Advisory - Consulting, Cyber Response | Off-Cycle Internship (Jan 2027 to Jun 2027)

Role Overview

Technology underpins many of the most influential organisations in the world and presents opportunities for businesses that want to seek out new markets and invest in transformational change. However, rapid technological emergence, greater connectivity, and a 24/7 approach to global commerce have also increased exposure to cyber and information risks.

KPMG Cybersecurity professionals assist clients in addressing their concerns around confidentiality, integrity, availability, and privacy of technology, business systems, and information assets. Using a holistic view of how technology and business integrate, the Cyber team performs technology-risk focused assessments, technology compliance, IT/operational process reviews, and supports the design of information risk and cyber security solutions.

Cyber Response Responsibilities

KPMG Cyber Response professionals work at the forefront of major cyber-attacks, supporting clients as “first responders” to cyber security incidents and major cyber emergencies. Cyber Response helps clients who have experienced a cyber security incident or suspect an ongoing attack, such as ransomware, business email compromise, data breaches, cloud security incidents, unauthorised access to IT resources, or other network intrusions. The team investigates the root cause and extent of the breach, including data exfiltration, compromised accounts, impacted hosts and servers, active threats, and malicious files in the environment.

Cyber Response also supports containment and remediation for effective and timely recovery, helps expel intruders from networks, and provides practical recommendations to prevent further incidents.

KPMG Cyber Response also supports non-emergency engagements involving compromise assessment (CA) and threat hunting (TH), helping detect threats or possible compromise early—before major business operations are disrupted. To strengthen incident response (IR) capabilities and security posture, KPMG also supports table-top exercises (TTX), IR training, playbook development, and incident response plan reviews.

Key Responsibilities

• Work closely with KPMG cyber security subject matter experts to design, implement, test, and support solutions for KPMG’s clients.
• Collaborate with KPMG engagement managers to support log analysis, review endpoint data to identify anomalies, indicators of compromise (IOCs), malicious files, and threat actors to determine root cause and incident impact.
• Support containment and eradication efforts.
• Assist with documenting findings and contribute to IR update calls.
• Collaborate with other cyber teams to deliver end-to-end incident response and recovery, which may include supporting delivery of Cyber OT/IoT security services such as risk assessment, VAPT, OT cybersecurity audits, and cybersecurity maturity assessments.
• Work with senior team members to help prepare playbooks, TTX materials, and business proposals.

Qualifications

• Degree in Cybersecurity / Information Security; or
• Degree in Engineering with relevant skills/experience/aptitude to develop in the field of cybersecurity; or
• Degree in Computer Science / IT with relevant skills/experience/aptitude to develop in the field of cybersecurity.

Technical Requirements

• Understand core cybersecurity principles, including threat vectors, vulnerabilities, and basic defence mechanisms.
• Awareness of standards and frameworks such as NIST, ISO 27001, and the SANS PICERL model.
• Familiarity with Windows artifacts and endpoint logs; familiarity with network device logs. Forensics triage experience is preferred but not mandatory.
• Familiarity with the incident response lifecycle and ability to support containment and recovery efforts.
• Ability to contribute to incident reports, playbooks, and TTX reports.
• Programming skills are preferred.
• Strong understanding of operating systems (Windows, Linux, Mac) and cloud environments (Azure, AWS, Google) is preferred.
• Entry-level certifications such as CompTIA Security+, CHFI, CEH, or mid-level GIAC certifications are desirable but not mandatory.

Soft Skills

• Strong problem-solving skills, including the ability to break down complex issues into smaller components.
• Ability to work both independently and as part of a larger team.
• Clear verbal and written communication skills, especially when documenting findings or interacting with clients and team members.
• Demonstrates integrity, accountability, and a client-focused mindset.
• Eagerness to learn and grow in the cybersecurity domain through continuous learning, interest in research in evolving technologies, and sharing knowledge across the team.