Principal Consultant, Restoration and Remediation

Stack

Responsibilities

• ▹Lead end-to-end recovery operations for complex cyber incidents, including ransomware outbreaks, large-scale breaches, and targeted compromises
• ▹Architect and manage technical remediation plans across hybrid infrastructure (on-prem, cloud, and SaaS), including user recovery, server rebuilds, reconfiguration, and hardening
• ▹Oversee restoration of identity services (Active Directory, Azure AD), messaging systems (Exchange, M365), VPNs, firewalls, MFA, and enterprise backup solutions
• ▹Advise client executives (CIOs, CISOs, legal, insurers) on remediation strategy, recovery timelines, and long-term resilience improvements
• ▹Coordinate recovery workstreams across DFIR, IT, legal, and insurance stakeholders
• ▹Act as technical escalation point during recovery engagements
• ▹Mentor senior and junior consultants on real-time client work and long-term development
• ▹Document and review client-facing technical reports, timelines, and lessons learned
• ▹Contribute to the evolution of recovery methodologies, internal tooling, and knowledge bases
• ▹Lead or support proactive services including tabletop exercises, remediation readiness assessments, and executive advisory engagements
• ▹Participate in an after-hours response rotation

Requirements

• ▹Senior technical leadership experience in cybersecurity and incident response
• ▹Track record leading the full post-incident recovery lifecycle, from strategic planning to hands-on systems restoration
• ▹Deep technical skills across enterprise IT infrastructure
• ▹Ability to lead clients, coach teammates, and evolve internal capabilities
• ▹Comfort operating in high-pressure environments

Soft skills

About the company

Surefire Cyber is redefining the incident response model, delivering client-centric support for ransomware, email compromise, malware, and data theft incidents, from preparation through response and recovery.