Principal Consultant, Restoration and Remediation

Responsibilities

• Lead end-to-end recovery operations for complex cyber incidents, including ransomware outbreaks and large-scale breaches
• Architect and manage technical remediation plans across hybrid infrastructure (on-prem, cloud, and SaaS)
• Oversee restoration of identity services, messaging systems, VPNs, firewalls, and enterprise backup solutions
• Advise client executives on remediation strategy, recovery timelines, and long-term resilience
• Coordinate recovery workstreams across DFIR, IT, legal, and insurance stakeholders
• Act as a technical escalation point during recovery engagements
• Mentor senior and junior consultants through technical coaching and project guidance
• Document and review client-facing technical reports and lessons learned
• Contribute to the evolution of recovery methodologies, internal tooling, and knowledge bases
• Lead proactive services including tabletop exercises and remediation readiness assessments
• Participate in after-hours response rotations

Requirements

• 10+ years of professional experience in cybersecurity, incident response, or IT infrastructure engineering
• Proven leadership in guiding enterprise-scale recovery efforts
• Deep hands-on experience with Active Directory, Azure AD, M365, Exchange, and virtualization platforms
• Expertise in infrastructure reconfiguration, network segmentation, and identity access recovery
• Ability to architect remediation plans in coordination with DFIR and SOC teams
• Strong written and verbal communication skills for executive-level updates
• Experience mentoring technical talent
• Familiarity with attacker TTPs and threat actor behaviors

Preferred Qualifications

• Advanced certifications such as CISSP, GCFA, MCSE, or OSCP

Benefits

• Competitive compensation plan and total rewards package
• Remote workforce
• Generous paid time off and floating holidays
• Paid parental leave
• Employer-paid medical, dental, and vision premiums for team members and dependents
• 401K matching program
• Professional development and career advancement opportunities

About the Company

Surefire Cyber is redefining the incident response model by delivering a swifter, stronger response to cyber incidents such as ransomware, email compromise, malware, and data theft.