Director Resource Planning & Capacity

Director, Resource Planning & Capacity

Reports to: FVP of Program Management
Practices covered: DFIR, Post-Breach Remediation (PBR), Offensive Security (OffSec), Cyber Threat Intelligence (CTI)
Scope: Billable consulting workforce across multiple regions and time zones
Level: Director, Program Management leadership team
Location: Hybrid, Dallas, TX (on-site)

About Us and Why This Role Exists

We are a cyber incident response and recovery firm. When a client is breached, we investigate, contain, and get them back to business, and we increasingly help them get ahead of the next attack through offensive testing and threat intelligence.

Our people are our delivery capacity. How we plan, deploy, and develop them is the core of our operating model.

Our demand is mostly reactive. Incidents arrive without warning, peak without notice, and need the right skills within hours. We are creating this role to give us one owner for matching our people to that demand: forecasting it, staffing it, and building the capacity and skills we will need next.

Role Purpose

The Director, Resource Planning & Capacity makes sure the right expert is on the right engagement at the right time, at a sustainable pace. You will own capacity planning, scheduling, utilization, and skills coverage across all four practices, and turn that data into hiring, cross-training, and staffing decisions our leadership can act on.

Key Responsibilities

Capacity and demand planning

• Build and run a rolling 30/90/180-day capacity forecast by practice, region, role level, and skill, drawing on pipeline, incident trends, and channel partner volumes.
• Model surge scenarios for the reactive practices and maintain a clear view of bench strength at all times.
• Prepare the workforce cases for the resource and investment committee: headcount requests, timing, and the utilization and revenue case behind each one.

Scheduling and deployment

• Lead the staffing process from engagement intake to release, working with the PMO and practice leads to assign people within hours of an incident landing.
• Design and run fair on-call and surge rotations for DFIR and PBR, and staff planned OffSec and CTI work around them.
• Shape how delivery teams are organized, including standing pods that pair DFIR investigators with PBR engineers.

Utilization, realization, and time data

• Set and track utilization targets by level, and report utilization and realization weekly to practice and executive leadership.
• Own the integrity of time and resource data in the PSA platform, including timekeeping discipline and estimate-versus-actual accuracy.
• Identify where hours leak, such as under-billed engagements, inconsistent estimates, or overloaded individuals, and drive the fix with the owners.

Skills and capability

• Maintain the skills inventory and taxonomy, including certifications, tooling, and languages, with strict care for employee privacy.
• Close skill gaps against forecast demand through hiring, certification plans, and cross-training, such as moving remediation consultants into incident response.
• Partner with practice leaders on career paths so staffing decisions also develop our people.

People sustainability

• Monitor workload, on-call load, and burnout signals, and act before they become attrition.
• Partner with HR and Talent Acquisition on hiring plans, onboarding ramp, and retention risk in high-demand roles.

Systems, process, and reporting

• Direct workforce management tooling and its integrations with the PSA, CRM, and HR systems.
• Publish a single source of truth for headcount, capacity, and utilization, and present it monthly to the executive team.

Scope by Practice

Each practice has a different demand pattern, so each needs a different staffing model.

Digital Forensics & Incident Response (DFIR)

• Demand: Unplanned, urgent, 24/7; spikes with major campaigns.
• What we need from you: Surge playbooks, on-call rotations, hours-to-staff targets, and burnout watch on front-line responders.

Post-Breach Remediation (PBR)

• Demand: Follows DFIR; large, multi-week recovery and rebuild work.
• What we need from you: Forecast PBR from the DFIR pipeline, staff multi-week projects, and cross-skill PBR consultants into DFIR.

Offensive Security (OffSec)

• Demand: Scheduled; penetration tests and red team work booked weeks ahead.
• What we need from you: Calendar-based scheduling, protecting planned work when incidents surge, and specialist skill coverage.

Cyber Threat Intelligence (CTI)

• Demand: Mix of retained subscriptions and incident support.
• What we need from you: Steady-state allocation plus fast pull-in to live incidents, and analyst skills and language coverage.

How We Will Measure Success

Targets are set in the first 90 days.

• Billable utilization by level and practice (Consultant target 70%+)
• Realization: billed vs. estimated hours
• Time to staff a new incident
• Forecast accuracy at 30 and 90 days
• Regretted attrition and on-call load
• Skills coverage vs. forecast demand
• Timekeeping compliance

Qualifications

Required

• 10+ years in resource management, workforce planning, or delivery operations, with 5+ years leading a function, ideally in professional services or consulting.
• Hands-on experience running utilization, capacity, and staffing for a billable workforce of 150+ people.
• After-hours and weekend support for urgent staffing needs during critical incidents expected
• Strong working knowledge of PSA or resource management tools (such as Kantata, Certinia, or similar) and their links to CRM and HR systems. Experience in Scoro a plus.
• Advanced data skills: Excel modelling and a BI tool such as Power BI or Tableau.
• Working understanding of cybersecurity services and how incident response, recovery, offensive testing, and threat intelligence work is delivered.
• Clear, direct communication with practice leaders, executives, and committees.

Preferred

• Workforce management in a 24/7 or surge-driven environment, such as incident response, MSSP/MDR, or emergency services.
• Experience staffing across multiple countries and time zones.
• Experience building skills inventories while protecting employee privacy, including GDPR.
• Experience running an on-call program and reducing burnout.

Key skills

• Capacity planning and forecasting (expert)
• Resource scheduling and deployment (expert)
• Workforce analytics and reporting (advanced)
• PSA and resource tooling (advanced)
• Cybersecurity services delivery (intermediate; CompTIA Security+ or similar a plus)

Project and portfolio management (intermediate; P