Director, Resource Planning & Capacity
Reports to: FVP of Program Management
Practices covered: DFIR, Post-Breach Remediation (PBR), Offensive Security (OffSec), Cyber Threat Intelligence (CTI)
Scope: Billable consulting workforce across multiple regions and time zones
Level: Director, Program Management leadership team
Location: Hybrid, Dallas, TX (on-site)
Role Purpose
The Director, Resource Planning & Capacity makes sure the right expert is on the right engagement at the right time, at a sustainable pace. You will own capacity planning, scheduling, utilization, and skills coverage across all four practices, and turn that data into hiring, cross-training, and staffing decisions our leadership can act on.
Key Responsibilities
Capacity and demand planning
- Build and run a rolling 30/90/180-day capacity forecast by practice, region, role level, and skill, drawing on pipeline, incident trends, and channel partner volumes.
- Model surge scenarios for the reactive practices and maintain a clear view of bench strength at all times.
- Prepare the workforce cases for the resource and investment committee: headcount requests, timing, and the utilization and revenue case behind each one.
Scheduling and deployment
- Lead the staffing process from engagement intake to release, working with the PMO and practice leads to assign people within hours of an incident landing.
- Design and run fair on-call and surge rotations for DFIR and PBR, and staff planned OffSec and CTI work around them.
- Shape how delivery teams are organized, including standing pods that pair DFIR investigators with PBR engineers.
Utilization, realization, and time data
- Set and track utilization targets by level, and report utilization and realization weekly to practice and executive leadership.
- Own the integrity of time and resource data in the PSA platform, including timekeeping discipline and estimate-versus-actual accuracy.
- Identify where hours leak, such as under-billed engagements, inconsistent estimates, or overloaded individuals, and drive the fix with the owners.
Skills and capability
- Maintain the skills inventory and taxonomy, including certifications, tooling, and languages, with strict care for employee privacy.
- Close skill gaps against forecast demand through hiring, certification plans, and cross-training, such as moving remediation consultants into incident response.
- Partner with practice leaders on career paths so staffing decisions also develop our people.
People sustainability
- Monitor workload, on-call load, and burnout signals, and act before they become attrition.
- Partner with HR and Talent Acquisition on hiring plans, onboarding ramp, and retention risk in high-demand roles.
Systems, process, and reporting
- Direct workforce management tooling and its integrations with the PSA, CRM, and HR systems.
- Publish a single source of truth for headcount, capacity, and utilization, and present it monthly to the executive team.
Scope by Practice
Each practice has a different demand pattern, so each needs a different staffing model.
Digital Forensics & Incident Response (DFIR)
- Demand: Unplanned, urgent, 24/7; spikes with major campaigns.
- What we need from you: Surge playbooks, on-call rotations, hours-to-staff targets, and burnout watch on front-line responders.
Post-Breach Remediation (PBR)
- Demand: Follows DFIR; large, multi-week recovery and rebuild work.
- What we need from you: Forecast PBR from the DFIR pipeline, staff multi-week projects, and cross-skill PBR consultants into DFIR.
Offensive Security (OffSec)
- Demand: Scheduled; penetration tests and red team work booked weeks ahead.
- What we need from you: Calendar-based scheduling, protecting planned work when incidents surge, and specialist skill coverage.
Cyber Threat Intelligence (CTI)
- Demand: Mix of retained subscriptions and incident support.
- What we need from you: Steady-state allocation plus fast pull-in to live incidents, and analyst skills and language coverage.
How We Will Measure Success
Targets are set in the first 90 days.
- Billable utilization by level and practice (Consultant target 70%+)
- Realization: billed vs. estimated hours
- Time to staff a new incident
- Forecast accuracy at 30 and 90 days
- Regretted attrition and on-call load
- Skills coverage vs. forecast demand
- Timekeeping compliance
Qualifications
Required
- 10+ years in resource management, workforce planning, or delivery operations, with 5+ years leading a function, ideally in professional services or consulting.
- Hands-on experience running utilization, capacity, and staffing for a billable workforce of 150+ people.
- After-hours and weekend support for urgent staffing needs during critical incidents expected
- Strong working knowledge of PSA or resource management tools (such as Kantata, Certinia, or similar) and their links to CRM and HR systems. Experience in Scoro a plus.
- Advanced data skills: Excel modelling and a BI tool such as Power BI or Tableau.
- Working understanding of cybersecurity services and how incident response, recovery, offensive testing, and threat intelligence work is delivered.
- Clear, direct communication with practice leaders, executives, and committees.
Preferred
- Workforce management in a 24/7 or surge-driven environment, such as incident response, MSSP/MDR, or emergency services.
- Experience staffing across multiple countries and time zones.
- Experience building skills inventories while protecting employee privacy, including GDPR.
- Experience running an on-call program and reducing burnout.
Key skills
- Capacity planning and forecasting (expert)
- Resource scheduling and deployment (expert)
- Workforce analytics and reporting (advanced)
- PSA and resource tooling (advanced)
- Cybersecurity services delivery (intermediate; CompTIA Security+ or similar a plus)
Project and portfolio management (intermediate; P
