Senior Consultant - Cyber Resilience

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

AtAHEAD, we prioritize creating a culture of belonging,where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.

We are an equal opportunity employer,anddo not discriminate based onan individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status,or any other protected characteristic under applicable law, whether actual or perceived.

We embrace all candidatesthatwillcontribute to the diversification and enrichment of ideas and perspectives atAHEAD.

AHEAD is seeking a Senior Consultant to help clients anticipate, withstand, recover from, and evolve beyond cyber incidents. This role willleadadvisory and delivery work focused on incident recovery, cyber disaster recovery, response and recovery maturation, and post-incident resilience improvement.

The successful candidate will help organizations translate lessons from incidents, exercises, andthreatexposure into practical improvements to recovery strategies, operating models, playbooks, architectures, governance, and testing programs. The role will also connect recovery planning toanticipationcapabilities through purple-team-style validation: using realistic attack paths, threat hunting, exposure reconnaissance,and assume-breach scenarios to test whether exposure reduction, detection, response, and recovery controls work together.

This is a client-facing consulting role requiring strong technical judgment, executive communication, and the ability to move from strategy to implementation. The consultant should be comfortable working across security, infrastructure, cloud, applications, business continuity, risk, and crisis-management stakeholders.

• Assess and mature incident response, cyberresilience, and threat intelligence capabilities.
• Design or improve recovery operating models based on threat hunting scenarios, roles and responsibilities, escalation paths, and decision rights.
• Develop and refine cyber recovery plans, recovery runbooks, crisis playbooks, and communications procedures.
• Facilitate post-incident reviews, after-action reviews, and lessons-learned sessions that produce measurable improvements.
• Create and conduct tabletop exercises, cyber recovery simulations, and technical recovery exercises.
• Evaluate recovery dependencies across identity, networking, endpoints, applications, data, cloud platforms, backup infrastructure, and third parties.
• Assess backup and restore strategies, including isolation, immutability, recoverability, privileged-access controls, and validation testing.
• Help clients define critical attack paths, pertinent threat intelligence sources, and conduct exposure reconnaissance.
• Create practical roadmaps to mature anticipation and recovery capabilities over time based on proven organizational threats.
• Support implementation of prioritized improvements, coordinating with client technical teams and delivery partners.
• Lead purple-team-style validation of cyber recovery readiness by translating realistic attack paths into scenarios that test prevention, detection, containment, response, and recovery.
• Partner with offensive-security and defensive-security stakeholders to validate whether controls, telemetry, escalation paths, and recovery procedures work together.
• Use threat intelligence, exposure findings, attack-path analysis, and detection gaps to prioritize resilience improvements.
• Facilitate assume-breach exercises and adversary-emulation-informed tabletop exercises that produce actionable recovery requirements.
• Use threat scenarios, exposure findings, and detection gaps to improve recovery readiness.
• Identify control, telemetry, and detection improvements that would reduce time to contain, investigate, and recover.
• Help clients connect vulnerability, exposure, detection, and recovery data into a risk-informed resilience program.
• Contribute to assessments of compromise assumptions, blast radius, and recovery sequencing.
• Provide feedback to upstream security capabilities based on incident and exercise findings.

• Lead workshops with technical, operational, risk, and executive stakeholders.
• Produce clear deliverables, including assessment reports, target-state designs, roadmaps, playbooks, exercise materials, and executive briefings.
• Serve as a trusted advisor to clients during high-consequence resilience and recovery initiatives.
• Contribute reusable methods, accelerators, reference architectures, and points of view to AHEAD’s cyber resilience practice.
• Mentor consultants and collaborate with account, delivery, and technical leadership.
• Support proposal development, scoping, estimation, and solution…