Remote Restoration & Remediation Consultant

Remote; San Francisco (CA); Remote; USD 95,000 - 140,000; Full time

Job summary

Surefire Cyber is seeking a Consultant, Restoration and Remediation to join the remote USA team. You will work with DFIR to help clients recover from ransomware and breaches, perform remediation, and restore systems.

This role requires hands-on experience restoring compromised systems, implementing remediation strategies, and communicating clearly with clients during urgent cyber events. You will collaborate with forensic analysts and support 24/7 incident response coverage on a rotational basis.

Qualifications

• Bachelor's degree in IT, Cybersecurity, Computer Science, or equivalent.
• Foundational knowledge of Windows, Linux, and MacOS.
• Experience with firewalls, VPNs, Active Directory, Group Policy, Exchange, and common endpoint security tools.
• Understanding of cyber incident impact, attacker techniques, and indicators of compromise (IOCs).
• Strong technical troubleshooting skills and a proactive, team-first attitude.

Responsibilities

• Support post-incident recovery, collaborating with DFIR teams to assess scope and impact.
• Restore compromised systems to a pre-incident state, including data recovery and configuration.
• Develop and execute tailored remediation plans based on technical, regulatory requirements.
• Reimage, rebuild, and reconfigure endpoints, servers, and services such as AD, Exchange, and VPN.
• Document actions taken with clear findings, decisions, and lessons learned.
• Participate in after-hours on-call/weekend rotational support for 24/7 incident response.

Skills

Windows OS

Linux OS

MacOS

Firewalls

VPNs

Active Directory

Group Policy

Exchange

Endpoint security tools

Education

Bachelor's degree in IT/Cybersecurity/CS

Tools

Active Directory

Exchange

VPNs

Firewalls

Endpoint security tools

Job description

Surefire Cyber is seeking a Consultant, Restoration and Remediation to join the remote USA team. You will work with DFIR to help clients recover from ransomware and breaches, perform remediation, and restore systems.

This role requires hands-on experience restoring compromised systems, implementing remediation strategies, and communicating clearly with clients during urgent cyber events. You will collaborate with forensic analysts and support 24/7 incident response coverage on a rotational basis.