Director, Incident Response and Post Breach Recovery (IR)

Key Responsibilities

• Lead technical recovery efforts during major cyber incidents
• Direct teams rebuilding compromised infrastructure and identity platforms
• Serve as a senior technical resource for complex recovery challenges
• Guide containment, eradication, and recovery operations
• Help design and execute secure rebuild strategies for enterprise environments
• Communicate clearly with executives, legal teams, and technical stakeholders
• Mentor and support consultants across multiple engagements
• Contribute to the development of recovery playbooks and frameworks

Required Experience

• 8+ years in cybersecurity, incident response, or enterprise infrastructure
• Strong technical background in enterprise systems and identity architecture
• Hands-on familiarity with EDR, containment strategies, and remediation workflows
• Experience leading technical teams during major cyber incidents
• Ability to operate both strategically and hands-on when needed

Preferred Qualifications

• Experience leading ransomware or large-scale cyber recovery engagements
• Background in consulting or incident response services
• Experience rebuilding enterprise Active Directory or hybrid identity environments
• Familiarity with Entra ID, modern identity platforms, and cloud infrastructure