Remote DFIR Restoration Lead: Incident Recovery Automation

Surefire Cyber Inc.; United States; Remote; USD 110,000 - 170,000; Full time

Benefits offered by this job

Fully remote workforce

Generous paid time off and floating/tr

Paid parental leave

Employer-paid medical, dental, and eye

401K matching program

Professional development and career

Job summary

Surefire Cyber Inc. is seeking a seasoned incident response and restoration specialist to lead recovery efforts after cyber incidents across Windows, Linux, and Mac environments.

You will collaborate with DFIR teams, automate recovery with PowerShell, and restore VMware, Hyper‑V, Citrix, and Nutanix environments while coordinating with storage and backup solutions provider ecosystems. This role supports remote operations with weekend on-call coverage.

Qualifications

• Bachelor’s degree in IT, Computer Science, or equivalent professional experience.
• DFIR and restoration experience in a consulting setting.
• Proficiency in Microsoft Exchange, M365, and Windows Server.
• Expertise in Windows, Linux, or MacOS operating systems.
• Experience in network administration and firewall configuration.
• Strong problem‑solving skills and attention to detail.
• Excellent verbal and written communication skills.

Responsibilities

• Perform restoration and recovery efforts following cyber incidents.
• Collaborate with DFIR teams to assess scope and impact of incidents.
• Restore compromised systems using Active Directory, Group Policy, and Azure AD.
• Script and automate recovery processes using PowerShell and Windows command line.
• Restore virtualized environments using VMware, Hyper‑V, Citrix, or Nutanix.
• Manage server hardware platforms including HP, Dell, Nutanix, and Cisco UCS.
• Recover data using storage vendors like Dell EMC, NetApp, and Pure Storage.
• Implement backup solutions such as Veeam, Backup Exec, and Zerto.
• Oversee enterprise messaging systems including Exchange and M365.
• Manage networking components including firewalls, VPNs, and core switches.
• Implement MFA services such as Okta, DUO, and Microsoft Authentication.
• Document restoration efforts, lessons learned, and best practices.
• Provide on-call and weekend rotational support.

Skills

DFIR experience

Restoration experience

Windows Server

Exchange/M365

Linux

MacOS

Network administration

Firewall configuration

Problem solving

Verbal and written communication

Education

Bachelor’s degree in IT, Computer Science, or equivalent

Tools

Active Directory

Group Policy

Azure AD

PowerShell

VMware

Hyper-V

Citrix

Nutanix

Dell EMC

NetApp

Pure Storage

Veeam

Backup Exec

Zerto

Exchange

M365

Job description

Surefire Cyber Inc. is seeking a seasoned incident response and restoration specialist to lead recovery efforts after cyber incidents across Windows, Linux, and Mac environments.

You will collaborate with DFIR teams, automate recovery with PowerShell, and restore VMware, Hyper‑V, Citrix, and Nutanix environments while coordinating with storage and backup solutions provider ecosystems. This role supports remote operations with weekend on-call coverage.