Director Resource Planning & Capacity

Director, Resource Planning & Capacity Reports to: FVP of Program Management Practices covered: DFIR, Post-Breach Remediation (PBR), Offensive Security (OffSec), Cyber Threat Intelligence (CTI) Scope: Billable consulting workforce across multiple regions and time zones Level: Director, Program Management leadership team Location: Hybrid, Dallas, TX (on-site) About Us and Why This Role Exists We are a cyber incident response and recovery firm. When a client is breached, we investigate, contain, and get them back to business, and we increasingly help them get ahead of the next attack through offensive testing and threat intelligence. Our people are our delivery capacity. How we plan, deploy, and develop them is the core of our operating model. Our demand is mostly reactive. Incidents arrive without warning, peak without notice, and need the right skills within hours. We are creating this role to give us one owner for matching our people to that demand: forecasting it, staffing it, and building the capacity and skills we will need next. Role Purpose The Director, Resource Planning & Capacity makes sure the right expert is on the right engagement at the right time, at a sustainable pace. You will own capacity planning, scheduling, utilization, and skills coverage across all four practices, and turn that data into hiring, cross-training, and staffing decisions our leadership can act on. Key Responsibilities Capacity and demand planning Build and run a rolling 30/90/180-day capacity forecast by practice, region, role level, and skill, drawing on pipeline, incident trends, and channel partner volumes. Model surge scenarios for the reactive practices and maintain a clear view of bench strength at all times. Prepare the workforce cases for the resource and investment committee: headcount requests, timing, and the utilization and revenue case behind each one. Scheduling and deployment Lead the staffing process from engagement intake to release, working with the PMO and practice leads to assign people within hours of an incident landing. Design and run fair on-call and surge rotations for DFIR and PBR, and staff planned OffSec and CTI work around them. Shape how delivery teams are organized, including standing pods that pair DFIR investigators with PBR engineers. Utilization, realization, and time data Set and track utilization targets by level, and report utilization and realization weekly to practice and executive leadership. Own the integrity of time and resource data in the PSA platform, including timekeeping discipline and estimate-versus-actual accuracy. Identify where hours leak, such as under-billed engagements, inconsistent estimates, or overloaded individuals, and drive the fix with the owners. Skills and capability Maintain the skills inventory and taxonomy, including certifications, tooling, and languages, with strict care for employee privacy. Close skill gaps against forecast demand through hiring, certification plans, and cross-training, such as moving remediation consultants into incident response. Partner with practice leaders on career paths so staffing decisions also develop our people. People sustainability Monitor workload, on-call load, and burnout signals, and act before they become attrition. Partner with HR and Talent Acquisition on hiring plans, onboarding ramp, and retention risk in high-demand roles. Systems, process, and reporting Direct workforce management tooling and its integrations with the PSA, CRM, and HR systems. Publish a single source of truth for headcount, capacity, and utilization, and present it monthly to the executive team. Scope by Practice Each practice has a different demand pattern, so each needs a different staffing model. Digital Forensics & Incident Response (DFIR) Demand: Unplanned, urgent, 24/7; spikes with major campaigns. What we need from you: Surge playbooks, on-call rotations, hours-to-staff targets, and burnout watch on front-line responders. Post-Breach Remediation (PBR) Demand…

View the full posting and apply