Principal Consultant, Restoration and Remediation

Job Title: Principal, Restoration and Remediation 

Location: Remote (USA) 

Role: Full time 

What Makes You Stand Out 

You are a senior technical leader in cybersecurity and incident response, known for restoring order and confidence during high-severity events. You’ve led the full lifecycle of post-incident recovery efforts, from strategic planning and stakeholder advising, to hands-on systems restoration and network reconfiguration. 

You bring not only deep technical skills across enterprise IT infrastructure but also the confidence and clarity to lead clients, coach teammates, and evolve internal capabilities. You thrive in high-pressure environments, take initiative, and are passionate about growing the next generation of cyber responders. 

How You’ll Make An Impact 

As a Principal Consultant on the Restoration and Remediation team, you’ll lead Surefire Cyber’s most complex and sensitive post-incident recovery engagements. You’ll advise clients on restoration strategy, coordinate with cross-functional teams, and oversee technical execution across diverse environments. 

You’ll also play a key role in maturing Surefire Cyber’s internal R&R capabilities; mentoring consultants, improving playbooks and tooling, and shaping how we scale recovery operations. 

Your Role In Action 

• Lead end-to-end recovery operations for complex cyber incidents, including ransomware outbreaks, large-scale breaches, and targeted compromises 

• Architect and manage technical remediation plans across hybrid infrastructure (on-prem, cloud, and SaaS), including user recovery, server rebuilds, reconfiguration, and hardening 

• Oversee restoration of identity services (Active Directory, Azure AD), messaging systems (Exchange, M365), VPNs, firewalls, MFA, and enterprise backup solutions 

• Advise client executives (CIOs, CISOs, legal, insurers) on remediation strategy, recovery timelines, and long-term resilience improvements 

• Coordinate recovery workstreams across DFIR, IT, legal, and insurance stakeholders, ensuring alignment and technical integrity 

• Act as technical escalation point during recovery engagements, solving roadblocks with precision and speed 

• Mentor senior and junior consultants on real-time client work and long-term development, including technical coaching, feedback, and project guidance 

• Document and review client-facing technical reports, timelines, and lessons learned to ensure completeness and clarity 

• Contribute to the evolution of Surefire Cyber’s recovery methodologies, including internal tooling, knowledge bases, and training paths 

• Lead or support proactive services including tabletop exercises, remediation readiness assessments, and executive advisory engagements 

• Participate in after-hours response rotations during major incident events (on-call availability expected) 

 

Your Expertise  

• 10+ years of professional experience in cybersecurity, incident response, systems/network administration, or IT infrastructure engineering 

• Proven leadership in guiding enterprise-scale recovery efforts during cyber incidents, ideally in a client-facing or consulting capacity 

• Deep hands-on experience with Active Directory, Azure AD, M365, Exchange, Group Policy, virtualization platforms (VMware, Hyper-V, Citrix), and backup tools (e.g., Veeam, Zerto, Unitrends) 

• Expert understanding of infrastructure reconfiguration, network segmentation, identity access recovery, and endpoint security post-compromise 

• Ability to architect and execute remediation plans in coordination with DFIR, SOC, and cloud teams 

• Comfortable advising senior business and legal stakeholders during high-pressure engagements 

• Strong written and verbal communication skills, including experience preparing and presenting executive-level remediation updates 

• Demonstrated experience mentoring and growing technical talent within a team 

• Familiarity with attacker TTPs, threat actor behaviors, and their implications for recovery sequencing and infrastructure redesign 

• Demonstrated expertise in cybersecurity, systems engineering, or incident response, whether gained through professional experience, certifications, or equivalent technical training.