Job description
About Surefire Cyber
Surefire Cyber is redefining the incident response model by delivering a swifter, stronger response to cyber incidents such as ransomware, email compromise, malware, data theft, and other threats. Our client-centric approach reduces stress and provides clients the confidence needed to prepare, respond, and recover from cyber incidents – and fortify their cyber resilience after an event.
Surefire Cyber’s approach and delivery are designed by industry veterans who have worked shoulder-toshoulder with law firms, insurance carriers, brokers, law enforcement, and impacted organizations in responding to cyber incidents. We are marshaling this experience to address the industry’s persistent challenges of efficiency, predictability, and transparency
Job Title: Principal, Restoration and Remediation
Location: Remote (USA)
Role: Full time
What Makes You Stand Out
You are a senior technical leader in cybersecurity and incident response, known for restoring order and confidence during high-severity events. You’ve led the full lifecycle of post-incident recovery efforts, from strategic planning and stakeholder advising, to hands-on systems restoration and network reconfiguration.
You bring not only deep technical skills across enterprise IT infrastructure but also the confidence and clarity to lead clients, coach teammates, and evolve internal capabilities. You thrive in high-pressure environments, take initiative, and are passionate about growing the next generation of cyber responders.
How You’llMake An Impact
As a Principal Consultant on the Restoration and Remediation team, you’ll lead Surefire Cyber’s most complex and sensitive post-incident recovery engagements. You’ll advise clients on restoration strategy, coordinate with cross-functional teams, and oversee technical execution across diverse environments.
You’ll also play a key role in maturing SurefireCyber’s internal R&R capabilities; mentoring consultants, improving playbooks and tooling, and shaping how we scale recovery operations.
Your Role In Action
Lead end-to-end recovery operations for complex cyber incidents, including ransomware outbreaks, large-scale breaches, and targeted compromises
Architect and manage technical remediation plans across hybrid infrastructure (on-prem, cloud, and SaaS), including user recovery, server rebuilds, reconfiguration, and hardening
Oversee restoration of identity services (Active Directory, Azure AD), messaging systems (Exchange, M365), VPNs, firewalls, MFA, and enterprise backup solutions
Advise client executives (CIOs, CISOs, legal, insurers) on remediation strategy, recovery timelines, and long-term resilience improvements
Coordinate recovery workstreams across DFIR, IT, legal, and insurance stakeholders, ensuring alignment and technical integrity
Act as technical escalation point during recovery engagements, solving roadblocks with precision and speed
Mentor senior and junior consultants on real-time client work and long-term development, including technical coaching, feedback, and project guidance
Document and review client-facing technical reports, timelines, and lessons learned to ensure completeness and clarity
Contribute to the evolution of SurefireCyber’s recovery methodologies, including internal tooling, knowledge bases, and training paths
Lead or support proactive services including tabletop exercises, remediation readiness assessments, and executive advisory engagements
Participate in after-hours response rotations during major incident events (on-call availability expected)
Your Expertise
10+ years of professional experience in cybersecurity, incident response, systems/network administration, or IT infrastructure engineering
Proven leadership in guiding enterprise-scale recovery efforts during cyber incidents, ideally in a client-facing or consulting capacity
Deep hands-on experience with Active Directory, Azure AD, M365, Exchange, Group Policy, virtualization platforms (VMware, Hyper-V, Citrix), and backup tools (e.g., Veeam, Zerto, Unitrends)
Expert understanding of infrastructure reconfiguration, network segmentation, identity access recovery, and endpoint security post-compromise
Ability to architect and execute remediation plans in coordination with DFIR, SOC, and cloud teams
Comfortable advising senior business and legal stakeholders during high-pressure engagements
Strong written and verbal communication skills, including experience preparing and presenting executive-level remediation updates
Demonstrated experience mentoring and growing technical talent within a team
Familiarity with attacker TTPs, threat actor behaviors, and their implications for recovery sequencing and infrastructure redesign
Demonstrated expertise in cybersecurity, systems engineering, or incident response, whether gained through professional experience, certifications, or equivalent technical training.
Advanced certifications (e.g., CISSP, GCFA, MCSE, OSCP) are strongly preferred.
Expertise in all these areas is not required, but you should be excited by the opportunity to learn new things and comfortable with working with other team members to expand your knowledge base and experience. We at Surefire Cyber invite you to apply even if you do not feel you have mastery in all the requirements listed on the job description and welcome a further discussion.
Interview Process
Submit interest and application on our website
Preliminary phone interview with the Talent & People Team (approx., 30 minutes)
Virtual technical interview with the Restoration Team (approx., 45 minutes)
Virtual interview with our Director of Restoration (approx., 45 minutes)
Take Home Assessment
Virtual interview with Chief Delivery Officer (approx., 30 minutes)
Virtual interview with CEO (Chief Executive Officer) (approx., 30 minutes)
Benefits for Full-Time Surefire Cyber Team Members
Competitive compensation plan and total rewards package for team members
Remote workforce
Generous paid time off plan and floating holidays
Paid parental leave
Employer paid premiums for both team members and their dependents for medical, dental, and vision
Comprehensive health, vision, dental, 401K matching program, disability, Flexible Spending Accounts (FSA), Health Savings Account (HSA), Life and AD&D benefits.
Professional development and career advancement opportunities
We prioritize employee growth and development through a robust performance management platform to provide ongoing coaching, clear feedback, recognition, and opportunities for career growth.
Note: Internship roles are not eligible for Surefire’s full-time benefits package. Internship-specific details will be shared during the interview process.
Surefire Cyber is an Equal Opportunity Employer that does not discriminate on the basis of actual or perceived race, color, creed, religion, national origin, ancestry, citizenship status, age, sex, or gender (including pregnancy, childbirth, and pregnancy-related conditions), gender identity or expression (including transgender status), sexual orientation, marital status, military service and veteran status, physical or mental disability, genetic information, or any other characteristic protected by applicable federal, state or local laws and ordinances.
Originally posted on Himalayas
Who can apply
Eligible countries: Australia, Canada, Denmark, France, Germany, Netherlands, Norway, Sweden, United Kingdom, United States. Accepted UTC offsets: UTC-10, UTC-9, UTC-8, UTC-7, UTC-6, UTC-5, UTC-4, UTC-3.5, UTC+0, UTC+1, UTC+8, UTC+8.75, UTC+9, UTC+9.5, UTC+10, UTC+10.5, UTC+14. Review the full description for employer-specific work authorization, residency and schedule requirements.