Cyber Response & Remediation Delivery Lead

Position Summary

The Remediation Delivery Lead is responsible for leading the technical remediation, containment, and recovery workstreams associated with complex cybersecurity incidents. This individual serves as a key delivery leader within the Cyber Response practice, coordinating technical teams, client stakeholders, incident leadership, and forensic resources to move an affected environment from active response through stabilization and recovery.

The ideal candidate combines strong technical infrastructure and cybersecurity experience with the ability to lead teams and communicate effectively during high-pressure incidents. This role requires someone who can quickly understand a client's environment, identify and prioritize remediation objectives, develop an actionable remediation strategy, coordinate execution across multiple technical workstreams, and clearly communicate progress, risks, dependencies, and decisions to both technical and executive stakeholders.

Key Responsibilities

• • Lead remediation, containment, hardening, and recovery activities during cybersecurity incident response engagements.
  • Develop and manage remediation plans based on incident scope, business priorities, known compromise, forensic findings, and operational dependencies.
  • Coordinate closely with Incident Command, Digital Forensics and Incident Response (DFIR), client IT/security teams, and other stakeholders throughout the engagement.
  • Translate forensic findings and indicators of compromise into actionable containment and remediation activities.
  • Prioritize multiple concurrent technical workstreams and maintain clear ownership, sequencing, dependencies, and status.
  • Guide clients through containment decisions while balancing security objectives, business continuity, evidence preservation, and operational impact.
  • Lead technical and executive-level discussions regarding remediation strategy, recovery priorities, risks, blockers, and overall engagement status.
  • Coordinate infrastructure recovery and security-hardening activities across identity, endpoint, virtualization, network, cloud, and backup environments.
  • Ensure appropriate change control, client authorization, documentation, rollback planning, and coordination with forensic teams before potentially impactful changes are made. This aligns directly with the change-control requirements in the remediation playbooks.
  • Maintain accurate remediation tracking and ensure actions, owners, outcomes, and outstanding risks are clearly communicated.
  • Provide technical leadership and guidance to remediation engineers while remaining capable of engaging directly in complex technical troubleshooting when necessary.
  • Support the continued development of Cyber Response remediation methodologies, playbooks, tooling, and delivery standards.

Technical Experience

Candidates should have strong hands-on or delivery experience across several of the following areas:

• • Active Directory and identity security
    • Active Directory recovery and hardening
    • Privileged account remediation
    • Authentication and identity dependencies
    • Microsoft Entra ID
    • Microsoft 365 identity and security
      
  • Cloud and collaboration platforms
    • Microsoft 365
    • Microsoft Entra ID
    • Google Workspace
      
  • Virtualization and infrastructure
    • VMware vSphere / ESXi
    • Microsoft Hyper-V
    • Windows Server environments
    • Core enterprise infrastructure and network services
      
  • Backup and recovery
    • Veeam Backup & Replication
    • Enterprise backup technologies
    • Backup validation and recovery planning
    • Recovery of critical infrastructure following destructive incidents
      
  • Endpoint security and incident response
    • EDR deployment and management
    • Endpoint containment
    • Triage collection
    • IOC-driven investigation/remediation
    • Security visibility restoration road maps

Preferred Qualifications:

• 4+ years acting in a similar capacity for a technology consulting firm
• Performing broad IT assessments, audits, or due diligence
• Bachelors degree

At RSM, we offer a competitive benefits and compensation package for all our people.Learn more about our total rewards at https://rsmus.com/careers/working-at-rsm/benefits.

We believe flexibility and in-person connection both play an important role in how we work and grow. Most roles at RSM follow a hybrid workstyle, which means team members are aligned to an RSM office and come together in person when it best supports clients, teams, development or relationship-building. Some roles may be virtual or primarily on-site based on role requirements, team priorities and client needs.

At RSM, an employee27s pay at any point in their career is intended to reflect their experiences, performance, and skills for their current role. The salary range (or starting rate for interns and associates) for this role represents numerous factors considered in the hiring decisions including, but not limited to, education, skills, work experience, certifications, location, etc. As such, pay for the successful candidate(s) could fall anywhere within the stated range.