Disputes & Investigations - Senior Director, Incident Response Lead

Alvarez & Marsal (A&M) is a global consulting firm with over 10,000 entrepreneurial, action and results-oriented professionals in over 40 countries. We take a hands-on approach to solving our clients' problems and assisting them in reaching their potential. Our culture celebrates independent thinkers and doers who positively impact our clients and shape our industry. The collaborative environment and engaging work-guided by A&M's core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity-are why our people love working at A&M.

A&M is investing in a new phase of growth for its EMEA cyber practice, building a cyber response capability inside its EMEA Disputes & Investigations practice. We cover the full incident lifecycle as one integrated team, from the server room to the witness box: incident response, recovery, investigation and litigation with remediation alongside. The practice leadership, counsel relationships and board-facing layer are in place.

We are now looking for a lead responder who will run major incidents end to end from London and shape how this capability operates across EMEA. This is a hands-on incident leadership role, not a practice management role. You will join at the start of the build, working with a small core team and drawing on A&M's global cyber teams and trusted specialist partners as each incident requires.

You will work with a senior A&M lead who engages with the board, general counsel or PE deal team, and alongside Forensic Technology, eDiscovery and Forensic Valuation colleagues who are already instructed by counsel and giving expert evidence.

For the right person this is a rare opportunity: to shape a capability from the start rather than inherit it; a senior operator track that does not require managing a team to progress; a path to giving expert evidence in your own name, alongside colleagues who already do; and a role in the practice's published work as it establishes itself as a leading voice in incident response.

• Lead major cyber incidents end to end as incident commander, from triage and containment through to eradication, restoration, recovery and post-incident review.
• Mobilise and direct responders across time zones, drawing on A&M's global cyber teams and specialist partners, and coordinate the technical, legal, communications and remediation work streams.
• Run counsel-instructed work through the recover, investigate and litigate phases, working to an evidential standard from the first hour so that it stands up to regulatory or judicial scrutiny.
• Lead the technical narrative in the room alongside the senior A&M leaders who advise boards, general counsel and PE deal teams, and give them the decisions they need to take.
• Work with our Forensic Technology, eDiscovery and Forensic Valuation teams on evidence preservation, privileged workflows and readiness for expert testimony.
• Set the practice's incident playbooks, surge model, tooling and remediation approach, suited to EMEA regulatory and operational requirements.
• Mentor responders as the team grows, and build relationships with specialist partners.

This role needs two things that rarely come together: deep hands-on incident expertise, and the ability to be trusted by a board, a general counsel or a sponsor in the worst week of their year. We are looking for both.

• A DFIR background.
• Hands-on experience leading major incidents end to end, including ransomware, where you personally made the containment, eradication, restoration and recovery decisions.
• Experience working with specialists on ransomware negotiations, including sound judgement on when not to negotiate. Time on the client side of…