Sr. Remediation Specialist (AIR)

About the role

The Principal Remediation Specialist is a senior level position with the scope to develop and grow the restoration capability within the AIR practice. The primary goal of each engagement is to recover clients to an operating capacity post incident.

Key Attributes

Business Support

• Support the development of bids/proposals associated with opportunities identified, typically from the Digital Forensics and Incident Response practice.
• Work with clients and sales teams to generate Statements of Work (SOWs).

Data Collection / Set-up

• Deploy client-side data and log collection solutions.
• Assist with forensic collection requests.
• Install Remote Monitoring and Management (RMM) utility and/or establish VPN credentials for remote access.
• Deploy forensic tools (e.g., SentinelOne / Velociraptor).
• Develop shared inventory tracking document.

Threat Actor Removal

• Perform technical engineering efforts to remove threat actors.
• Acquire third-party products and services necessary to remove threat actors and rebuild, recover, stabilize, and secure customer systems and environments.
• Block Indicators of Compromise (IOCs) within network firewalls as provided by forensics provider.
• Perform impact assessment of servers to determine viability in cooperation with forensics provider.

Environment Re-Build

• Rebuild, recover, stabilize, and secure systems.
• Restoration/rebuild/decryption of servers.
• Active Directory (AD) health review and rebuild.
• Domain controller rebuilds and AD hardening.
• Configure segregated networks.
• Hypervisor configurations.
• Local Administrator Password Solution (LAPS) configuration.
• Troubleshooting, impact to, and recovery options for Exchange.
• Remote site firewall firmware update assistance.

Legal / Comms

• Work with company, customer’s General Counsel, customer’s insurance carrier, and any applicable third parties.

Desired Experience

Due to the varied nature of client systems, wide and diverse experience across multiple technologies and solutions is preferable. Typical technologies and solutions include:

Leadership

• More than 10 years in IT/Network/Cloud Engineering roles.
• Leading enterprise recovery-type projects.
• Disaster Recovery planning.
• VMware/Hyper-V, AWS/Azure/GCP recovery.
• Infrastructure as Code (IaC) (Terraform, Ansible).

Network Recovery SME

• Veeam, Commvault, Rubrik, Cohesity.

Cloud Recovery SME

• Cloud/SaaS admin.
• AWS/Azure Security Engineer.

Infrastructure & Backup Tools

• VMware vSphere, Hyper-V, AWS Backup, Azure Site Recovery.
• Veeam, Commvault, Rubrik, Cohesity, Zerto.
• Immutable storage: S3 Object Lock, Wasabi Immutable, Dell Data Domain.

Network Tools

• Firewalls: Palo Alto, Cisco ASA/FTD, SonicWall, Watchguard.
• Monitoring: SolarWinds, NetFlow analyzers, Wireshark.
• Segmentation: VLANs, Illumio, Guardicore.

Endpoint Tools

• EDR/XDR: CrowdStrike, Defender ATP, SentinelOne.
• RMM: Screen Connect, Kaseya, NinjaOne.
• MDM: Intune, JAMF, Workspace ONE.
• Imaging: MDT, Clonezilla, Acronis.

Cloud & SaaS Recovery Tools

• AWS/Azure/GCP recovery playbooks.
• SaaS backup: Spanning, Druva, AvePoint.
• IAM monitoring: CloudTrail, Azure Sentinel.

Communication & Coordination Tools

• Project Management: Connectwise, AutoTask, Atera.
• Secure comms: Signal, MS Teams with eDiscovery.
• Crisis platforms: xMatters, Everbridge.
• Documentation: Confluence, SharePoint, ServiceNow.

Testing & Validation Tools

• Red/Yellow/Green segmented environments.
• Sandbox for malware testing: Cuckoo, AnyRun.
• Cyber range and tabletop testing platforms.

Qualifications

• Relevant academic degree.
• CISM or CISSP (or a commitment to obtain within 12 months).
• GCWN, ITIL, DRII Certified.
• CCNP Security, PCNSE, GCIA.
• Microsoft 365 Certified, JAMF, Security+.
• Veeam Certified, GEBR.
• CCSP, CCSK.

Education

A high school diploma or equivalent is required; a college or university degree is a plus.