Jobs at Kroll

Leads client-facing Identity Governance and Administration engagements from strategy through implementation. Architects SailPoint and Saviynt solutions covering identity lifecycle management, access certifications, RBAC, SoD, entitlement governance, provisioning, connectors, and compliance reporting. Advises executive stakeholders, leads delivery teams, manages engagement scope and quality, mentors IAM professionals, and supports business development. Integrates IGA with PAM and SSO/MFA technologies while developing governance roadmaps and target operating models.

Lead Kroll’s US Cyber Advisory practice by delivering cybersecurity strategy, risk, governance, resilience, regulatory, and AI advisory services. Advise executives and boards, lead complex engagements, oversee teams and deliverables, develop client relationships, support proposals and business development, shape service offerings, and mentor cybersecurity professionals.

Design, administer, and optimize a cyber threat intelligence platform. Build Python automation, ETL pipelines, APIs, and integrations that collect, enrich, normalize, correlate, and distribute intelligence from commercial, open-source, government, dark web, and internal sources. Apply STIX/TAXII and MITRE ATT&CK to track indicators, actors, malware, vulnerabilities, and campaigns. Develop dashboards and AI-assisted capabilities while ensuring data quality, governance, and security across intelligence repositories.

Supports financial investigations, litigation support, forensic accounting, compliance assessments, fraud risk evaluations, asset tracing, and internal investigations. Conducts interviews, analyzes financial records, tests internal controls, prepares client reports and presentations, performs quality control, and manages project priorities. The role also provides oversight to junior staff, supports client relationships and business development, and collaborates with investigative teams across Kroll’s offices.

Supports cyber defense and incident response assignments, including forensic investigations, breach remediation, case management, client communication, resource and budget coordination, quality assurance, and delivery of commercially viable advice. Mentors junior staff, manages concurrent projects, develops client relationships, meets performance objectives, and may travel frequently across regions and industries.

Conduct cyber defense and incident response assignments, including forensic investigations and breach remediation. Support case managers with project structure, resource and budget management, findings presentation, client communication, quality control, and commercially viable advice. Manage complex concurrent cases, mentor junior staff, build client relationships, and coordinate teams across global offices. Frequent travel may be required.

Leads Kroll’s global Cyber Due Diligence practice across private equity, M&A, and investment clients. Responsibilities include setting strategy, overseeing engagement quality, managing delivery resources, developing methodologies, supporting business development, expanding client relationships, and presenting executive-level cyber risk recommendations. The role also drives adjacent cyber advisory, resilience, transformation, AI governance, managed services, portfolio monitoring, and value creation opportunities while mentoring practitioners and advising senior stakeholders.

Lead end-to-end development of a benchmarking capability for Kroll's KREV platform: define methodology, product roadmap, data ingestion/normalization, integration with KREV, run quarterly production cycles, coordinate engineering and stakeholders, drive pilot and GA launches, and monitor coverage, adoption, and data quality risks.

Lead delivery and scaling of CrowdStrike MDR and Next‑Gen SIEM (LogScale) services. Define SOPs, playbooks, and automation; manage and mentor detection engineers; develop detection logic, baseline configurations, deployment templates, and automation (Terraform/Ansible/PowerShell/Python). Interface with client executives, track SLAs/metrics, and collaborate on alliance and go‑to‑market initiatives to mature clients' detection and response capabilities.

Lead and grow Kroll's CrowdStrike Falcon Cloud Security deployment practice: deploy, configure, integrate, tune CNAPP across AWS/Azure/GCP, build detections and SOAR playbooks, validate coverage, mentor consultants, and hand off runbooks to operations.

Lead the CrowdStrike Identity Security consulting practice at Kroll by assessing, architecting, implementing identity solutions, mentoring consultants, and advising clients on identity strategy.

Lead and manage complex financial investigations, forensic accounting, and regulatory compliance engagements. Oversee case teams, conduct investigative interviews and internal control testing, write client-facing reports, manage client relationships, and drive business development while ensuring high standards of case delivery and team development.