Senior Consultant - Cyber Resilience

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD. 

We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived. 

We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD. 

AHEAD is seeking a Senior Consultant to help clients anticipate, withstand, recover from, and evolve beyond cyber incidents. This role will lead advisory and delivery work focused on incident recovery, cyber disaster recovery, response and recovery maturation, and post-incident resilience improvement. 

The successful candidate will help organizations translate lessons from incidents, exercises, and threat exposure into practical improvements to recovery strategies, operating models, playbooks, architectures, governance, and testing programs. The role will also connect recovery planning to anticipation capabilities through purple-team-style validation: using realistic attack paths, threat hunting, exposure reconnaissance, and assume-breach scenarios to test whether exposure reduction, detection, response, and recovery controls work together. 

This is a client-facing consulting role requiring strong technical judgment, executive communication, and the ability to move from strategy to implementation. The consultant should be comfortable working across security, infrastructure, cloud, applications, business continuity, risk, and crisis-management stakeholders. 

\n

Responsibilities

• Assess and mature incident response, cyber resilience, and threat intelligence capabilities. 

• Design or improve recovery operating models based on threat hunting scenarios, roles and responsibilities, escalation paths, and decision rights. 

• Develop and refine cyber recovery plans, recovery runbooks, crisis playbooks, and communications procedures. 

• Facilitate post-incident reviews, after-action reviews, and lessons-learned sessions that produce measurable improvements. 

• Create and conduct tabletop exercises, cyber recovery simulations, and technical recovery exercises. 

• Evaluate recovery dependencies across identity, networking, endpoints, applications, data, cloud platforms, backup infrastructure, and third parties. 

• Assess backup and restore strategies, including isolation, immutability, recoverability, privileged-access controls, and validation testing. 

• Help clients define critical attack paths, pertinent threat intelligence sources, and conduct exposure reconnaissance. 

• Create practical roadmaps to mature anticipation and recovery capabilities over time based on proven organizational threats. 

• Support implementation of prioritized improvements, coordinating with client technical teams and delivery partners. 

• Lead purple-team-style validation of cyber recovery readiness by translating realistic attack paths into scenarios that test prevention, detection, containment, response, and recovery. 

• Partner with offensive-security and defensive-security stakeholders to validate whether controls, telemetry, escalation paths, and recovery procedures work together. 

• Use threat intelligence, exposure findings, attack-path analysis, and detection gaps to prioritize resilience improvements. 

• Facilitate assume-breach exercises and adversary-emulation-informed tabletop exercises that produce actionable recovery requirements. 

• Use threat scenarios, exposure findings, and detection gaps to improve recovery readiness. 

• Identify control, telemetry, and detection improvements that would reduce time to contain, investigate, and recover. 

• Help clients connect vulnerability, exposure, detection, and recovery data into a risk-informed resilience program. 

• Contribute to assessments of compromise assumptions, blast radius, and recovery sequencing. 

• Provide feedback to upstream security capabilities based on incident and exercise findings. 

Consulting and practice responsibilities 

• Lead workshops with technical, operational, risk, and executive stakeholders. 

• Produce clear deliverables, including assessment reports, target-state designs, roadmaps, playbooks, exercise materials, and executive briefings. 

• Serve as a trusted advisor to clients during high-consequence resilience and recovery initiatives. 

• Contribute reusable methods, accelerators, reference architectures, and points of view to AHEAD’s cyber resilience practice. 

• Mentor consultants and collaborate with account, delivery, and technical leadership. 

• Support proposal development, scoping, estimation, and solution shaping for relevant engagements. 

Required Qualifications

• Significant experience in cybersecurity consulting, incident response, cyber recovery, disaster recovery, business continuity, or a closely related discipline. 

• Demonstrated experience designing, assessing, testing, or improving incident response and recovery capabilities. 

• Strong understanding of enterprise infrastructure and security environments, including identity, endpoints, networks, cloud, applications, data, backups, and third-party dependencies. 

• Ability to distinguish and integrate cyber recovery, IT disaster recovery, business continuity, and crisis management practices. 

• Experience facilitating tabletop exercises, simulations, post-incident reviews, or recovery testing. 

• Ability to communicate complex technical risks and recovery decisions to both practitioners and executives. 

• Strong consulting skills, including workshop facilitation, structured problem solving, written communication, and stakeholder management. 

• Willingness to travel for client engagements as required. 

Preferred Qualifications

• Experience with ransomware recovery, destructive attacks, identity compromise, cloud recovery, or major cyber incident response. 

• Experience developing recovery architectures, clean-room or isolated recovery environments, cyber vaults, immutable backups, or recovery validation programs. 

• Experience with security operations, detection engineering, threat hunting, threat intelligence, attack-path analysis, or exposure management. 

• Familiarity with NIST CSF, NIST SP 800-61, NIST SP 800-34, CISA guidance, ISO 22301, ISO 27001, or comparable frameworks. 

• Relevant certifications such as CISSP, CISM, CBCP, CRISC, GCIH, GCIA, GCFA, or equivalent experience. 

• Experience operating in regulated, complex, or highly available environments. 

• Experience building offerings, methodologies, or delivery practices in a consulting organization. 

\n$160,000 - $200,000 a year\n

The compensation range indicated in this posting reflects the On-Target Earnings (“OTE”) for this role, which includes a base salary and any applicable target bonus amount. This OTE range may vary based on the candidate’s relevant experience, qualifications, and geographic location.  

Why AHEAD:

Through our daily work and internal groups like Moving Women AHEAD and RISE AHEAD, we value and benefit from diversity of people, ideas, experience, and everything in between.

We fuel growth by stacking our office with top-notch technologies in a multi-million-dollar lab, by encouraging cross department training and development, sponsoring certifications and credentials for continued learning.

USA Employment Benefits include: 

- Medical, Dental, and Vision Insurance 

- 401(k) 

- Paid company holidays 

- Paid time off 

- Paid parental and caregiver leave 

- Plus more! See benefits https://www.aheadbenefits.com/ for additional details. 

Use of AI:

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, assessing responses, or to capture recordings and create transcriptions or summaries during interviews. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans.

If you would like more information about how your data is processed, please refer to the Candidate Privacy Notice or contact us at [email protected]. 

You may opt-out of the review or analysis of your application and resume by AI tools by using the General Application. Please include the role you wish to apply for in the Additional Information field. You may also choose to opt-out of recording and transcription at any time, including after joining an interview.  Candidates will not be penalized for choosing to opt-out.