Senior DFIR Restoration Engineer — Remote

Tokio Marine HCC; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Competitive salary and comprehensive  

401(k) plan with 6% company match

Comprehensive medical, vision, and  d

Dental coverage and life insurance

Paid time off and holidays

Employee discount program

Job summary

Tokio Marine HCC is seeking a Senior Restoration Engineer, DFIR, to lead the hands‑on restoration of systems after ransomware or intrusions. You will assess, plan, and direct complex rebuilds of Windows servers, AD, DNS, VPN, and backup ecosystems, while preserving forensic requirements and coordinating with client IT and MSP teams.

The role requires 5+ years in infrastructure, DR, and incident response, with strong virtualization, backup, and cloud identity experience.

Qualifications

• Bachelor’s degree or equivalent professional experience in IT, CS, cybersecurity, or IS.
• 5+ years in infrastructure engineering, DR, incident response, or ransomware recovery with leadership.
• Hands‑on experience administering Windows Server, AD, DNS, DHCP, file services, and related infra.
• Strong virtualization experience (VMware/Hyper‑V) and DR technologies.
• Knowledge of networks, security controls, firewalls, VPN, and endpoint security tooling.
• Experience with Microsoft 365 / Entra ID and cloud/hybrid identity.
• Proven ability to rebuild, recover from backup, and validate clean recovery points under pressure.
• Willingness for rotating after‑hours/on‑call coverage for 24/7/365 IR engagements.

Responsibilities

• Lead the technical restoration workstream for cyber incidents from assessment to service restoration.
• Assess environments, define priorities, and sequence restoration activities with stakeholders.
• Develop practical restoration plans covering dependencies, owners, milestones, and risks.
• Advise on safe recovery decisions (offline, rebuild, restore from backup, or replace).
• Lead rebuild/recovery of Windows servers, AD, DNS, DHCP, and core infra components.
• Support recovery of MS 365/Entra ID, file services, DNS, VPN, and backups.
• Validate backup integrity, coordinate test restores, establish clean recovery points.
• Guide credential resets, domain hardening, and containment measures during restoration.
• Collaborate with forensic/security teams to avoid impacting evidence or reintroducing threats.
• Communicate status, risks, dependencies, and next steps to client leadership.

Skills

Windows Server

Active Directory

VMware/Hyper-V

Backup & DR technologies

Networking & security

Microsoft 365 / Entra ID

Incident response

Troubleshooting under pressure

Leadership

Executive communication

Education

Bachelor’s degree in IT, CS, Cybersecurity, IS

Tools

VMware

Hyper-V

Backup software

Replication tech

Active Directory tooling

Job description

Tokio Marine HCC is seeking a Senior Restoration Engineer, DFIR, to lead the hands‑on restoration of systems after ransomware or intrusions. You will assess, plan, and direct complex rebuilds of Windows servers, AD, DNS, VPN, and backup ecosystems, while preserving forensic requirements and coordinating with client IT and MSP teams.

The role requires 5+ years in infrastructure, DR, and incident response, with strong virtualization, backup, and cloud identity experience.