Recovery Engineer

ArrowTeam; Washington (District of Columbia); Hybrid; USD 110,000 - 170,000; Full time

Job summary

Arrow Team seeks a Restoration Engineer to execute the technical recovery of client environments during cybersecurity incidents, ransomware engagements, and major infrastructure failures. Working under the Incident Commander, you will restore business-critical systems, rebuild infrastructure, validate recovery integrity, and drive technical execution from containment through operational recovery.

This hands-on role requires deep expertise across Microsoft infrastructure, virtualization,

Qualifications

• 5–8 years administering and troubleshooting enterprise Windows infrastructure.
• Strong experience with AD, Group Policy, DNS, DHCP, Windows Server, Hyper-V/VMware.
• Experience restoring systems from backup platforms such as Veeam, Cove, Commvault, Rubrik, Cohesity.
• Working knowledge of firewalls, VPNs, routing, switching, storage, and enterprise authentication.
• PowerShell scripting to automate recovery tasks.
• Ability to diagnose complex infrastructure issues under pressure with minimal supervision.
• Excellent documentation and communication to incidents commanders.

Responsibilities

• Execute the technical restoration of client environments during ransomware events, cyber incidents, and critical infrastructure outages.
• Recover and rebuild Windows Server environments, Active Directory, virtualization platforms, storage infrastructure, and core network services.
• Perform recovery operations using backup platforms, snapshots, replication technologies, and disaster recovery tooling while validating data integrity and application functionality.
• Troubleshoot complex infrastructure failures spanning servers, networking, identity, storage, cloud platforms, and endpoint management.
• Implement containment and remediation activities under the direction of the Incident Commander while maintaining detailed technical documentation throughout the engagement.
• Coordinate closely with Security Engineers, Network Engineers, MSP teams, and client technical staff to ensure recovery activities are completed safely and efficiently.
• Identify risks, blockers, and technical dependencies early, escalating concerns to the Incident Commander before they impact recovery timelines.
• Document restoration procedures, technical findings, and environmental changes to support post-incident reporting and future response efforts.
• Contribute to the development and improvement of Arrow Team restoration playbooks, recovery procedures, automation, and technical standards.
• Participate in an on-call rotation supporting emergency incident response engagements outside normal business hours.

Skills

Windows infrastructure

Active Directory

PowerShell

VMware/Hyper-V

Networking

Cloud platforms

Tools

Veeam

Cove

Commvault

Rubrik

Cohesity

Job description

Arrow Team delivers high-speed incident response and premium managed IT services to organizations facing disruption, complexity, and risk. We combine precision engineering with mission-first urgency to restore control in the face of chaos. As we expand our Incident Response practice, we're building a technically elite team capable of recovering complex enterprise environments under extreme time pressure.

Role Overview

We are seeking a highly skilled Restoration Engineer to execute the technical recovery of client environments during cybersecurity incidents, ransomware engagements, and major infrastructure failures. Working under the direction of an Incident Commander, you'll be responsible for restoring business-critical systems, rebuilding infrastructure, validating recovery integrity, and driving technical execution from containment through operational recovery.

This is a hands-on engineering role for individuals who thrive in complex, high-pressure environments. Success requires deep technical expertise across Microsoft infrastructure, virtualization, networking, cloud platforms, and enterprise recovery methodologies. Restoration Engineers are expected to independently solve unfamiliar problems, make sound technical decisions, and maintain momentum when time is critical.

Core Responsibilities

Execute the technical restoration of client environments during ransomware events, cyber incidents, and critical infrastructure outages.

Recover and rebuild Windows Server environments, Active Directory, virtualization platforms, storage infrastructure, and core network services.

Perform recovery operations using backup platforms, snapshots, replication technologies, and disaster recovery tooling while validating data integrity and application functionality.

Troubleshoot complex infrastructure failures spanning servers, networking, identity, storage, cloud platforms, and endpoint management.

Implement containment and remediation activities under the direction of the Incident Commander while maintaining detailed technical documentation throughout the engagement.

Coordinate closely with Security Engineers, Network Engineers, MSP teams, and client technical staff to ensure recovery activities are completed safely and efficiently.

Identify risks, blockers, and technical dependencies early, escalating concerns to the Incident Commander before they impact recovery timelines.

Document restoration procedures, technical findings, and environmental changes to support post-incident reporting and future response efforts.

Contribute to the development and improvement of Arrow Team restoration playbooks, recovery procedures, automation, and technical standards.

Participate in an on-call rotation supporting emergency incident response engagements outside normal business hours.

Required Qualifications

5 to 8 years of experience administering and troubleshooting enterprise Windows infrastructure, preferably within an MSP, consulting, enterprise operations, or incident response environment.

Strong experience with Active Directory, Group Policy, DNS, DHCP, Windows Server, Hyper-V and/or VMware virtualization, Microsoft 365, Entra ID, and enterprise networking.

Experience restoring systems from enterprise backup platforms such as Veeam, Cove, Commvault, Rubrik, Cohesity, or similar technologies.

Working knowledge of firewalls, VPN technologies, routing, switching, storage systems, and enterprise authentication.

PowerShell scripting and automation skills with the ability to rapidly troubleshoot unfamiliar environments.

Demonstrated ability to diagnose complex infrastructure issues under pressure with minimal supervision.

Excellent troubleshooting methodology, analytical thinking, and attention to detail.

Strong documentation habits and the ability to communicate technical findings clearly to both technical peers and Incident Commanders.

Willingness to work extended hours and travel on short notice when required.

Preferred Qualifications

Experience supporting ransomware recovery, cyber incident response, or disaster recovery operations.

Hands-on experience with Azure, AWS, Microsoft 365, and hybrid cloud infrastructure.

Experience with enterprise backup architecture, replication technologies, and disaster recovery planning.

Technical certifications such as Microsoft Certified, VMware VCP, Veeam VMCE, CCNP, Azure Administrator, AWS Solutions Architect, or equivalent.

Experience developing automation, tooling, or scripts to improve restoration efficiency.

What Success Looks Like

Successful Restoration Engineers consistently:

Evidence exceptional empathy when working with clients under extreme duress.

Restore critical client infrastructure accurately under aggressive timelines.

Solve unfamiliar technical problems with confidence and sound engineering judgment.

Maintain clear documentation that enables seamless coordination across the response team.

Escalate technical risks early while remaining focused on execution.

Continuously improve recovery processes through documentation, automation, and lessons learned.

Represent Arrow Team's commitment to technical excellence during our clients' most critical moments.