Response, Forensic - Advisory

Job description KPMG China provides multidisciplinary services from audit and tax to advisory, with a strong focus on serving our clients’ needs and their industries. Not only do we have an overriding commitment to provide the highest quality services for our clients, but we also strive to become a responsible corporate citizen that has a positive impact on our environment and community. At KPMG, you’ll translate insights into action and reveal opportunities for all—our teams, our clients and our world. KPMG Forensic leverages our vast industry experience and leading technologies to help clients handle fraud and misconduct investigations, address complex regulatory compliance issues, and provide dispute advisory support in financial disputes that are likely to lead to litigation, arbitration, expert determination or mediation. Our team have qualifications and experience in forensic accounting, big data analytics, technology, anti-money laundering/Sanctions compliance, law enforcement and research. We have dedicated Forensic Technology labs in Shanghai and Hong Kong and are equipped with capability and experience to analyze and host terabytes of data in local jurisdictions. We have leading hardware equipment and are keeping learning and strengthening our technique capacity to address rising market needs on big data analytics, computer forensics and cyber incident responses. We have worked with industry professionals in Asia Pacific, and worldwide through the KPMG International Forensic network of over 3,000 professionals to provide one-stop solution for complex projects across numerous jurisdictions. Key Responsibilities 1. Engagement Leadership & Technical Delivery • Lead and manage end-to-end cyber incident response engagements, including ransomware recovery, BEC investigations, network intrusions, insider threat cases and data breach notifications. • Serve as Engagement Manager and/or subject-matter expert (SME) on complex, multi-jurisdictional investigations across mainland China and Hong Kong. • Direct the technical workstreams of junior team members: digital forensics, log analysis, malware triage, threat actor attribution and network traffic analysis. • Oversee the preparation of clear, board-ready investigation reports, regulatory notifications and privileged memoranda for client legal counsel. • Manage engagement economics including scoping, budgeting, billing and risk management in accordance with KPMG quality and independence standards. • Provide hands-on technical support as required, including host-based forensics, memory analysis, EDR investigation and cloud-platform (AWS / Azure / GCP) log review. 2. Incident Readiness & Advisory • Lead cyber incident readiness assessments, tabletop exercises and war-gaming simulations for clients across financial services, healthcare, critical infrastructure and technology sectors. • Design and develop bespoke incident response plans (IRPs), playbooks and communication protocols. • Advise clients on integration of attorney-client privilege frameworks and cyber insurance mechanisms into their incident response program. • Provide regulatory advisory support in relation to mandatory breach reporting requirements under the PIPL, DSL, Cybersecurity Law, HKMA requirements and sector-specific regulations. 3. Business Development & Client Management • Build, maintain and expand senior-level (CISO, General Counsel, CFO) relationships with clients in financial services, state-owned enterprises, multinationals and technology companies. • Develop and execute go-to-market initiatives for Cyber Response services in Greater China, including thought-leadership publications, seminars and regulatory briefings. • Identify and qualify new business opportunities; lead the preparation of proposals, fee structures and pitch presentations. • Collaborate with KPMG's ASPAC Cyber network and global Cyber Response hubs to cross-sell and leverage global capabilities for China-outbound and inbound clients. • Maintain and develop relationships with cyber insurers, law firms, regulators and law enforcement agencies. 4. Team Development & Practice Building • Coach, mentor and develop Managers, Senior Consultants and Consultants within the Cyber Response team. • Contribute to the development of technical methodologies, tools (including KPMG Digital Responder) and knowledge assets. • Drive training enablement and professional development programs for the broader Forensic Services team. • Support recruitment efforts and participate in campus and lateral hiring initiatives. • Contribute to KPMG's global Cyber Response Centre of Excellence through knowledge-sharing and methodology development. Essential Requirements • Minimum 10 years of experience in cybersecurity, of which at least 6 years in a specialist cyber incident response / digital forensics advisory role within a professional services firm, law enforcement (cyber unit) or in-house CSIRT/SOC environment. • Demonstrated track record of leading complex, high-stakes cyber incident investigations independently and managing client-facing engagements. • Strong technical proficiency in at least three of the following areas: – Host-based and memory forensics (Windows, Linux, macOS) – Network forensics and packet analysis – Cloud platform (AWS / Azure / GCP / AliCloud) log investigation and incident response – Malware analysis and reverse engineering – Threat intelligence and threat actor profiling – EDR platforms (CrowdStrike, SentinelOne, Microsoft Defender) • Experience managing engagements with regulatory reporting obligations under PRC or Hong Kong data protection laws. • Proven ability to produce high-quality investigative reports and present findings to boards, legal counsel and regulatory bodies in English and Mandarin. • Demonstrated business development capability with an existing or developing client network in Greater China. • Professional-level proficiency in both written and spoken English and Mandarin Chinese; Cantonese is a plus. Preferred Qualifications • One or more of the following certifications: GCFE, GCFA, GCFR, GREM, GDAT, CISSP, CISM, EnCE, or equivalent. • Prior experience in a Big 4, top-tier consulting firm or specialist IR firm. • Experience with attorney-client privilege management and working alongside external legal counsel on litigation-driven investigations. • Familiarity with cyber insurance claims processes and interaction with insurers. • Working knowledge of ICS/OT environments and critical infrastructure security. • Experience developing and delivering cyber tabletop exercises and crisis simulation programs. About KPMG At KPMG China, we are committed to being an equal opportunity employer, with zero tolerance for any form of discrimination against any persons. It is important for us to create an inclusive, diverse and agile workplace for our people to develop and thrive at both a personal and professional level. We strive to make ESG (environmental, social and governance) a watermark running through our organisation; from empowering our people to become agents of positive change, to providing better solutions and services to our clients to help them achieve their ESG goals. View Our Impact Plan to learn more about our ESG commitments and progress across four key pillars - Governance, People, Planet and Prosperity – and how we make a positive impact on our people, environment and society. We encourage you to come as you are, and we welcome all qualified candidates to apply, and hope you unlock opportunities with us. Visit KPMG China website for more company information. You acknowledge and agree that all personal information hereby provided regarding yourself will be used by KPMG China for its candidate selection purposed only. KPMG China collects, uses, processes, and retains your personal information in accordance with KPMG China’s Online Privacy Statement and/or KPMG China Privacy Statement (collectively " Privacy Statement "). During the recruitment process, KPMG China may need to store personal information of candidates in a designated third-party application tracking platform. If you have any questions regarding the information you provided in the form or your job application in general, please contact KPMG China’s HR personnel in the location where your application is submitted [ see here ]. #LI-2