Principal Consultant, Restoration and Remediation

The role

You will lead complex post-incident recovery engagements and advise clients on restoration strategy. You will also mentor consultants and improve internal recovery capabilities and tooling.

What you will do

• Lead end-to-end recovery operations for complex cyber incidents
• Architect and manage technical remediation plans across hybrid infrastructure
• Oversee restoration of identity services, messaging systems, VPNs, firewalls, MFA, and backup solutions
• Advise client executives on remediation strategy, recovery timelines, and long-term resilience
• Coordinate recovery workstreams across DFIR, IT, legal, and insurance stakeholders
• Act as technical escalation point during recovery engagements
• Mentor senior and junior consultants on client work and development
• Document and review client-facing technical reports and lessons learned
• Contribute to the evolution of recovery methodologies, tooling, and training
• Lead or support proactive services like tabletop exercises and readiness assessments

Required qualifications

• 10+ years of professional experience in cybersecurity, incident response, systems/network administration, or IT infrastructure engineering
• Proven leadership in guiding enterprise-scale recovery efforts during cyber incidents
• Deep hands-on experience with Active Directory, Azure AD, M365, Exchange, Group Policy, virtualization platforms, and backup tools
• Expert understanding of infrastructure reconfiguration, network segmentation, identity access recovery, and endpoint security post-compromise
• Ability to architect and execute remediation plans in coordination with DFIR, SOC, and cloud teams
• Comfortable advising senior business and legal stakeholders during high-pressure engagements
• Strong written and verbal communication skills
• Demonstrated experience mentoring and growing technical talent within a team
• Familiarity with attacker TTPs, threat actor behaviors, and their implications for recovery
• Demonstrated expertise in cybersecurity, systems engineering, or incident response

Nice to have

• Advanced certifications (e.g., CISSP, GCFA, MCSE, OSCP)

Benefits

• Competitive compensation plan and equity
• Remote workforce
• Generous paid time off plan and floating holidays
• Employer paid premiums for team members and dependents for medical, dental, and vision
• Comprehensive health, vision, dental, 401K matching program, disability, Flexible Spending Accounts (FSA), Health Savings Account (HSA), Life and AD&D benefits
• Paid parental leave
• Professional development and career advancement opportunities
• Performance management platform for coaching, feedback, and recognition

Before you apply

• Preliminary phone interview with the Talent & People Team
• Virtual technical interview with the Restoration Team
• Virtual interview with our Director of Restoration
• Take Home Assessment
• Virtual interview with Chief Delivery Officer

About the company

Surefire Cyber delivers incident response for cyber incidents such as ransomware, email compromise, malware, and data theft. Their approach is designed by industry veterans to address challenges of efficiency, predictability, and transparency.