Job Title: Senior Restoration Engineer, DFIR
Location: Remote (Texas residency required)
Employment Type: Full-Time
Travel: Up to 50%
Role OverviewSenior Restoration Engineer, DFIR
We are seeking a Senior Restoration Engineer to provide hands-on technical leadership for containment, recovery, and restoration on Vector3 Incident Response engagements. Reporting to the Director of Engineering, this engineer will lead the restoration workstream for ransomware, network intrusion, destructive malware, and other cyber incidents. They will help clients bring critical technology services back online while preserving forensic and containment requirements.
This is not a standard infrastructure or disaster recovery role. The successful candidate will assess damaged or compromised environments, build practical restoration plans, direct complex rebuild and recovery work, and validate security controls before systems return to service. They will do this under real-time pressure during active incidents. The Senior Restoration Engineer will work closely with Engagement Managers, forensic consultants, Security Operations Engineers, client IT teams, MSPs, counsel, carriers, and technology vendors, and will provide technical guidance to Restoration Engineers and other delivery resources.
Key Responsibilities- Lead the technical restoration workstream for ransomware, network intrusion, destructive malware, and other cyber incidents, from initial assessment through return to normal operations.
- Quickly assess the client's environment, business-critical services, backups, identity systems, network dependencies, and security tooling to define restoration priorities and sequencing.
- Develop and maintain a practical restoration plan covering dependencies, owners, milestones, risks, and validation requirements.
- Advise Engagement Managers and clients on safe recovery decisions, including whether a system should stay offline, be rebuilt, be restored from backup, or be replaced.
- Lead and perform the rebuild and recovery of Windows servers, endpoints, Active Directory, virtualization platforms, core network services, and other critical infrastructure.
- Support the recovery of Microsoft 365 / Entra ID, file services, DNS, DHCP, VPN, firewalls, remote access, backup platforms, and business-critical applications.
- Validate backup integrity, coordinate test restores, and establish clean recovery points before production restoration.
- Guide credential resets, privileged account recovery, domain hardening, segmentation, EDR deployment, and other containment measures.
- Partner with forensic and security operations teams so that restoration does not compromise evidence or reintroduce a threat actor.
- Confirm endpoint protection, patching, access controls, logging, and network restrictions are in place before restored systems are reconnected.
- Serve as a senior technical point of contact for client IT leadership, providing clear status updates, risks, dependencies, and next steps in restoration meetings and executive updates.
- Maintain accurate restoration records, including systems rebuilt, credentials reset, configurations changed, and validation completed.
- Develop reusable restoration playbooks, checklists, scripts, and standards that improve the speed, quality, and consistency of Vector3 recovery services.
- Provide day-to-day technical guidance and quality review for Restoration Engineers, and support scoping, estimation, and solution design for restoration engagements.
Required Qualifications- Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Information Systems, or a related field; equivalent professional experience may be considered.
- 5+ years of progressive experience in infrastructure engineering, systems administration, disaster recovery, incident response, or ransomware recovery, including leading complex restoration or recovery work.
- Advanced hands-on experience administering and recovering Windows Server, Active Directory, Group Policy, DNS, DHCP, file services, and related enterprise infrastructure.
- Strong experience with virtualization platforms such as VMware or Hyper-V, and with backup, replication, and disaster recovery technologies.
- Working knowledge of network infrastructure and security controls, including firewalls, VPN, routing, segmentation, remote access, and endpoint security tooling.
- Experience with Microsoft 365 / Entra ID and cloud or hybrid identity environments.
- Demonstrated experience rebuilding systems, restoring from backup, validating clean recovery points, and troubleshooting complex infrastructure dependencies under time pressure.
- Ability to participate in rotating after-hours and on-call coverage supporting 24/7/365 Incident Response engagements.
Preferred Qualifications- Experience in digital forensics and incident response, managed services, consulting, or another client-service environment.
- Azure, AWS, or other cloud infrastructure experience.
- Strong scripting or automation skills using PowerShell or similar tools.
- Relevant certifications such as Microsoft, VMware, Cisco, CompTIA, GIAC, or vendor certifications in infrastructure, cloud, backup, or incident response.
Core Competencies- Restoration Leadership: Ability to own the technical recovery workstream and drive it from assessment to return to service.
- Infrastructure Depth: Advanced, hands-on command of Windows, identity, virtualization, and backup environments.
- Secure Recovery Judgment: Ability to balance speed of recovery against containment, evidence preservation, and residual risk.
- Problem Solving Under Pressure: Ability to find alternative recovery paths when systems, configurations, or backups are unavailable.
- Client Communication: Ability to lead technical discussions with client IT leaders and executives during high-stress incidents.
- Technical Mentorship: Ability to guide, review, and raise the quality of work across restoration resources.
Skills & Attributes- Sound technical judgment with the ability to make decisions with incomplete information.
- Ability to manage multiple urgent priorities without losing attention to detail.
- Strong written and verbal communication skills.
- Ability to work independently and effectively in high-pressure environments with frequent interruptions and rapidly changing priorities.
- Willingness to work extended or irregular hours during active incidents, and to work remotely, at a Vector3 office, or on-site at client locations.
What We Offer- Competitive salary and comprehensive benefit package
- Strong learning culture with ongoing development opportunities
- Opportunities for growth and career advancement
- Comprehensive medical, vision, and dental coverage, with eligibility beginning on your first day of employment
- Basic life and disability insurance
- 401(k) plan with 6% company match
- 20 days of PTO and two floating holidays (prorated)
- Approximately 11 paid holidays and volunteer time off
- Paid parental leave
- Access to our award-winning wellness program, including mental health services, fitness network membership, and a complimentary Headspace subscription
- Student loan matching program
- Employee discount program
- An opportunity to do meaningful work and love what you do
#LI-TI #LI-Remote
