Sr. Remediation Specialist (AIR)

LevelBlue, LLC.; United States; Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Comprehensive health insurance

401(k) with employer matching

Generous paid time off

Flexible spending accounts

Employee assistance programs

Training and development opportunities

Adoption assistance program

Job summary

LevelBlue, LLC. is seeking a Principal Remediation Specialist to lead advanced post-incident recovery engagements. You will drive restoration of client environments, collaborate with sales and legal teams, and supervise data collection and threat removal activities.

You will coordinate across enterprise recovery programs, implement IaC approaches, and employ security tools to ensure rapid return to operation while maintaining compliance and client satisfaction.

Qualifications

• Senior IT/Network/Cloud experience with 10+ years in roles.
• Expertise in enterprise recovery projects and DR planning.
• Experience with IaC tooling and cloud security.
• Ability to coordinate across legal, client, and vendor teams.

Responsibilities

• Lead remediation engagements and develop restoration capability within AIR practice.
• Collaborate with sales to draft SOWs and bids.
• Deploy client data collection and VPN access for forensics processing.
• Acquire tools and services to remove threats and rebuild customer systems.
• Perform risk and impact assessments with forensics partners, and harden AD/servers.
• Coordinate crisis communications and documentation using Confluence/ServiceNow.
• Oversee testing in cyber range environments and validate outcomes.

Skills

Leadership

Disaster Recovery

IaC (Terraform/Ansible)

Cloud Recovery

Security Engineering

Threat Hunting

Project Management

Communication

Vendor Coordination

Incident Response

Education

CISM or CISSP (or within 12 months)

GCWN

ITIL

DRII Certified

CCNP Security

PCNSE

GCIA

Microsoft 365 Certified

JAMF

Security+

Veeam Certified

GEBR

CCSP

CCSK

Tools

SentinelOne

Velociraptor

SolarWinds

Wireshark

S3/Wasabi Wasabi Immutable

Confluence

SharePoint

ServiceNow

ConnectWise

Atera

xMatters

Everbridge

Job description

Posted Thursday, August 6, 2026 at 6:00 AM

LevelBlue reduces risk and builds lasting resilience so organizations can innovate and advance their mission with confidence. As the world’s most analyst-recognized and largest pure-play managed security services provider, LevelBlue elevates client outcomes that matter: stronger defense, faster response, and sustained business continuity. LevelBlue combines AI-powered security operations, advanced threat intelligence, and elite human expertise to provide the most comprehensive portfolio of strategic advisory, managed security, offensive security, and incident response services.

The Principal Remediation Specialist is a senior level position with the scope to develop and grow the restoration capability within the AIR practice. The primary goal of each engagement is to recover our clients to an operating capacity post incident.

Key Attributes:

Business Support

• Support the development of bids / proposals associated with the opportunities identified usually from our Digital Forensics and Incident Response practice.
• Work clients and our sales teams with the generation of SOWs.

Data Collection / Set-up

• Deployment of client-side data and log collection solutions
• Assist with forensic collection requests
• Install Remote Monitoring and Management (“RMM”) utility and/or establish VPN credentials for remote access
• Deployment of Forensic tools e.g. (SentinelOne / Velociraptor)
• Develop shared inventory tracking document

Threat Actor Removal

• Technical engineering efforts to remove the threat actors
• Acquire third party products and services necessary to remove the threat actors and rebuild, recover, stabilize, and secure the Customer systems and environments
• Block IOCs within network firewalls as provided by forensics provider
• Perform impact assessment of servers to determine viability in cooperation with forensics provider
• Rebuild, recover, stabilize, and secure systems
• Restoration/ rebuild/ decryption of servers
• AD Health review and rebuild
• Domain controller rebuilds and AD hardening
• Hypervisor configurations
• LAPS (Local Administrator Password Solution) configuration
• Troubleshooting, impact to and recovery options for Exchange
• Remote site Firewall Firmware update assistance

Legal / Comms

• Work with Company, Customer’s General Counsel, Customer’s insurance carrier, and any applicable third parties

Desired Experience:

Due to the varied nature of client systems; as wide and diverse experience across multiple technologies and solutions is preferable. Typical technologies and solutions include:

Leadership

• More than 10 years in IT / Network / Cloud Engineering roles
• Leading enterprise recovery type projects
• Disaster Recovery planning
• IaC – Infrastructure as Code (Terraform, Ansible)

Network Recovery SME

Cloud Recovery SME

• Cloud/SaaS admin
• AWS/Azure Security Engineer

Infrastructure & Backup Tools

• Immutable storage: S3 Object Lock, Wasabi Immutable, Dell Data Domain

Network Tools

• Monitoring: SolarWinds, NetFlow analyzers, Wireshark

Cloud & SaaS Recovery Tools

Communication & Coordination Tools

• Project Management: Connectwise, AutoTask, Atera
• Secure comms: Signal, MS Teams with eDiscovery
• Crisis platforms: xMatters, Everbridge
• Documentation: Confluence, SharePoint, ServiceNow

Testing & Validation Tools

• Red/Yellow/Green segmented environments
• Sandbox for malware testing: Cuckoo, AnyRun
• Cyber range and tabletop testing platforms

Qualifications:

• CISM or CISSP(or a commitment to obtain within 12 months)
• GCWN, ITIL, DRII Certified
• CCNP Security, PCNSE, GCIA
• Microsoft 365 Certified, JAMF, Security+
• Veeam Certified, GEBR
• CCSP, CCSK

Education:

• A high school diploma or equivalent is required; a college or university degree is a plus.

Why Join LevelBlue?

At LevelBlue, you’re not just an employee—you’re part of a team making a real difference in the world of cybersecurity. We foster a culture of innovation and creativity where your contributions are valued, and you’ll have the support and resources to grow and thrive.

Benefits and Perks:

• Comprehensive medical, dental, and vision insurance.
• 401(k) with employer matching.
• Generous paid time off and holidays.
• Flexible spending accounts and health savings accounts.
• Employee assistance programs.
• Training and development opportunities.
• Adoption assistance program.

This role is open to candidates legally authorized to work in the United States. At LevelBlue, we support flexible work and bring people together in person for key moments based on role, team, and business needs.

LevelBlue is committed to a culture of respect, inclusion, and equal opportunity. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age, or any other status protected under applicable law.