Elite Restoration Engineer - Cyber Incident Recovery

ArrowTeam; Washington (District of Columbia); Hybrid; USD 110,000 - 170,000; Full time

Job summary

Arrow Team seeks a Restoration Engineer to execute the technical recovery of client environments during cybersecurity incidents, ransomware engagements, and major infrastructure failures. Working under the Incident Commander, you will restore business-critical systems, rebuild infrastructure, validate recovery integrity, and drive technical execution from containment through operational recovery.

This hands-on role requires deep expertise across Microsoft infrastructure, virtualization,

Qualifications

• 5–8 years administering and troubleshooting enterprise Windows infrastructure.
• Strong experience with AD, Group Policy, DNS, DHCP, Windows Server, Hyper-V/VMware.
• Experience restoring systems from backup platforms such as Veeam, Cove, Commvault, Rubrik, Cohesity.
• Working knowledge of firewalls, VPNs, routing, switching, storage, and enterprise authentication.
• PowerShell scripting to automate recovery tasks.
• Ability to diagnose complex infrastructure issues under pressure with minimal supervision.
• Excellent documentation and communication to incidents commanders.

Responsibilities

• Execute the technical restoration of client environments during ransomware events, cyber incidents, and critical infrastructure outages.
• Recover and rebuild Windows Server environments, Active Directory, virtualization platforms, storage infrastructure, and core network services.
• Perform recovery operations using backup platforms, snapshots, replication technologies, and disaster recovery tooling while validating data integrity and application functionality.
• Troubleshoot complex infrastructure failures spanning servers, networking, identity, storage, cloud platforms, and endpoint management.
• Implement containment and remediation activities under the direction of the Incident Commander while maintaining detailed technical documentation throughout the engagement.
• Coordinate closely with Security Engineers, Network Engineers, MSP teams, and client technical staff to ensure recovery activities are completed safely and efficiently.
• Identify risks, blockers, and technical dependencies early, escalating concerns to the Incident Commander before they impact recovery timelines.
• Document restoration procedures, technical findings, and environmental changes to support post-incident reporting and future response efforts.
• Contribute to the development and improvement of Arrow Team restoration playbooks, recovery procedures, automation, and technical standards.
• Participate in an on-call rotation supporting emergency incident response engagements outside normal business hours.

Skills

Windows infrastructure

Active Directory

PowerShell

VMware/Hyper-V

Networking

Cloud platforms

Tools

Veeam

Cove

Commvault

Rubrik

Cohesity

Job description

Arrow Team seeks a Restoration Engineer to execute the technical recovery of client environments during cybersecurity incidents, ransomware engagements, and major infrastructure failures. Working under the Incident Commander, you will restore business-critical systems, rebuild infrastructure, validate recovery integrity, and drive technical execution from containment through operational recovery.

This hands-on role requires deep expertise across Microsoft infrastructure, virtualization,